From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id DA6F71382A6 for ; Thu, 2 Jun 2016 19:29:38 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 11CF5142BC; Thu, 2 Jun 2016 19:13:05 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 25929142BC for ; Thu, 2 Jun 2016 19:13:04 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 104AA340E22 for ; Thu, 2 Jun 2016 19:13:02 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id D3D30980 for ; Thu, 2 Jun 2016 19:12:57 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1464894767.b897bcdfc22bddef00a1c5dd7684a5ad72ca3d75.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.5 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 1005_linux-4.5.6.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: b897bcdfc22bddef00a1c5dd7684a5ad72ca3d75 X-VCS-Branch: 4.5 Date: Thu, 2 Jun 2016 19:12:57 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: aa2e68be-8ec7-48ce-ada0-3db8dbbdf0ff X-Archives-Hash: a7d0fc23e20474e2f7f7968f1cb45714 commit: b897bcdfc22bddef00a1c5dd7684a5ad72ca3d75 Author: Mike Pagano gentoo org> AuthorDate: Thu Jun 2 19:12:47 2016 +0000 Commit: Mike Pagano gentoo org> CommitDate: Thu Jun 2 19:12:47 2016 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b897bcdf Replace full 4.5.6 patch with incremental. 1005_linux-4.5.6.patch | 34160 +++++------------------------------------------ 1 file changed, 2980 insertions(+), 31180 deletions(-) diff --git a/1005_linux-4.5.6.patch b/1005_linux-4.5.6.patch index 339ef1c..4b62797 100644 --- a/1005_linux-4.5.6.patch +++ b/1005_linux-4.5.6.patch @@ -1,71 +1,3 @@ -diff --git a/Documentation/cgroup-v2.txt b/Documentation/cgroup-v2.txt -index ff49cf901148..81eb378210c6 100644 ---- a/Documentation/cgroup-v2.txt -+++ b/Documentation/cgroup-v2.txt -@@ -1368,6 +1368,12 @@ system than killing the group. Otherwise, memory.max is there to - limit this type of spillover and ultimately contain buggy or even - malicious applications. - -+Setting the original memory.limit_in_bytes below the current usage was -+subject to a race condition, where concurrent charges could cause the -+limit setting to fail. memory.max on the other hand will first set the -+limit to prevent new charges, and then reclaim and OOM kill until the -+new limit is met - or the task writing to memory.max is killed. -+ - The combined memory+swap accounting and limiting is replaced by real - control over swap space. - -diff --git a/Documentation/devicetree/bindings/ata/ahci-platform.txt b/Documentation/devicetree/bindings/ata/ahci-platform.txt -index c2340eeeb97f..c000832a7fb9 100644 ---- a/Documentation/devicetree/bindings/ata/ahci-platform.txt -+++ b/Documentation/devicetree/bindings/ata/ahci-platform.txt -@@ -30,6 +30,10 @@ Optional properties: - - target-supply : regulator for SATA target power - - phys : reference to the SATA PHY node - - phy-names : must be "sata-phy" -+- ports-implemented : Mask that indicates which ports that the HBA supports -+ are available for software to use. Useful if PORTS_IMPL -+ is not programmed by the BIOS, which is true with -+ some embedded SOC's. - - Required properties when using sub-nodes: - - #address-cells : number of cells to encode an address -diff --git a/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt -index 08a4a32c8eb0..0326154c7925 100644 ---- a/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt -+++ b/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt -@@ -134,12 +134,12 @@ mfio80 ddr_debug, mips_trace_data, mips_debug - mfio81 dreq0, mips_trace_data, eth_debug - mfio82 dreq1, mips_trace_data, eth_debug - mfio83 mips_pll_lock, mips_trace_data, usb_debug --mfio84 sys_pll_lock, mips_trace_data, usb_debug --mfio85 wifi_pll_lock, mips_trace_data, sdhost_debug --mfio86 bt_pll_lock, mips_trace_data, sdhost_debug --mfio87 rpu_v_pll_lock, dreq2, socif_debug --mfio88 rpu_l_pll_lock, dreq3, socif_debug --mfio89 audio_pll_lock, dreq4, dreq5 -+mfio84 audio_pll_lock, mips_trace_data, usb_debug -+mfio85 rpu_v_pll_lock, mips_trace_data, sdhost_debug -+mfio86 rpu_l_pll_lock, mips_trace_data, sdhost_debug -+mfio87 sys_pll_lock, dreq2, socif_debug -+mfio88 wifi_pll_lock, dreq3, socif_debug -+mfio89 bt_pll_lock, dreq4, dreq5 - tck - trstn - tdi -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 9a53c929f017..21e4b4861331 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -4016,6 +4016,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - sector if the number is odd); - i = IGNORE_DEVICE (don't bind to this - device); -+ j = NO_REPORT_LUNS (don't use report luns -+ command, uas only); - l = NOT_LOCKABLE (don't try to lock and - unlock ejectable media); - m = MAX_SECTORS_64 (don't transfer more diff --git a/Documentation/serial/tty.txt b/Documentation/serial/tty.txt index bc3842dc323a..e2dea3dc4307 100644 --- a/Documentation/serial/tty.txt @@ -80,430 +12,14 @@ index bc3842dc323a..e2dea3dc4307 100644 TTY_NO_WRITE_SPLIT Prevent driver from splitting up writes into smaller chunks. -diff --git a/MAINTAINERS b/MAINTAINERS -index 6ee06ea47be4..77e4c10b4c06 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -228,13 +228,13 @@ F: kernel/sys_ni.c - - ABIT UGURU 1,2 HARDWARE MONITOR DRIVER - M: Hans de Goede --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: drivers/hwmon/abituguru.c - - ABIT UGURU 3 HARDWARE MONITOR DRIVER - M: Alistair John Strachan --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: drivers/hwmon/abituguru3.c - -@@ -386,14 +386,14 @@ F: Documentation/devicetree/bindings/net/ieee802154/adf7242.txt - - ADM1025 HARDWARE MONITOR DRIVER - M: Jean Delvare --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/adm1025 - F: drivers/hwmon/adm1025.c - - ADM1029 HARDWARE MONITOR DRIVER - M: Corentin Labbe --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: drivers/hwmon/adm1029.c - -@@ -438,7 +438,7 @@ F: drivers/video/backlight/adp8860_bl.c - - ADS1015 HARDWARE MONITOR DRIVER - M: Dirk Eibach --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/ads1015 - F: drivers/hwmon/ads1015.c -@@ -451,7 +451,7 @@ F: drivers/macintosh/therm_adt746x.c - - ADT7475 HARDWARE MONITOR DRIVER - M: Jean Delvare --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/adt7475 - F: drivers/hwmon/adt7475.c -@@ -628,7 +628,7 @@ F: include/linux/ccp.h - - AMD FAM15H PROCESSOR POWER MONITORING DRIVER - M: Huang Rui --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Supported - F: Documentation/hwmon/fam15h_power - F: drivers/hwmon/fam15h_power.c -@@ -786,7 +786,7 @@ F: drivers/input/mouse/bcm5974.c - - APPLE SMC DRIVER - M: Henrik Rydberg --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Odd fixes - F: drivers/hwmon/applesmc.c - -@@ -1825,7 +1825,7 @@ F: include/media/i2c/as3645a.h - - ASC7621 HARDWARE MONITOR DRIVER - M: George Joseph --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/asc7621 - F: drivers/hwmon/asc7621.c -@@ -1918,7 +1918,7 @@ F: drivers/net/wireless/ath/carl9170/ - - ATK0110 HWMON DRIVER - M: Luca Tettamanti --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: drivers/hwmon/asus_atk0110.c - -@@ -3037,7 +3037,7 @@ F: mm/swap_cgroup.c - - CORETEMP HARDWARE MONITORING DRIVER - M: Fenghua Yu --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/coretemp - F: drivers/hwmon/coretemp.c -@@ -3625,7 +3625,7 @@ T: git git://git.infradead.org/users/vkoul/slave-dma.git - - DME1737 HARDWARE MONITOR DRIVER - M: Juerg Haefliger --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/dme1737 - F: drivers/hwmon/dme1737.c -@@ -4163,8 +4163,8 @@ F: Documentation/efi-stub.txt - F: arch/ia64/kernel/efi.c - F: arch/x86/boot/compressed/eboot.[ch] - F: arch/x86/include/asm/efi.h --F: arch/x86/platform/efi/* --F: drivers/firmware/efi/* -+F: arch/x86/platform/efi/ -+F: drivers/firmware/efi/ - F: include/linux/efi*.h - - EFI VARIABLE FILESYSTEM -@@ -4322,7 +4322,7 @@ F: include/video/exynos_mipi* - - F71805F HARDWARE MONITORING DRIVER - M: Jean Delvare --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/f71805f - F: drivers/hwmon/f71805f.c -@@ -4401,7 +4401,7 @@ F: fs/* - - FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER - M: Riku Voipio --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: drivers/hwmon/f75375s.c - F: include/linux/f75375s.h -@@ -4958,8 +4958,8 @@ F: drivers/media/usb/hackrf/ - HARDWARE MONITORING - M: Jean Delvare - M: Guenter Roeck --L: lm-sensors@lm-sensors.org --W: http://www.lm-sensors.org/ -+L: linux-hwmon@vger.kernel.org -+W: http://hwmon.wiki.kernel.org/ - T: quilt http://jdelvare.nerim.net/devel/linux/jdelvare-hwmon/ - T: git git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging.git - S: Maintained -@@ -5484,7 +5484,7 @@ F: drivers/usb/atm/ueagle-atm.c - - INA209 HARDWARE MONITOR DRIVER - M: Guenter Roeck --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/ina209 - F: Documentation/devicetree/bindings/i2c/ina209.txt -@@ -5492,7 +5492,7 @@ F: drivers/hwmon/ina209.c - - INA2XX HARDWARE MONITOR DRIVER - M: Guenter Roeck --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/ina2xx - F: drivers/hwmon/ina2xx.c -@@ -5985,7 +5985,7 @@ F: drivers/isdn/hardware/eicon/ - - IT87 HARDWARE MONITORING DRIVER - M: Jean Delvare --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/it87 - F: drivers/hwmon/it87.c -@@ -6021,7 +6021,7 @@ F: drivers/media/dvb-frontends/ix2505v* - - JC42.4 TEMPERATURE SENSOR DRIVER - M: Guenter Roeck --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: drivers/hwmon/jc42.c - F: Documentation/hwmon/jc42 -@@ -6071,14 +6071,14 @@ F: drivers/tty/serial/jsm/ - - K10TEMP HARDWARE MONITORING DRIVER - M: Clemens Ladisch --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/k10temp - F: drivers/hwmon/k10temp.c - - K8TEMP HARDWARE MONITORING DRIVER - M: Rudolf Marek --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/k8temp - F: drivers/hwmon/k8temp.c -@@ -6605,27 +6605,27 @@ F: net/llc/ - - LM73 HARDWARE MONITOR DRIVER - M: Guillaume Ligneul --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: drivers/hwmon/lm73.c - - LM78 HARDWARE MONITOR DRIVER - M: Jean Delvare --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/lm78 - F: drivers/hwmon/lm78.c - - LM83 HARDWARE MONITOR DRIVER - M: Jean Delvare --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/lm83 - F: drivers/hwmon/lm83.c - - LM90 HARDWARE MONITOR DRIVER - M: Jean Delvare --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/lm90 - F: Documentation/devicetree/bindings/hwmon/lm90.txt -@@ -6633,7 +6633,7 @@ F: drivers/hwmon/lm90.c - - LM95234 HARDWARE MONITOR DRIVER - M: Guenter Roeck --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/lm95234 - F: drivers/hwmon/lm95234.c -@@ -6700,7 +6700,7 @@ F: drivers/scsi/sym53c8xx_2/ - - LTC4261 HARDWARE MONITOR DRIVER - M: Guenter Roeck --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/ltc4261 - F: drivers/hwmon/ltc4261.c -@@ -6870,28 +6870,28 @@ F: include/uapi/linux/matroxfb.h - - MAX16065 HARDWARE MONITOR DRIVER - M: Guenter Roeck --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/max16065 - F: drivers/hwmon/max16065.c - - MAX20751 HARDWARE MONITOR DRIVER - M: Guenter Roeck --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/max20751 - F: drivers/hwmon/max20751.c - - MAX6650 HARDWARE MONITOR AND FAN CONTROLLER DRIVER - M: "Hans J. Koch" --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/max6650 - F: drivers/hwmon/max6650.c - - MAX6697 HARDWARE MONITOR DRIVER - M: Guenter Roeck --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/max6697 - F: Documentation/devicetree/bindings/i2c/max6697.txt -@@ -7455,7 +7455,7 @@ F: drivers/scsi/NCR_D700.* - - NCT6775 HARDWARE MONITOR DRIVER - M: Guenter Roeck --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/nct6775 - F: drivers/hwmon/nct6775.c -@@ -8235,7 +8235,7 @@ F: drivers/video/logo/logo_parisc* - - PC87360 HARDWARE MONITORING DRIVER - M: Jim Cromie --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/pc87360 - F: drivers/hwmon/pc87360.c -@@ -8247,7 +8247,7 @@ F: drivers/char/pc8736x_gpio.c - - PC87427 HARDWARE MONITORING DRIVER - M: Jean Delvare --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/pc87427 - F: drivers/hwmon/pc87427.c -@@ -8601,8 +8601,8 @@ F: drivers/rtc/rtc-puv3.c - - PMBUS HARDWARE MONITORING DRIVERS - M: Guenter Roeck --L: lm-sensors@lm-sensors.org --W: http://www.lm-sensors.org/ -+L: linux-hwmon@vger.kernel.org -+W: http://hwmon.wiki.kernel.org/ - W: http://www.roeck-us.net/linux/drivers/ - T: git git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging.git - S: Maintained -@@ -8807,7 +8807,7 @@ F: drivers/media/usb/pwc/* - - PWM FAN DRIVER - M: Kamil Debski --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Supported - F: Documentation/devicetree/bindings/hwmon/pwm-fan.txt - F: Documentation/hwmon/pwm-fan -@@ -10113,28 +10113,28 @@ F: Documentation/devicetree/bindings/media/i2c/nokia,smia.txt - - SMM665 HARDWARE MONITOR DRIVER - M: Guenter Roeck --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/smm665 - F: drivers/hwmon/smm665.c - - SMSC EMC2103 HARDWARE MONITOR DRIVER - M: Steve Glendinning --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/emc2103 - F: drivers/hwmon/emc2103.c - - SMSC SCH5627 HARDWARE MONITOR DRIVER - M: Hans de Goede --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Supported - F: Documentation/hwmon/sch5627 - F: drivers/hwmon/sch5627.c - - SMSC47B397 HARDWARE MONITOR DRIVER - M: Jean Delvare --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/smsc47b397 - F: drivers/hwmon/smsc47b397.c -@@ -11067,7 +11067,7 @@ F: include/linux/mmc/sh_mobile_sdhi.h - - TMP401 HARDWARE MONITOR DRIVER - M: Guenter Roeck --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/tmp401 - F: drivers/hwmon/tmp401.c -@@ -11812,14 +11812,14 @@ F: Documentation/networking/vrf.txt - - VT1211 HARDWARE MONITOR DRIVER - M: Juerg Haefliger --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/vt1211 - F: drivers/hwmon/vt1211.c - - VT8231 HARDWARE MONITOR DRIVER - M: Roger Lucas --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: drivers/hwmon/vt8231.c - -@@ -11838,21 +11838,21 @@ F: drivers/w1/ - - W83791D HARDWARE MONITORING DRIVER - M: Marc Hulsman --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/w83791d - F: drivers/hwmon/w83791d.c - - W83793 HARDWARE MONITORING DRIVER - M: Rudolf Marek --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: Documentation/hwmon/w83793 - F: drivers/hwmon/w83793.c - - W83795 HARDWARE MONITORING DRIVER - M: Jean Delvare --L: lm-sensors@lm-sensors.org -+L: linux-hwmon@vger.kernel.org - S: Maintained - F: drivers/hwmon/w83795.c - diff --git a/Makefile b/Makefile -index 7b3ecdcdc6c1..07a1786f695a 100644 +index a23df411d393..07a1786f695a 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ VERSION = 4 PATCHLEVEL = 5 --SUBLEVEL = 0 +-SUBLEVEL = 5 +SUBLEVEL = 6 EXTRAVERSION = NAME = Blurry Fish Butt @@ -521,294 +37,6 @@ index 7b3ecdcdc6c1..07a1786f695a 100644 endif ifdef CONFIG_FRAME_POINTER -diff --git a/arch/arc/boot/dts/axs10x_mb.dtsi b/arch/arc/boot/dts/axs10x_mb.dtsi -index 44a578c10732..ab5d5701e11d 100644 ---- a/arch/arc/boot/dts/axs10x_mb.dtsi -+++ b/arch/arc/boot/dts/axs10x_mb.dtsi -@@ -47,6 +47,14 @@ - clocks = <&apbclk>; - clock-names = "stmmaceth"; - max-speed = <100>; -+ mdio0 { -+ #address-cells = <1>; -+ #size-cells = <0>; -+ compatible = "snps,dwmac-mdio"; -+ phy1: ethernet-phy@1 { -+ reg = <1>; -+ }; -+ }; - }; - - ehci@0x40000 { -diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h -index 57c1f33844d4..0352fb8d21b9 100644 ---- a/arch/arc/include/asm/bitops.h -+++ b/arch/arc/include/asm/bitops.h -@@ -35,21 +35,6 @@ static inline void op##_bit(unsigned long nr, volatile unsigned long *m)\ - \ - m += nr >> 5; \ - \ -- /* \ -- * ARC ISA micro-optimization: \ -- * \ -- * Instructions dealing with bitpos only consider lower 5 bits \ -- * e.g (x << 33) is handled like (x << 1) by ASL instruction \ -- * (mem pointer still needs adjustment to point to next word) \ -- * \ -- * Hence the masking to clamp @nr arg can be elided in general. \ -- * \ -- * However if @nr is a constant (above assumed in a register), \ -- * and greater than 31, gcc can optimize away (x << 33) to 0, \ -- * as overflow, given the 32-bit ISA. Thus masking needs to be \ -- * done for const @nr, but no code is generated due to gcc \ -- * const prop. \ -- */ \ - nr &= 0x1f; \ - \ - __asm__ __volatile__( \ -diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h -index 694ece8a0243..cb69299a492e 100644 ---- a/arch/arc/include/asm/io.h -+++ b/arch/arc/include/asm/io.h -@@ -13,6 +13,15 @@ - #include - #include - -+#ifdef CONFIG_ISA_ARCV2 -+#include -+#define __iormb() rmb() -+#define __iowmb() wmb() -+#else -+#define __iormb() do { } while (0) -+#define __iowmb() do { } while (0) -+#endif -+ - extern void __iomem *ioremap(unsigned long physaddr, unsigned long size); - extern void __iomem *ioremap_prot(phys_addr_t offset, unsigned long size, - unsigned long flags); -@@ -22,6 +31,15 @@ extern void iounmap(const void __iomem *addr); - #define ioremap_wc(phy, sz) ioremap(phy, sz) - #define ioremap_wt(phy, sz) ioremap(phy, sz) - -+/* -+ * io{read,write}{16,32}be() macros -+ */ -+#define ioread16be(p) ({ u16 __v = be16_to_cpu((__force __be16)__raw_readw(p)); __iormb(); __v; }) -+#define ioread32be(p) ({ u32 __v = be32_to_cpu((__force __be32)__raw_readl(p)); __iormb(); __v; }) -+ -+#define iowrite16be(v,p) ({ __iowmb(); __raw_writew((__force u16)cpu_to_be16(v), p); }) -+#define iowrite32be(v,p) ({ __iowmb(); __raw_writel((__force u32)cpu_to_be32(v), p); }) -+ - /* Change struct page to physical address */ - #define page_to_phys(page) (page_to_pfn(page) << PAGE_SHIFT) - -@@ -99,15 +117,6 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr) - - } - --#ifdef CONFIG_ISA_ARCV2 --#include --#define __iormb() rmb() --#define __iowmb() wmb() --#else --#define __iormb() do { } while (0) --#define __iowmb() do { } while (0) --#endif -- - /* - * MMIO can also get buffered/optimized in micro-arch, so barriers needed - * Based on ARM model for the typical use case -@@ -129,15 +138,23 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr) - #define writel(v,c) ({ __iowmb(); writel_relaxed(v,c); }) - - /* -- * Relaxed API for drivers which can handle any ordering themselves -+ * Relaxed API for drivers which can handle barrier ordering themselves -+ * -+ * Also these are defined to perform little endian accesses. -+ * To provide the typical device register semantics of fixed endian, -+ * swap the byte order for Big Endian -+ * -+ * http://lkml.kernel.org/r/201603100845.30602.arnd@arndb.de - */ - #define readb_relaxed(c) __raw_readb(c) --#define readw_relaxed(c) __raw_readw(c) --#define readl_relaxed(c) __raw_readl(c) -+#define readw_relaxed(c) ({ u16 __r = le16_to_cpu((__force __le16) \ -+ __raw_readw(c)); __r; }) -+#define readl_relaxed(c) ({ u32 __r = le32_to_cpu((__force __le32) \ -+ __raw_readl(c)); __r; }) - - #define writeb_relaxed(v,c) __raw_writeb(v,c) --#define writew_relaxed(v,c) __raw_writew(v,c) --#define writel_relaxed(v,c) __raw_writel(v,c) -+#define writew_relaxed(v,c) __raw_writew((__force u16) cpu_to_le16(v),c) -+#define writel_relaxed(v,c) __raw_writel((__force u32) cpu_to_le32(v),c) - - #include - -diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi -index 1fafaad516ba..97471d62d5e4 100644 ---- a/arch/arm/boot/dts/am33xx.dtsi -+++ b/arch/arm/boot/dts/am33xx.dtsi -@@ -860,7 +860,7 @@ - ti,no-idle-on-init; - reg = <0x50000000 0x2000>; - interrupts = <100>; -- dmas = <&edma 52>; -+ dmas = <&edma 52 0>; - dma-names = "rxtx"; - gpmc,num-cs = <7>; - gpmc,num-waitpins = <2>; -diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi -index 92068fbf8b57..6bd38a28e26c 100644 ---- a/arch/arm/boot/dts/am4372.dtsi -+++ b/arch/arm/boot/dts/am4372.dtsi -@@ -207,7 +207,7 @@ - ti,tptcs = <&edma_tptc0 7>, <&edma_tptc1 5>, - <&edma_tptc2 0>; - -- ti,edma-memcpy-channels = <32 33>; -+ ti,edma-memcpy-channels = <58 59>; - }; - - edma_tptc0: tptc@49800000 { -@@ -884,7 +884,7 @@ - gpmc: gpmc@50000000 { - compatible = "ti,am3352-gpmc"; - ti,hwmods = "gpmc"; -- dmas = <&edma 52>; -+ dmas = <&edma 52 0>; - dma-names = "rxtx"; - clocks = <&l3s_gclk>; - clock-names = "fck"; -diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts -index d580e2b70f9a..637dc5dbc8ac 100644 ---- a/arch/arm/boot/dts/am43x-epos-evm.dts -+++ b/arch/arm/boot/dts/am43x-epos-evm.dts -@@ -792,3 +792,8 @@ - tx-num-evt = <32>; - rx-num-evt = <32>; - }; -+ -+&synctimer_32kclk { -+ assigned-clocks = <&mux_synctimer32k_ck>; -+ assigned-clock-parents = <&clkdiv32k_ick>; -+}; -diff --git a/arch/arm/boot/dts/armada-375.dtsi b/arch/arm/boot/dts/armada-375.dtsi -index 7ccce7529b0c..cc952cf8ec30 100644 ---- a/arch/arm/boot/dts/armada-375.dtsi -+++ b/arch/arm/boot/dts/armada-375.dtsi -@@ -529,7 +529,7 @@ - }; - - sata@a0000 { -- compatible = "marvell,orion-sata"; -+ compatible = "marvell,armada-370-sata"; - reg = <0xa0000 0x5000>; - interrupts = ; - clocks = <&gateclk 14>, <&gateclk 20>; -diff --git a/arch/arm/boot/dts/armada-385-linksys.dtsi b/arch/arm/boot/dts/armada-385-linksys.dtsi -index 3710755c6d76..85d2c377c332 100644 ---- a/arch/arm/boot/dts/armada-385-linksys.dtsi -+++ b/arch/arm/boot/dts/armada-385-linksys.dtsi -@@ -117,7 +117,7 @@ - }; - - /* USB part of the eSATA/USB 2.0 port */ -- usb@50000 { -+ usb@58000 { - status = "okay"; - }; - -diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts -index ff888d21c786..f3e2b96c06a3 100644 ---- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts -+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts -@@ -303,6 +303,7 @@ - regulator-name = "mmc0-card-supply"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; -+ regulator-always-on; - }; - - gpio_keys { -diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts -index 569026e8f96c..da84e65b56ef 100644 ---- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts -+++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts -@@ -268,5 +268,6 @@ - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; - vin-supply = <&vcc_3v3_reg>; -+ regulator-always-on; - }; - }; -diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi -index 0827d594b1f0..cd0cd5fd09a3 100644 ---- a/arch/arm/boot/dts/at91sam9x5.dtsi -+++ b/arch/arm/boot/dts/at91sam9x5.dtsi -@@ -106,7 +106,7 @@ - - pmc: pmc@fffffc00 { - compatible = "atmel,at91sam9x5-pmc", "syscon"; -- reg = <0xfffffc00 0x100>; -+ reg = <0xfffffc00 0x200>; - interrupts = <1 IRQ_TYPE_LEVEL_HIGH 7>; - interrupt-controller; - #address-cells = <1>; -diff --git a/arch/arm/boot/dts/pxa3xx.dtsi b/arch/arm/boot/dts/pxa3xx.dtsi -index cf6998a0804d..564341af7e97 100644 ---- a/arch/arm/boot/dts/pxa3xx.dtsi -+++ b/arch/arm/boot/dts/pxa3xx.dtsi -@@ -30,7 +30,7 @@ - reg = <0x43100000 90>; - interrupts = <45>; - clocks = <&clks CLK_NAND>; -- dmas = <&pdma 97>; -+ dmas = <&pdma 97 3>; - dma-names = "data"; - #address-cells = <1>; - #size-cells = <1>; -diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi -index ed521e85e208..e8bc7e8bedd2 100644 ---- a/arch/arm/boot/dts/qcom-apq8064.dtsi -+++ b/arch/arm/boot/dts/qcom-apq8064.dtsi -@@ -665,7 +665,7 @@ - }; - - sata0: sata@29000000 { -- compatible = "generic-ahci"; -+ compatible = "qcom,apq8064-ahci", "generic-ahci"; - status = "disabled"; - reg = <0x29000000 0x180>; - interrupts = ; -@@ -687,6 +687,7 @@ - - phys = <&sata_phy0>; - phy-names = "sata-phy"; -+ ports-implemented = <0x1>; - }; - - /* Temporary fixed regulator */ -diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c -index 7d0cba6f1cc5..c86ea8aac203 100644 ---- a/arch/arm/kernel/setup.c -+++ b/arch/arm/kernel/setup.c -@@ -430,11 +430,13 @@ static void __init patch_aeabi_idiv(void) - pr_info("CPU: div instructions available: patching division code\n"); - - fn_addr = ((uintptr_t)&__aeabi_uidiv) & ~1; -+ asm ("" : "+g" (fn_addr)); - ((u32 *)fn_addr)[0] = udiv_instruction(); - ((u32 *)fn_addr)[1] = bx_lr_instruction(); - flush_icache_range(fn_addr, fn_addr + 8); - - fn_addr = ((uintptr_t)&__aeabi_idiv) & ~1; -+ asm ("" : "+g" (fn_addr)); - ((u32 *)fn_addr)[0] = sdiv_instruction(); - ((u32 *)fn_addr)[1] = bx_lr_instruction(); - flush_icache_range(fn_addr, fn_addr + 8); diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c index aba61fd3697a..88323ffb1ee0 100644 --- a/arch/arm/kvm/mmu.c @@ -849,216 +77,6 @@ index aba61fd3697a..88323ffb1ee0 100644 return 0; } -diff --git a/arch/arm/mach-cns3xxx/pcie.c b/arch/arm/mach-cns3xxx/pcie.c -index 47905a50e075..318394ed5c7a 100644 ---- a/arch/arm/mach-cns3xxx/pcie.c -+++ b/arch/arm/mach-cns3xxx/pcie.c -@@ -220,13 +220,13 @@ static void cns3xxx_write_config(struct cns3xxx_pcie *cnspci, - u32 mask = (0x1ull << (size * 8)) - 1; - int shift = (where % 4) * 8; - -- v = readl_relaxed(base + (where & 0xffc)); -+ v = readl_relaxed(base); - - v &= ~(mask << shift); - v |= (val & mask) << shift; - -- writel_relaxed(v, base + (where & 0xffc)); -- readl_relaxed(base + (where & 0xffc)); -+ writel_relaxed(v, base); -+ readl_relaxed(base); - } - - static void __init cns3xxx_pcie_hw_init(struct cns3xxx_pcie *cnspci) -diff --git a/arch/arm/mach-exynos/Kconfig b/arch/arm/mach-exynos/Kconfig -index 652a0bb11578..5189bcecad12 100644 ---- a/arch/arm/mach-exynos/Kconfig -+++ b/arch/arm/mach-exynos/Kconfig -@@ -27,6 +27,7 @@ menuconfig ARCH_EXYNOS - select S5P_DEV_MFC - select SRAM - select THERMAL -+ select THERMAL_OF - select MFD_SYSCON - select CLKSRC_EXYNOS_MCT - select POWER_RESET -diff --git a/arch/arm/mach-exynos/pm_domains.c b/arch/arm/mach-exynos/pm_domains.c -index 7c21760f590f..875a2bab64f6 100644 ---- a/arch/arm/mach-exynos/pm_domains.c -+++ b/arch/arm/mach-exynos/pm_domains.c -@@ -92,7 +92,7 @@ static int exynos_pd_power(struct generic_pm_domain *domain, bool power_on) - if (IS_ERR(pd->clk[i])) - break; - -- if (IS_ERR(pd->clk[i])) -+ if (IS_ERR(pd->pclk[i])) - continue; /* Skip on first power up */ - if (clk_set_parent(pd->clk[i], pd->pclk[i])) - pr_err("%s: error setting parent to clock%d\n", -diff --git a/arch/arm/mach-omap2/cpuidle34xx.c b/arch/arm/mach-omap2/cpuidle34xx.c -index aa7b379e2661..2a3db0bd9e15 100644 ---- a/arch/arm/mach-omap2/cpuidle34xx.c -+++ b/arch/arm/mach-omap2/cpuidle34xx.c -@@ -34,6 +34,7 @@ - #include "pm.h" - #include "control.h" - #include "common.h" -+#include "soc.h" - - /* Mach specific information to be recorded in the C-state driver_data */ - struct omap3_idle_statedata { -@@ -315,6 +316,69 @@ static struct cpuidle_driver omap3_idle_driver = { - .safe_state_index = 0, - }; - -+/* -+ * Numbers based on measurements made in October 2009 for PM optimized kernel -+ * with CPU freq enabled on device Nokia N900. Assumes OPP2 (main idle OPP, -+ * and worst case latencies). -+ */ -+static struct cpuidle_driver omap3430_idle_driver = { -+ .name = "omap3430_idle", -+ .owner = THIS_MODULE, -+ .states = { -+ { -+ .enter = omap3_enter_idle_bm, -+ .exit_latency = 110 + 162, -+ .target_residency = 5, -+ .name = "C1", -+ .desc = "MPU ON + CORE ON", -+ }, -+ { -+ .enter = omap3_enter_idle_bm, -+ .exit_latency = 106 + 180, -+ .target_residency = 309, -+ .name = "C2", -+ .desc = "MPU ON + CORE ON", -+ }, -+ { -+ .enter = omap3_enter_idle_bm, -+ .exit_latency = 107 + 410, -+ .target_residency = 46057, -+ .name = "C3", -+ .desc = "MPU RET + CORE ON", -+ }, -+ { -+ .enter = omap3_enter_idle_bm, -+ .exit_latency = 121 + 3374, -+ .target_residency = 46057, -+ .name = "C4", -+ .desc = "MPU OFF + CORE ON", -+ }, -+ { -+ .enter = omap3_enter_idle_bm, -+ .exit_latency = 855 + 1146, -+ .target_residency = 46057, -+ .name = "C5", -+ .desc = "MPU RET + CORE RET", -+ }, -+ { -+ .enter = omap3_enter_idle_bm, -+ .exit_latency = 7580 + 4134, -+ .target_residency = 484329, -+ .name = "C6", -+ .desc = "MPU OFF + CORE RET", -+ }, -+ { -+ .enter = omap3_enter_idle_bm, -+ .exit_latency = 7505 + 15274, -+ .target_residency = 484329, -+ .name = "C7", -+ .desc = "MPU OFF + CORE OFF", -+ }, -+ }, -+ .state_count = ARRAY_SIZE(omap3_idle_data), -+ .safe_state_index = 0, -+}; -+ - /* Public functions */ - - /** -@@ -333,5 +397,8 @@ int __init omap3_idle_init(void) - if (!mpu_pd || !core_pd || !per_pd || !cam_pd) - return -ENODEV; - -- return cpuidle_register(&omap3_idle_driver, NULL); -+ if (cpu_is_omap3430()) -+ return cpuidle_register(&omap3430_idle_driver, NULL); -+ else -+ return cpuidle_register(&omap3_idle_driver, NULL); - } -diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c -index 3c87e40650cf..9821be6dfd5e 100644 ---- a/arch/arm/mach-omap2/io.c -+++ b/arch/arm/mach-omap2/io.c -@@ -368,6 +368,7 @@ void __init omap5_map_io(void) - void __init dra7xx_map_io(void) - { - iotable_init(dra7xx_io_desc, ARRAY_SIZE(dra7xx_io_desc)); -+ omap_barriers_init(); - } - #endif - /* -diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c -index b6d62e4cdfdd..2af6ff63e3b4 100644 ---- a/arch/arm/mach-omap2/omap_hwmod.c -+++ b/arch/arm/mach-omap2/omap_hwmod.c -@@ -1416,9 +1416,7 @@ static void _enable_sysc(struct omap_hwmod *oh) - (sf & SYSC_HAS_CLOCKACTIVITY)) - _set_clockactivity(oh, oh->class->sysc->clockact, &v); - -- /* If the cached value is the same as the new value, skip the write */ -- if (oh->_sysc_cache != v) -- _write_sysconfig(v, oh); -+ _write_sysconfig(v, oh); - - /* - * Set the autoidle bit only after setting the smartidle bit -@@ -1481,7 +1479,9 @@ static void _idle_sysc(struct omap_hwmod *oh) - _set_master_standbymode(oh, idlemode, &v); - } - -- _write_sysconfig(v, oh); -+ /* If the cached value is the same as the new value, skip the write */ -+ if (oh->_sysc_cache != v) -+ _write_sysconfig(v, oh); - } - - /** -diff --git a/arch/arm/mach-prima2/Kconfig b/arch/arm/mach-prima2/Kconfig -index f998eb1c698e..0cf4426183cf 100644 ---- a/arch/arm/mach-prima2/Kconfig -+++ b/arch/arm/mach-prima2/Kconfig -@@ -2,6 +2,7 @@ menuconfig ARCH_SIRF - bool "CSR SiRF" - depends on ARCH_MULTI_V7 - select ARCH_HAS_RESET_CONTROLLER -+ select RESET_CONTROLLER - select ARCH_REQUIRE_GPIOLIB - select GENERIC_IRQ_CHIP - select NO_IOPORT_MAP -diff --git a/arch/arm/mach-socfpga/headsmp.S b/arch/arm/mach-socfpga/headsmp.S -index 5d94b7a2fb10..c160fa3007e9 100644 ---- a/arch/arm/mach-socfpga/headsmp.S -+++ b/arch/arm/mach-socfpga/headsmp.S -@@ -13,6 +13,7 @@ - #include - - .arch armv7-a -+ .arm - - ENTRY(secondary_trampoline) - /* CPU1 will always fetch from 0x0 when it is brought out of reset. -diff --git a/arch/arm64/include/asm/opcodes.h b/arch/arm64/include/asm/opcodes.h -index 4e603ea36ad3..123f45d92cd1 100644 ---- a/arch/arm64/include/asm/opcodes.h -+++ b/arch/arm64/include/asm/opcodes.h -@@ -1 +1,5 @@ -+#ifdef CONFIG_CPU_BIG_ENDIAN -+#define CONFIG_CPU_ENDIAN_BE8 CONFIG_CPU_BIG_ENDIAN -+#endif -+ - #include <../../arm/include/asm/opcodes.h> diff --git a/arch/arm64/include/asm/pgtable-hwdef.h b/arch/arm64/include/asm/pgtable-hwdef.h index 5c25b831273d..9786f770088d 100644 --- a/arch/arm64/include/asm/pgtable-hwdef.h @@ -1072,18 +90,9 @@ index 5c25b831273d..9786f770088d 100644 #define PMD_SECT_RDONLY (_AT(pmdval_t, 1) << 7) /* AP[2] */ #define PMD_SECT_S (_AT(pmdval_t, 3) << 8) diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h -index 819aff5d593f..137d3bf88e2a 100644 +index 7273210782d5..137d3bf88e2a 100644 --- a/arch/arm64/include/asm/pgtable.h +++ b/arch/arm64/include/asm/pgtable.h -@@ -279,7 +279,7 @@ extern void __sync_icache_dcache(pte_t pteval, unsigned long addr); - static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, - pte_t *ptep, pte_t pte) - { -- if (pte_valid(pte)) { -+ if (pte_present(pte)) { - if (pte_sw_dirty(pte) && pte_write(pte)) - pte_val(pte) &= ~PTE_RDONLY; - else @@ -356,6 +356,7 @@ static inline pgprot_t mk_sect_prot(pgprot_t prot) #define pmd_trans_huge(pmd) (pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT)) #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ @@ -1144,14 +153,6 @@ index 819aff5d593f..137d3bf88e2a 100644 { return pte_pmd(ptep_get_and_clear(mm, address, (pte_t *)pmdp)); } -@@ -649,6 +664,7 @@ extern pgd_t idmap_pg_dir[PTRS_PER_PGD]; - * bits 0-1: present (must be zero) - * bits 2-7: swap type - * bits 8-57: swap offset -+ * bit 58: PTE_PROT_NONE (must be zero) - */ - #define __SWP_TYPE_SHIFT 2 - #define __SWP_TYPE_BITS 6 diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c index 212ae6361d8b..a5f234039616 100644 --- a/arch/arm64/kernel/cpuinfo.c @@ -1166,58 +167,6 @@ index 212ae6361d8b..a5f234039616 100644 }; static const char *const compat_hwcap2_str[] = { -diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c -index c536c9e307b9..0931155f6406 100644 ---- a/arch/arm64/kernel/debug-monitors.c -+++ b/arch/arm64/kernel/debug-monitors.c -@@ -186,20 +186,21 @@ static void clear_regs_spsr_ss(struct pt_regs *regs) - - /* EL1 Single Step Handler hooks */ - static LIST_HEAD(step_hook); --static DEFINE_RWLOCK(step_hook_lock); -+static DEFINE_SPINLOCK(step_hook_lock); - - void register_step_hook(struct step_hook *hook) - { -- write_lock(&step_hook_lock); -- list_add(&hook->node, &step_hook); -- write_unlock(&step_hook_lock); -+ spin_lock(&step_hook_lock); -+ list_add_rcu(&hook->node, &step_hook); -+ spin_unlock(&step_hook_lock); - } - - void unregister_step_hook(struct step_hook *hook) - { -- write_lock(&step_hook_lock); -- list_del(&hook->node); -- write_unlock(&step_hook_lock); -+ spin_lock(&step_hook_lock); -+ list_del_rcu(&hook->node); -+ spin_unlock(&step_hook_lock); -+ synchronize_rcu(); - } - - /* -@@ -213,15 +214,15 @@ static int call_step_hook(struct pt_regs *regs, unsigned int esr) - struct step_hook *hook; - int retval = DBG_HOOK_ERROR; - -- read_lock(&step_hook_lock); -+ rcu_read_lock(); - -- list_for_each_entry(hook, &step_hook, node) { -+ list_for_each_entry_rcu(hook, &step_hook, node) { - retval = hook->fn(regs, esr); - if (retval == DBG_HOOK_HANDLED) - break; - } - -- read_unlock(&step_hook_lock); -+ rcu_read_unlock(); - - return retval; - } diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c index 4d1ac81870d2..e9e0e6db73f6 100644 --- a/arch/arm64/kvm/inject_fault.c @@ -1292,108 +241,6 @@ index abe2a9542b3a..a26e3acea6a9 100644 /* * The kernel tried to access some page that wasn't present. */ -diff --git a/arch/ia64/include/asm/io.h b/arch/ia64/include/asm/io.h -index a865d2a04f75..5de673ac9cb1 100644 ---- a/arch/ia64/include/asm/io.h -+++ b/arch/ia64/include/asm/io.h -@@ -433,6 +433,7 @@ static inline void __iomem * ioremap_cache (unsigned long phys_addr, unsigned lo - return ioremap(phys_addr, size); - } - #define ioremap_cache ioremap_cache -+#define ioremap_uc ioremap_nocache - - - /* -diff --git a/arch/mips/alchemy/devboards/db1000.c b/arch/mips/alchemy/devboards/db1000.c -index bdeed9d13c6f..433c4b9a9f0a 100644 ---- a/arch/mips/alchemy/devboards/db1000.c -+++ b/arch/mips/alchemy/devboards/db1000.c -@@ -503,15 +503,15 @@ int __init db1000_dev_setup(void) - if (board == BCSR_WHOAMI_DB1500) { - c0 = AU1500_GPIO2_INT; - c1 = AU1500_GPIO5_INT; -- d0 = AU1500_GPIO0_INT; -- d1 = AU1500_GPIO3_INT; -+ d0 = 0; /* GPIO number, NOT irq! */ -+ d1 = 3; /* GPIO number, NOT irq! */ - s0 = AU1500_GPIO1_INT; - s1 = AU1500_GPIO4_INT; - } else if (board == BCSR_WHOAMI_DB1100) { - c0 = AU1100_GPIO2_INT; - c1 = AU1100_GPIO5_INT; -- d0 = AU1100_GPIO0_INT; -- d1 = AU1100_GPIO3_INT; -+ d0 = 0; /* GPIO number, NOT irq! */ -+ d1 = 3; /* GPIO number, NOT irq! */ - s0 = AU1100_GPIO1_INT; - s1 = AU1100_GPIO4_INT; - -@@ -545,15 +545,15 @@ int __init db1000_dev_setup(void) - } else if (board == BCSR_WHOAMI_DB1000) { - c0 = AU1000_GPIO2_INT; - c1 = AU1000_GPIO5_INT; -- d0 = AU1000_GPIO0_INT; -- d1 = AU1000_GPIO3_INT; -+ d0 = 0; /* GPIO number, NOT irq! */ -+ d1 = 3; /* GPIO number, NOT irq! */ - s0 = AU1000_GPIO1_INT; - s1 = AU1000_GPIO4_INT; - platform_add_devices(db1000_devs, ARRAY_SIZE(db1000_devs)); - } else if ((board == BCSR_WHOAMI_PB1500) || - (board == BCSR_WHOAMI_PB1500R2)) { - c0 = AU1500_GPIO203_INT; -- d0 = AU1500_GPIO201_INT; -+ d0 = 1; /* GPIO number, NOT irq! */ - s0 = AU1500_GPIO202_INT; - twosocks = 0; - flashsize = 64; -@@ -566,7 +566,7 @@ int __init db1000_dev_setup(void) - */ - } else if (board == BCSR_WHOAMI_PB1100) { - c0 = AU1100_GPIO11_INT; -- d0 = AU1100_GPIO9_INT; -+ d0 = 9; /* GPIO number, NOT irq! */ - s0 = AU1100_GPIO10_INT; - twosocks = 0; - flashsize = 64; -@@ -583,7 +583,6 @@ int __init db1000_dev_setup(void) - } else - return 0; /* unknown board, no further dev setup to do */ - -- irq_set_irq_type(d0, IRQ_TYPE_EDGE_BOTH); - irq_set_irq_type(c0, IRQ_TYPE_LEVEL_LOW); - irq_set_irq_type(s0, IRQ_TYPE_LEVEL_LOW); - -@@ -597,7 +596,6 @@ int __init db1000_dev_setup(void) - c0, d0, /*s0*/0, 0, 0); - - if (twosocks) { -- irq_set_irq_type(d1, IRQ_TYPE_EDGE_BOTH); - irq_set_irq_type(c1, IRQ_TYPE_LEVEL_LOW); - irq_set_irq_type(s1, IRQ_TYPE_LEVEL_LOW); - -diff --git a/arch/mips/alchemy/devboards/db1550.c b/arch/mips/alchemy/devboards/db1550.c -index b518f029f5e7..1c01d6eadb08 100644 ---- a/arch/mips/alchemy/devboards/db1550.c -+++ b/arch/mips/alchemy/devboards/db1550.c -@@ -514,7 +514,7 @@ static void __init db1550_devices(void) - AU1000_PCMCIA_MEM_PHYS_ADDR + 0x000400000 - 1, - AU1000_PCMCIA_IO_PHYS_ADDR, - AU1000_PCMCIA_IO_PHYS_ADDR + 0x000010000 - 1, -- AU1550_GPIO3_INT, AU1550_GPIO0_INT, -+ AU1550_GPIO3_INT, 0, - /*AU1550_GPIO21_INT*/0, 0, 0); - - db1x_register_pcmcia_socket( -@@ -524,7 +524,7 @@ static void __init db1550_devices(void) - AU1000_PCMCIA_MEM_PHYS_ADDR + 0x004400000 - 1, - AU1000_PCMCIA_IO_PHYS_ADDR + 0x004000000, - AU1000_PCMCIA_IO_PHYS_ADDR + 0x004010000 - 1, -- AU1550_GPIO5_INT, AU1550_GPIO1_INT, -+ AU1550_GPIO5_INT, 1, - /*AU1550_GPIO22_INT*/0, 0, 1); - - platform_device_register(&db1550_nand_dev); diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h index f6b12790716c..942b8f6bf35b 100644 --- a/arch/mips/include/asm/kvm_host.h @@ -1407,76 +254,6 @@ index f6b12790716c..942b8f6bf35b 100644 void kvm_mips_init_count(struct kvm_vcpu *vcpu); int kvm_mips_set_count_ctl(struct kvm_vcpu *vcpu, s64 count_ctl); int kvm_mips_set_count_resume(struct kvm_vcpu *vcpu, s64 count_resume); -diff --git a/arch/mips/kernel/unaligned.c b/arch/mips/kernel/unaligned.c -index 490cea569d57..5c62065cbf22 100644 ---- a/arch/mips/kernel/unaligned.c -+++ b/arch/mips/kernel/unaligned.c -@@ -885,7 +885,7 @@ static void emulate_load_store_insn(struct pt_regs *regs, - { - union mips_instruction insn; - unsigned long value; -- unsigned int res; -+ unsigned int res, preempted; - unsigned long origpc; - unsigned long orig31; - void __user *fault_addr = NULL; -@@ -1226,27 +1226,36 @@ static void emulate_load_store_insn(struct pt_regs *regs, - if (!access_ok(VERIFY_READ, addr, sizeof(*fpr))) - goto sigbus; - -- /* -- * Disable preemption to avoid a race between copying -- * state from userland, migrating to another CPU and -- * updating the hardware vector register below. -- */ -- preempt_disable(); -- -- res = __copy_from_user_inatomic(fpr, addr, -- sizeof(*fpr)); -- if (res) -- goto fault; -- -- /* -- * Update the hardware register if it is in use by the -- * task in this quantum, in order to avoid having to -- * save & restore the whole vector context. -- */ -- if (test_thread_flag(TIF_USEDMSA)) -- write_msa_wr(wd, fpr, df); -+ do { -+ /* -+ * If we have live MSA context keep track of -+ * whether we get preempted in order to avoid -+ * the register context we load being clobbered -+ * by the live context as it's saved during -+ * preemption. If we don't have live context -+ * then it can't be saved to clobber the value -+ * we load. -+ */ -+ preempted = test_thread_flag(TIF_USEDMSA); -+ -+ res = __copy_from_user_inatomic(fpr, addr, -+ sizeof(*fpr)); -+ if (res) -+ goto fault; - -- preempt_enable(); -+ /* -+ * Update the hardware register if it is in use -+ * by the task in this quantum, in order to -+ * avoid having to save & restore the whole -+ * vector context. -+ */ -+ preempt_disable(); -+ if (test_thread_flag(TIF_USEDMSA)) { -+ write_msa_wr(wd, fpr, df); -+ preempted = 0; -+ } -+ preempt_enable(); -+ } while (preempted); - break; - - case msa_st_op: diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c index b37954cc880d..b8b7860ec1a8 100644 --- a/arch/mips/kvm/emulate.c @@ -1633,29432 +410,3431 @@ index ad988000563f..1664589d4746 100644 break; case KVM_REG_MIPS_CP0_CAUSE: /* -diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig -index 14f655cf542e..86ed37671ef5 100644 ---- a/arch/parisc/Kconfig -+++ b/arch/parisc/Kconfig -@@ -29,6 +29,7 @@ config PARISC - select TTY # Needed for pdc_cons.c - select HAVE_DEBUG_STACKOVERFLOW - select HAVE_ARCH_AUDITSYSCALL -+ select HAVE_ARCH_SECCOMP_FILTER - select ARCH_NO_COHERENT_DMA_MMAP - - help -diff --git a/arch/parisc/include/asm/compat.h b/arch/parisc/include/asm/compat.h -index 0448a2c8eafb..3387307cc33e 100644 ---- a/arch/parisc/include/asm/compat.h -+++ b/arch/parisc/include/asm/compat.h -@@ -183,6 +183,13 @@ typedef struct compat_siginfo { - int _band; /* POLL_IN, POLL_OUT, POLL_MSG */ - int _fd; - } _sigpoll; -+ -+ /* SIGSYS */ -+ struct { -+ compat_uptr_t _call_addr; /* calling user insn */ -+ int _syscall; /* triggering system call number */ -+ compat_uint_t _arch; /* AUDIT_ARCH_* of syscall */ -+ } _sigsys; - } _sifields; - } compat_siginfo_t; - -diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h -index a5eba95d87fe..637ce8d6f375 100644 ---- a/arch/parisc/include/asm/syscall.h -+++ b/arch/parisc/include/asm/syscall.h -@@ -39,6 +39,19 @@ static inline void syscall_get_arguments(struct task_struct *tsk, +diff --git a/arch/x86/kernel/cpu/perf_event_intel_pt.c b/arch/x86/kernel/cpu/perf_event_intel_pt.c +index c0bbd1033b7c..a5286d0bbb43 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel_pt.c ++++ b/arch/x86/kernel/cpu/perf_event_intel_pt.c +@@ -695,6 +695,7 @@ static int pt_buffer_reset_markers(struct pt_buffer *buf, + + /* clear STOP and INT from current entry */ + buf->topa_index[buf->stop_pos]->stop = 0; ++ buf->topa_index[buf->stop_pos]->intr = 0; + buf->topa_index[buf->intr_pos]->intr = 0; + + /* how many pages till the STOP marker */ +@@ -719,6 +720,7 @@ static int pt_buffer_reset_markers(struct pt_buffer *buf, + buf->intr_pos = idx; + + buf->topa_index[buf->stop_pos]->stop = 1; ++ buf->topa_index[buf->stop_pos]->intr = 1; + buf->topa_index[buf->intr_pos]->intr = 1; + + return 0; +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index 6525e926f566..2e1fd586b895 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -509,6 +509,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, + do_cpuid_1_ent(&entry[i], function, idx); + if (idx == 1) { + entry[i].eax &= kvm_supported_word10_x86_features; ++ cpuid_mask(&entry[i].eax, 10); + entry[i].ebx = 0; + if (entry[i].eax & (F(XSAVES)|F(XSAVEC))) + entry[i].ebx = +diff --git a/arch/x86/kvm/mtrr.c b/arch/x86/kvm/mtrr.c +index 3f8c732117ec..c146f3c262c3 100644 +--- a/arch/x86/kvm/mtrr.c ++++ b/arch/x86/kvm/mtrr.c +@@ -44,8 +44,6 @@ static bool msr_mtrr_valid(unsigned msr) + case MSR_MTRRdefType: + case MSR_IA32_CR_PAT: + return true; +- case 0x2f8: +- return true; } + return false; } +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 539062e24de1..60946a5d3812 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -5021,8 +5021,8 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event) + vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid); -+static inline void syscall_set_return_value(struct task_struct *task, -+ struct pt_regs *regs, -+ int error, long val) -+{ -+ regs->gr[28] = error ? error : val; -+} -+ -+static inline void syscall_rollback(struct task_struct *task, -+ struct pt_regs *regs) -+{ -+ /* do nothing */ -+} -+ - static inline int syscall_get_arch(void) - { - int arch = AUDIT_ARCH_PARISC; -diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h -index 0abdd4c607ed..1960b87c1c8b 100644 ---- a/arch/parisc/include/asm/uaccess.h -+++ b/arch/parisc/include/asm/uaccess.h -@@ -76,6 +76,7 @@ struct exception_table_entry { - */ - struct exception_data { - unsigned long fault_ip; -+ unsigned long fault_gp; - unsigned long fault_space; - unsigned long fault_addr; - }; -diff --git a/arch/parisc/kernel/asm-offsets.c b/arch/parisc/kernel/asm-offsets.c -index d2f62570a7b1..78d30d2ea2d8 100644 ---- a/arch/parisc/kernel/asm-offsets.c -+++ b/arch/parisc/kernel/asm-offsets.c -@@ -299,6 +299,7 @@ int main(void) + cr0 = X86_CR0_NW | X86_CR0_CD | X86_CR0_ET; +- vmx_set_cr0(vcpu, cr0); /* enter rmode */ + vmx->vcpu.arch.cr0 = cr0; ++ vmx_set_cr0(vcpu, cr0); /* enter rmode */ + vmx_set_cr4(vcpu, 0); + vmx_set_efer(vcpu, 0); + vmx_fpu_activate(vcpu); +diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c +index beac4dfdade6..349b8ce92bf2 100644 +--- a/arch/x86/pci/xen.c ++++ b/arch/x86/pci/xen.c +@@ -491,8 +491,11 @@ int __init pci_xen_initial_domain(void) #endif - BLANK(); - DEFINE(EXCDATA_IP, offsetof(struct exception_data, fault_ip)); -+ DEFINE(EXCDATA_GP, offsetof(struct exception_data, fault_gp)); - DEFINE(EXCDATA_SPACE, offsetof(struct exception_data, fault_space)); - DEFINE(EXCDATA_ADDR, offsetof(struct exception_data, fault_addr)); - BLANK(); -diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c -index 568b2c61ea02..3cad8aadc69e 100644 ---- a/arch/parisc/kernel/parisc_ksyms.c -+++ b/arch/parisc/kernel/parisc_ksyms.c -@@ -47,11 +47,11 @@ EXPORT_SYMBOL(__cmpxchg_u64); - EXPORT_SYMBOL(lclear_user); - EXPORT_SYMBOL(lstrnlen_user); - --/* Global fixups */ --extern void fixup_get_user_skip_1(void); --extern void fixup_get_user_skip_2(void); --extern void fixup_put_user_skip_1(void); --extern void fixup_put_user_skip_2(void); -+/* Global fixups - defined as int to avoid creation of function pointers */ -+extern int fixup_get_user_skip_1; -+extern int fixup_get_user_skip_2; -+extern int fixup_put_user_skip_1; -+extern int fixup_put_user_skip_2; - EXPORT_SYMBOL(fixup_get_user_skip_1); - EXPORT_SYMBOL(fixup_get_user_skip_2); - EXPORT_SYMBOL(fixup_put_user_skip_1); -diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c -index ce0b2b4075c7..8fb81a391599 100644 ---- a/arch/parisc/kernel/ptrace.c -+++ b/arch/parisc/kernel/ptrace.c -@@ -270,7 +270,8 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, - long do_syscall_trace_enter(struct pt_regs *regs) - { - /* Do the secure computing check first. */ -- secure_computing_strict(regs->gr[20]); -+ if (secure_computing() == -1) -+ return -1; - - if (test_thread_flag(TIF_SYSCALL_TRACE) && - tracehook_report_syscall_entry(regs)) { -@@ -296,7 +297,11 @@ long do_syscall_trace_enter(struct pt_regs *regs) - regs->gr[23] & 0xffffffff); - - out: -- return regs->gr[20]; + __acpi_register_gsi = acpi_register_gsi_xen; + __acpi_unregister_gsi = NULL; +- /* Pre-allocate legacy irqs */ +- for (irq = 0; irq < nr_legacy_irqs(); irq++) { + /* -+ * Sign extend the syscall number to 64bit since it may have been -+ * modified by a compat ptrace call ++ * Pre-allocate the legacy IRQs. Use NR_LEGACY_IRQS here ++ * because we don't have a PIC and thus nr_legacy_irqs() is zero. + */ -+ return (int) ((u32) regs->gr[20]); - } - - void do_syscall_trace_exit(struct pt_regs *regs) -diff --git a/arch/parisc/kernel/signal32.c b/arch/parisc/kernel/signal32.c -index 984abbee71ca..c342b2e17492 100644 ---- a/arch/parisc/kernel/signal32.c -+++ b/arch/parisc/kernel/signal32.c -@@ -371,6 +371,11 @@ copy_siginfo_to_user32 (compat_siginfo_t __user *to, const siginfo_t *from) - val = (compat_int_t)from->si_int; - err |= __put_user(val, &to->si_int); - break; -+ case __SI_SYS >> 16: -+ err |= __put_user(ptr_to_compat(from->si_call_addr), &to->si_call_addr); -+ err |= __put_user(from->si_syscall, &to->si_syscall); -+ err |= __put_user(from->si_arch, &to->si_arch); -+ break; - } - } - return err; -diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S -index fbafa0d0e2bf..57b4836b7ecd 100644 ---- a/arch/parisc/kernel/syscall.S -+++ b/arch/parisc/kernel/syscall.S -@@ -329,6 +329,7 @@ tracesys_next: - - ldo -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 /* get task ptr */ - LDREG TI_TASK(%r1), %r1 -+ LDREG TASK_PT_GR28(%r1), %r28 /* Restore return value */ - LDREG TASK_PT_GR26(%r1), %r26 /* Restore the users args */ - LDREG TASK_PT_GR25(%r1), %r25 - LDREG TASK_PT_GR24(%r1), %r24 -@@ -342,7 +343,8 @@ tracesys_next: - stw %r21, -56(%r30) /* 6th argument */ - #endif ++ for (irq = 0; irq < NR_IRQS_LEGACY; irq++) { + int trigger, polarity; -- comiclr,>>= __NR_Linux_syscalls, %r20, %r0 -+ cmpib,COND(=),n -1,%r20,tracesys_exit /* seccomp may have returned -1 */ -+ comiclr,>> __NR_Linux_syscalls, %r20, %r0 - b,n .Ltracesys_nosys - - LDREGX %r20(%r19), %r19 -diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c -index 553b09855cfd..77e2262c97f6 100644 ---- a/arch/parisc/kernel/traps.c -+++ b/arch/parisc/kernel/traps.c -@@ -798,6 +798,9 @@ void notrace handle_interruption(int code, struct pt_regs *regs) - - if (fault_space == 0 && !faulthandler_disabled()) - { -+ /* Clean up and return if in exception table. */ -+ if (fixup_exception(regs)) -+ return; - pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC); - parisc_terminate("Kernel Fault", regs, code, fault_address); - } -diff --git a/arch/parisc/lib/fixup.S b/arch/parisc/lib/fixup.S -index 536ef66bb94b..1052b747e011 100644 ---- a/arch/parisc/lib/fixup.S -+++ b/arch/parisc/lib/fixup.S -@@ -26,6 +26,7 @@ + if (acpi_get_override_irq(irq, &trigger, &polarity) == -1) +diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c +index cd2c3d6d40e0..993fd31394c8 100644 +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -319,6 +319,7 @@ int acpi_device_fix_up_power(struct acpi_device *device) - #ifdef CONFIG_SMP - .macro get_fault_ip t1 t2 -+ loadgp - addil LT%__per_cpu_offset,%r27 - LDREG RT%__per_cpu_offset(%r1),\t1 - /* t2 = smp_processor_id() */ -@@ -40,14 +41,19 @@ - LDREG RT%exception_data(%r1),\t1 - /* t1 = this_cpu_ptr(&exception_data) */ - add,l \t1,\t2,\t1 -+ /* %r27 = t1->fault_gp - restore gp */ -+ LDREG EXCDATA_GP(\t1), %r27 - /* t1 = t1->fault_ip */ - LDREG EXCDATA_IP(\t1), \t1 - .endm - #else - .macro get_fault_ip t1 t2 -+ loadgp - /* t1 = this_cpu_ptr(&exception_data) */ - addil LT%exception_data,%r27 - LDREG RT%exception_data(%r1),\t2 -+ /* %r27 = t2->fault_gp - restore gp */ -+ LDREG EXCDATA_GP(\t2), %r27 - /* t1 = t2->fault_ip */ - LDREG EXCDATA_IP(\t2), \t1 - .endm -diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c -index a762864ec92e..f9064449908a 100644 ---- a/arch/parisc/mm/fault.c -+++ b/arch/parisc/mm/fault.c -@@ -151,6 +151,7 @@ int fixup_exception(struct pt_regs *regs) - struct exception_data *d; - d = this_cpu_ptr(&exception_data); - d->fault_ip = regs->iaoq[0]; -+ d->fault_gp = regs->gr[27]; - d->fault_space = regs->isr; - d->fault_addr = regs->ior; - -diff --git a/arch/powerpc/include/asm/word-at-a-time.h b/arch/powerpc/include/asm/word-at-a-time.h -index e4396a7d0f7c..4afe66aa1400 100644 ---- a/arch/powerpc/include/asm/word-at-a-time.h -+++ b/arch/powerpc/include/asm/word-at-a-time.h -@@ -82,7 +82,7 @@ static inline unsigned long create_zero_mask(unsigned long bits) - "andc %1,%1,%2\n\t" - "popcntd %0,%1" - : "=r" (leading_zero_bits), "=&r" (trailing_zero_bit_mask) -- : "r" (bits)); -+ : "b" (bits)); - - return leading_zero_bits; + return ret; } -diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h -index 8dde19962a5b..f63c96cd3608 100644 ---- a/arch/powerpc/include/uapi/asm/cputable.h -+++ b/arch/powerpc/include/uapi/asm/cputable.h -@@ -31,6 +31,7 @@ - #define PPC_FEATURE_PSERIES_PERFMON_COMPAT \ - 0x00000040 - -+/* Reserved - do not use 0x00000004 */ - #define PPC_FEATURE_TRUE_LE 0x00000002 - #define PPC_FEATURE_PPC_LE 0x00000001 - -diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c -index 3c5736e52a14..54ed9c7663e6 100644 ---- a/arch/powerpc/kernel/process.c -+++ b/arch/powerpc/kernel/process.c -@@ -854,7 +854,7 @@ void restore_tm_state(struct pt_regs *regs) - static inline void save_sprs(struct thread_struct *t) - { - #ifdef CONFIG_ALTIVEC -- if (cpu_has_feature(cpu_has_feature(CPU_FTR_ALTIVEC))) -+ if (cpu_has_feature(CPU_FTR_ALTIVEC)) - t->vrsave = mfspr(SPRN_VRSAVE); - #endif - #ifdef CONFIG_PPC_BOOK3S_64 -diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c -index 7030b035905d..a15fe1d4e84a 100644 ---- a/arch/powerpc/kernel/prom.c -+++ b/arch/powerpc/kernel/prom.c -@@ -148,23 +148,25 @@ static struct ibm_pa_feature { - unsigned long cpu_features; /* CPU_FTR_xxx bit */ - unsigned long mmu_features; /* MMU_FTR_xxx bit */ - unsigned int cpu_user_ftrs; /* PPC_FEATURE_xxx bit */ -+ unsigned int cpu_user_ftrs2; /* PPC_FEATURE2_xxx bit */ - unsigned char pabyte; /* byte number in ibm,pa-features */ - unsigned char pabit; /* bit number (big-endian) */ - unsigned char invert; /* if 1, pa bit set => clear feature */ - } ibm_pa_features[] __initdata = { -- {0, 0, PPC_FEATURE_HAS_MMU, 0, 0, 0}, -- {0, 0, PPC_FEATURE_HAS_FPU, 0, 1, 0}, -- {CPU_FTR_CTRL, 0, 0, 0, 3, 0}, -- {CPU_FTR_NOEXECUTE, 0, 0, 0, 6, 0}, -- {CPU_FTR_NODSISRALIGN, 0, 0, 1, 1, 1}, -- {0, MMU_FTR_CI_LARGE_PAGE, 0, 1, 2, 0}, -- {CPU_FTR_REAL_LE, PPC_FEATURE_TRUE_LE, 5, 0, 0}, -+ {0, 0, PPC_FEATURE_HAS_MMU, 0, 0, 0, 0}, -+ {0, 0, PPC_FEATURE_HAS_FPU, 0, 0, 1, 0}, -+ {CPU_FTR_CTRL, 0, 0, 0, 0, 3, 0}, -+ {CPU_FTR_NOEXECUTE, 0, 0, 0, 0, 6, 0}, -+ {CPU_FTR_NODSISRALIGN, 0, 0, 0, 1, 1, 1}, -+ {0, MMU_FTR_CI_LARGE_PAGE, 0, 0, 1, 2, 0}, -+ {CPU_FTR_REAL_LE, 0, PPC_FEATURE_TRUE_LE, 0, 5, 0, 0}, - /* -- * If the kernel doesn't support TM (ie. CONFIG_PPC_TRANSACTIONAL_MEM=n), -- * we don't want to turn on CPU_FTR_TM here, so we use CPU_FTR_TM_COMP -- * which is 0 if the kernel doesn't support TM. -+ * If the kernel doesn't support TM (ie CONFIG_PPC_TRANSACTIONAL_MEM=n), -+ * we don't want to turn on TM here, so we use the *_COMP versions -+ * which are 0 if the kernel doesn't support TM. - */ -- {CPU_FTR_TM_COMP, 0, 0, 22, 0, 0}, -+ {CPU_FTR_TM_COMP, 0, 0, -+ PPC_FEATURE2_HTM_COMP|PPC_FEATURE2_HTM_NOSC_COMP, 22, 0, 0}, - }; ++EXPORT_SYMBOL_GPL(acpi_device_fix_up_power); - static void __init scan_features(unsigned long node, const unsigned char *ftrs, -@@ -195,10 +197,12 @@ static void __init scan_features(unsigned long node, const unsigned char *ftrs, - if (bit ^ fp->invert) { - cur_cpu_spec->cpu_features |= fp->cpu_features; - cur_cpu_spec->cpu_user_features |= fp->cpu_user_ftrs; -+ cur_cpu_spec->cpu_user_features2 |= fp->cpu_user_ftrs2; - cur_cpu_spec->mmu_features |= fp->mmu_features; - } else { - cur_cpu_spec->cpu_features &= ~fp->cpu_features; - cur_cpu_spec->cpu_user_features &= ~fp->cpu_user_ftrs; -+ cur_cpu_spec->cpu_user_features2 &= ~fp->cpu_user_ftrs2; - cur_cpu_spec->mmu_features &= ~fp->mmu_features; - } - } -diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c -index 744e24bcb85c..4a811ca7ac9d 100644 ---- a/arch/powerpc/mm/hugetlbpage.c -+++ b/arch/powerpc/mm/hugetlbpage.c -@@ -414,13 +414,13 @@ static void hugepd_free(struct mmu_gather *tlb, void *hugepte) + int acpi_device_update_power(struct acpi_device *device, int *state_p) { - struct hugepd_freelist **batchp; +diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c +index 67da6fb72274..c45fdc49ff28 100644 +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -135,7 +135,7 @@ static struct osi_linux { + unsigned int enable:1; + unsigned int dmi:1; + unsigned int cmdline:1; +- unsigned int default_disabling:1; ++ u8 default_disabling; + } osi_linux = {0, 0, 0, 0}; + + static u32 acpi_osi_handler(acpi_string interface, u32 supported) +@@ -1713,10 +1713,13 @@ void __init acpi_osi_setup(char *str) + if (*str == '!') { + str++; + if (*str == '\0') { +- osi_linux.default_disabling = 1; ++ /* Do not override acpi_osi=!* */ ++ if (!osi_linux.default_disabling) ++ osi_linux.default_disabling = ++ ACPI_DISABLE_ALL_VENDOR_STRINGS; + return; + } else if (*str == '*') { +- acpi_update_interfaces(ACPI_DISABLE_ALL_STRINGS); ++ osi_linux.default_disabling = ACPI_DISABLE_ALL_STRINGS; + for (i = 0; i < OSI_STRING_ENTRIES_MAX; i++) { + osi = &osi_setup_entries[i]; + osi->enable = false; +@@ -1789,10 +1792,13 @@ static void __init acpi_osi_setup_late(void) + acpi_status status; -- batchp = this_cpu_ptr(&hugepd_freelist_cur); -+ batchp = &get_cpu_var(hugepd_freelist_cur); + if (osi_linux.default_disabling) { +- status = acpi_update_interfaces(ACPI_DISABLE_ALL_VENDOR_STRINGS); ++ status = acpi_update_interfaces(osi_linux.default_disabling); - if (atomic_read(&tlb->mm->mm_users) < 2 || - cpumask_equal(mm_cpumask(tlb->mm), - cpumask_of(smp_processor_id()))) { - kmem_cache_free(hugepte_cache, hugepte); -- put_cpu_var(hugepd_freelist_cur); -+ put_cpu_var(hugepd_freelist_cur); - return; + if (ACPI_SUCCESS(status)) +- printk(KERN_INFO PREFIX "Disabled all _OSI OS vendors\n"); ++ printk(KERN_INFO PREFIX "Disabled all _OSI OS vendors%s\n", ++ osi_linux.default_disabling == ++ ACPI_DISABLE_ALL_STRINGS ? ++ " and feature groups" : ""); } -diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h -index c873e682b67f..6dafabb6ae1a 100644 ---- a/arch/s390/include/asm/pci.h -+++ b/arch/s390/include/asm/pci.h -@@ -45,7 +45,8 @@ struct zpci_fmb { - u64 rpcit_ops; - u64 dma_rbytes; - u64 dma_wbytes; --} __packed __aligned(16); -+ u64 pad[2]; -+} __packed __aligned(128); - - enum zpci_state { - ZPCI_FN_STATE_RESERVED, -diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S -index cd5a191381b9..c920b81be5bb 100644 ---- a/arch/s390/kernel/entry.S -+++ b/arch/s390/kernel/entry.S -@@ -1199,114 +1199,12 @@ cleanup_critical: - .quad .Lpsw_idle_lpsw - - .Lcleanup_save_fpu_regs: -- TSTMSK __LC_CPU_FLAGS,_CIF_FPU -- bor %r14 -- clg %r9,BASED(.Lcleanup_save_fpu_regs_done) -- jhe 5f -- clg %r9,BASED(.Lcleanup_save_fpu_regs_fp) -- jhe 4f -- clg %r9,BASED(.Lcleanup_save_fpu_regs_vx_high) -- jhe 3f -- clg %r9,BASED(.Lcleanup_save_fpu_regs_vx_low) -- jhe 2f -- clg %r9,BASED(.Lcleanup_save_fpu_fpc_end) -- jhe 1f -- lg %r2,__LC_CURRENT -- aghi %r2,__TASK_thread --0: # Store floating-point controls -- stfpc __THREAD_FPU_fpc(%r2) --1: # Load register save area and check if VX is active -- lg %r3,__THREAD_FPU_regs(%r2) -- TSTMSK __LC_MACHINE_FLAGS,MACHINE_FLAG_VX -- jz 4f # no VX -> store FP regs --2: # Store vector registers (V0-V15) -- VSTM %v0,%v15,0,%r3 # vstm 0,15,0(3) --3: # Store vector registers (V16-V31) -- VSTM %v16,%v31,256,%r3 # vstm 16,31,256(3) -- j 5f # -> done, set CIF_FPU flag --4: # Store floating-point registers -- std 0,0(%r3) -- std 1,8(%r3) -- std 2,16(%r3) -- std 3,24(%r3) -- std 4,32(%r3) -- std 5,40(%r3) -- std 6,48(%r3) -- std 7,56(%r3) -- std 8,64(%r3) -- std 9,72(%r3) -- std 10,80(%r3) -- std 11,88(%r3) -- std 12,96(%r3) -- std 13,104(%r3) -- std 14,112(%r3) -- std 15,120(%r3) --5: # Set CIF_FPU flag -- oi __LC_CPU_FLAGS+7,_CIF_FPU -- lg %r9,48(%r11) # return from save_fpu_regs -+ larl %r9,save_fpu_regs - br %r14 --.Lcleanup_save_fpu_fpc_end: -- .quad .Lsave_fpu_regs_fpc_end --.Lcleanup_save_fpu_regs_vx_low: -- .quad .Lsave_fpu_regs_vx_low --.Lcleanup_save_fpu_regs_vx_high: -- .quad .Lsave_fpu_regs_vx_high --.Lcleanup_save_fpu_regs_fp: -- .quad .Lsave_fpu_regs_fp --.Lcleanup_save_fpu_regs_done: -- .quad .Lsave_fpu_regs_done - - .Lcleanup_load_fpu_regs: -- TSTMSK __LC_CPU_FLAGS,_CIF_FPU -- bnor %r14 -- clg %r9,BASED(.Lcleanup_load_fpu_regs_done) -- jhe 1f -- clg %r9,BASED(.Lcleanup_load_fpu_regs_fp) -- jhe 2f -- clg %r9,BASED(.Lcleanup_load_fpu_regs_vx_high) -- jhe 3f -- clg %r9,BASED(.Lcleanup_load_fpu_regs_vx) -- jhe 4f -- lg %r4,__LC_CURRENT -- aghi %r4,__TASK_thread -- lfpc __THREAD_FPU_fpc(%r4) -- TSTMSK __LC_MACHINE_FLAGS,MACHINE_FLAG_VX -- lg %r4,__THREAD_FPU_regs(%r4) # %r4 <- reg save area -- jz 2f # -> no VX, load FP regs --4: # Load V0 ..V15 registers -- VLM %v0,%v15,0,%r4 --3: # Load V16..V31 registers -- VLM %v16,%v31,256,%r4 -- j 1f --2: # Load floating-point registers -- ld 0,0(%r4) -- ld 1,8(%r4) -- ld 2,16(%r4) -- ld 3,24(%r4) -- ld 4,32(%r4) -- ld 5,40(%r4) -- ld 6,48(%r4) -- ld 7,56(%r4) -- ld 8,64(%r4) -- ld 9,72(%r4) -- ld 10,80(%r4) -- ld 11,88(%r4) -- ld 12,96(%r4) -- ld 13,104(%r4) -- ld 14,112(%r4) -- ld 15,120(%r4) --1: # Clear CIF_FPU bit -- ni __LC_CPU_FLAGS+7,255-_CIF_FPU -- lg %r9,48(%r11) # return from load_fpu_regs -+ larl %r9,load_fpu_regs - br %r14 --.Lcleanup_load_fpu_regs_vx: -- .quad .Lload_fpu_regs_vx --.Lcleanup_load_fpu_regs_vx_high: -- .quad .Lload_fpu_regs_vx_high --.Lcleanup_load_fpu_regs_fp: -- .quad .Lload_fpu_regs_fp --.Lcleanup_load_fpu_regs_done: -- .quad .Lload_fpu_regs_done + for (i = 0; i < OSI_STRING_ENTRIES_MAX; i++) { +diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c +index 80783dcb7f57..aba31210c802 100644 +--- a/drivers/bluetooth/hci_vhci.c ++++ b/drivers/bluetooth/hci_vhci.c +@@ -50,6 +50,7 @@ struct vhci_data { + wait_queue_head_t read_wait; + struct sk_buff_head readq; - /* - * Integer constants -diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c -index 9220db5c996a..93fc63ef6e95 100644 ---- a/arch/s390/kernel/setup.c -+++ b/arch/s390/kernel/setup.c -@@ -327,6 +327,7 @@ static void __init setup_lowcore(void) - + PAGE_SIZE - STACK_FRAME_OVERHEAD - sizeof(struct pt_regs); - lc->current_task = (unsigned long) init_thread_union.thread_info.task; - lc->thread_info = (unsigned long) &init_thread_union; -+ lc->lpp = LPP_MAGIC; - lc->machine_flags = S390_lowcore.machine_flags; - lc->stfl_fac_list = S390_lowcore.stfl_fac_list; - memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list, -diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c -index 13dab0c1645c..3776aca22082 100644 ---- a/arch/s390/mm/gup.c -+++ b/arch/s390/mm/gup.c -@@ -20,9 +20,9 @@ - static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr, - unsigned long end, int write, struct page **pages, int *nr) - { -+ struct page *head, *page; - unsigned long mask; - pte_t *ptep, pte; -- struct page *page; - - mask = (write ? _PAGE_PROTECT : 0) | _PAGE_INVALID | _PAGE_SPECIAL; - -@@ -37,12 +37,14 @@ static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr, - return 0; - VM_BUG_ON(!pfn_valid(pte_pfn(pte))); - page = pte_page(pte); -- if (!page_cache_get_speculative(page)) -+ head = compound_head(page); -+ if (!page_cache_get_speculative(head)) - return 0; - if (unlikely(pte_val(pte) != pte_val(*ptep))) { -- put_page(page); -+ put_page(head); - return 0; - } -+ VM_BUG_ON_PAGE(compound_head(page) != head, page); - pages[*nr] = page; - (*nr)++; ++ struct mutex open_mutex; + struct delayed_work open_timeout; + }; -diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c -index 8f19c8f9d660..8f75edc998ff 100644 ---- a/arch/s390/pci/pci.c -+++ b/arch/s390/pci/pci.c -@@ -864,8 +864,11 @@ static inline int barsize(u8 size) +@@ -87,12 +88,15 @@ static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) + return 0; + } - static int zpci_mem_init(void) +-static int vhci_create_device(struct vhci_data *data, __u8 opcode) ++static int __vhci_create_device(struct vhci_data *data, __u8 opcode) { -+ BUILD_BUG_ON(!is_power_of_2(__alignof__(struct zpci_fmb)) || -+ __alignof__(struct zpci_fmb) < sizeof(struct zpci_fmb)); -+ - zdev_fmb_cache = kmem_cache_create("PCI_FMB_cache", sizeof(struct zpci_fmb), -- 16, 0, NULL); -+ __alignof__(struct zpci_fmb), 0, NULL); - if (!zdev_fmb_cache) - goto error_fmb; - -diff --git a/arch/sh/mm/kmap.c b/arch/sh/mm/kmap.c -index ec29e14ec5a8..bf25d7c79a2d 100644 ---- a/arch/sh/mm/kmap.c -+++ b/arch/sh/mm/kmap.c -@@ -36,6 +36,7 @@ void *kmap_coherent(struct page *page, unsigned long addr) - - BUG_ON(!test_bit(PG_dcache_clean, &page->flags)); - -+ preempt_disable(); - pagefault_disable(); + struct hci_dev *hdev; + struct sk_buff *skb; + __u8 dev_type; - idx = FIX_CMAP_END - -@@ -64,4 +65,5 @@ void kunmap_coherent(void *kvaddr) - } - - pagefault_enable(); -+ preempt_enable(); - } -diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c -index b821b13d343a..8a6b57108ac2 100644 ---- a/arch/um/drivers/mconsole_kern.c -+++ b/arch/um/drivers/mconsole_kern.c -@@ -133,7 +133,7 @@ void mconsole_proc(struct mc_request *req) - ptr += strlen("proc"); - ptr = skip_spaces(ptr); - -- file = file_open_root(mnt->mnt_root, mnt, ptr, O_RDONLY); -+ file = file_open_root(mnt->mnt_root, mnt, ptr, O_RDONLY, 0); - if (IS_ERR(file)) { - mconsole_reply(req, "Failed to open file", 1, 0); - printk(KERN_ERR "open /proc/%s: %ld\n", ptr, PTR_ERR(file)); -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index c46662f64c39..3bf45a0cd69e 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -1160,22 +1160,23 @@ config MICROCODE - bool "CPU microcode loading support" - default y - depends on CPU_SUP_AMD || CPU_SUP_INTEL -- depends on BLK_DEV_INITRD - select FW_LOADER - ---help--- -- - If you say Y here, you will be able to update the microcode on -- certain Intel and AMD processors. The Intel support is for the -- IA32 family, e.g. Pentium Pro, Pentium II, Pentium III, Pentium 4, -- Xeon etc. The AMD support is for families 0x10 and later. You will -- obviously need the actual microcode binary data itself which is not -- shipped with the Linux kernel. -- -- This option selects the general module only, you need to select -- at least one vendor specific module as well. -- -- To compile this driver as a module, choose M here: the module -- will be called microcode. -+ Intel and AMD processors. The Intel support is for the IA32 family, -+ e.g. Pentium Pro, Pentium II, Pentium III, Pentium 4, Xeon etc. The -+ AMD support is for families 0x10 and later. You will obviously need -+ the actual microcode binary data itself which is not shipped with -+ the Linux kernel. -+ -+ The preferred method to load microcode from a detached initrd is described -+ in Documentation/x86/early-microcode.txt. For that you need to enable -+ CONFIG_BLK_DEV_INITRD in order for the loader to be able to scan the -+ initrd for microcode blobs. -+ -+ In addition, you can build-in the microcode into the kernel. For that you -+ need to enable FIRMWARE_IN_KERNEL and add the vendor-supplied microcode -+ to the CONFIG_EXTRA_FIRMWARE config option. - - config MICROCODE_INTEL - bool "Intel microcode loading support" -diff --git a/arch/x86/crypto/sha-mb/sha1_mb.c b/arch/x86/crypto/sha-mb/sha1_mb.c -index a841e9765bd6..8381c09d2870 100644 ---- a/arch/x86/crypto/sha-mb/sha1_mb.c -+++ b/arch/x86/crypto/sha-mb/sha1_mb.c -@@ -453,10 +453,10 @@ static int sha_complete_job(struct mcryptd_hash_request_ctx *rctx, - - req = cast_mcryptd_ctx_to_req(req_ctx); - if (irqs_disabled()) -- rctx->complete(&req->base, ret); -+ req_ctx->complete(&req->base, ret); - else { - local_bh_disable(); -- rctx->complete(&req->base, ret); -+ req_ctx->complete(&req->base, ret); - local_bh_enable(); - } - } -diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c -index 03663740c866..1a4477cedc49 100644 ---- a/arch/x86/entry/common.c -+++ b/arch/x86/entry/common.c -@@ -268,6 +268,7 @@ static void exit_to_usermode_loop(struct pt_regs *regs, u32 cached_flags) - /* Called with IRQs disabled. */ - __visible inline void prepare_exit_to_usermode(struct pt_regs *regs) - { -+ struct thread_info *ti = pt_regs_to_thread_info(regs); - u32 cached_flags; - - if (IS_ENABLED(CONFIG_PROVE_LOCKING) && WARN_ON(!irqs_disabled())) -@@ -275,12 +276,22 @@ __visible inline void prepare_exit_to_usermode(struct pt_regs *regs) - - lockdep_sys_exit(); - -- cached_flags = -- READ_ONCE(pt_regs_to_thread_info(regs)->flags); -+ cached_flags = READ_ONCE(ti->flags); - - if (unlikely(cached_flags & EXIT_TO_USERMODE_LOOP_FLAGS)) - exit_to_usermode_loop(regs, cached_flags); - -+#ifdef CONFIG_COMPAT -+ /* -+ * Compat syscalls set TS_COMPAT. Make sure we clear it before -+ * returning to user mode. We need to clear it *after* signal -+ * handling, because syscall restart has a fixup for compat -+ * syscalls. The fixup is exercised by the ptrace_syscall_32 -+ * selftest. -+ */ -+ ti->status &= ~TS_COMPAT; -+#endif ++ if (data->hdev) ++ return -EBADFD; + - user_enter(); - } - -@@ -332,14 +343,6 @@ __visible inline void syscall_return_slowpath(struct pt_regs *regs) - if (unlikely(cached_flags & SYSCALL_EXIT_WORK_FLAGS)) - syscall_slow_exit_work(regs, cached_flags); - --#ifdef CONFIG_COMPAT -- /* -- * Compat syscalls set TS_COMPAT. Make sure we clear it before -- * returning to user mode. -- */ -- ti->status &= ~TS_COMPAT; --#endif -- - local_irq_disable(); - prepare_exit_to_usermode(regs); - } -diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h -index c80f6b6f3da2..e8c4fba52d3d 100644 ---- a/arch/x86/include/asm/apic.h -+++ b/arch/x86/include/asm/apic.h -@@ -644,8 +644,8 @@ static inline void entering_irq(void) + /* bits 0-1 are dev_type (BR/EDR or AMP) */ + dev_type = opcode & 0x03; - static inline void entering_ack_irq(void) - { -- ack_APIC_irq(); - entering_irq(); -+ ack_APIC_irq(); +@@ -151,6 +155,17 @@ static int vhci_create_device(struct vhci_data *data, __u8 opcode) + return 0; } - static inline void ipi_entering_ack_irq(void) -diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h -index f8a29d2c97b0..e6a8613fbfb0 100644 ---- a/arch/x86/include/asm/hugetlb.h -+++ b/arch/x86/include/asm/hugetlb.h -@@ -4,6 +4,7 @@ - #include - #include - -+#define hugepages_supported() cpu_has_pse - - static inline int is_hugepage_only_range(struct mm_struct *mm, - unsigned long addr, -diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h -index 1815b736269d..84b3d194a958 100644 ---- a/arch/x86/include/asm/hw_irq.h -+++ b/arch/x86/include/asm/hw_irq.h -@@ -141,6 +141,7 @@ struct irq_alloc_info { - struct irq_cfg { - unsigned int dest_apicid; - u8 vector; -+ u8 old_vector; - }; - - extern struct irq_cfg *irq_cfg(unsigned int irq); -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 44adbb819041..f8dba2097c40 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -42,7 +42,7 @@ - - #define KVM_PIO_PAGE_OFFSET 1 - #define KVM_COALESCED_MMIO_PAGE_OFFSET 2 --#define KVM_HALT_POLL_NS_DEFAULT 500000 -+#define KVM_HALT_POLL_NS_DEFAULT 400000 - - #define KVM_IRQCHIP_NUM_PINS KVM_IOAPIC_NUM_PINS - -diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h -index 1e1b07a5a738..9d3a96c4da78 100644 ---- a/arch/x86/include/asm/microcode.h -+++ b/arch/x86/include/asm/microcode.h -@@ -3,6 +3,7 @@ - - #include - #include -+#include - - #define native_rdmsr(msr, val1, val2) \ - do { \ -@@ -143,4 +144,29 @@ static inline void reload_early_microcode(void) { } - static inline bool - get_builtin_firmware(struct cpio_data *cd, const char *name) { return false; } - #endif -+ -+static inline unsigned long get_initrd_start(void) ++static int vhci_create_device(struct vhci_data *data, __u8 opcode) +{ -+#ifdef CONFIG_BLK_DEV_INITRD -+ return initrd_start; -+#else -+ return 0; -+#endif -+} ++ int err; + -+static inline unsigned long get_initrd_start_addr(void) -+{ -+#ifdef CONFIG_BLK_DEV_INITRD -+#ifdef CONFIG_X86_32 -+ unsigned long *initrd_start_p = (unsigned long *)__pa_nodebug(&initrd_start); ++ mutex_lock(&data->open_mutex); ++ err = __vhci_create_device(data, opcode); ++ mutex_unlock(&data->open_mutex); + -+ return (unsigned long)__pa_nodebug(*initrd_start_p); -+#else -+ return get_initrd_start(); -+#endif -+#else /* CONFIG_BLK_DEV_INITRD */ -+ return 0; -+#endif ++ return err; +} + - #endif /* _ASM_X86_MICROCODE_H */ -diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h -index 7bcb861a04e5..5a2ed3ed2f26 100644 ---- a/arch/x86/include/asm/perf_event.h -+++ b/arch/x86/include/asm/perf_event.h -@@ -165,6 +165,7 @@ struct x86_pmu_capability { - #define GLOBAL_STATUS_ASIF BIT_ULL(60) - #define GLOBAL_STATUS_COUNTERS_FROZEN BIT_ULL(59) - #define GLOBAL_STATUS_LBRS_FROZEN BIT_ULL(58) -+#define GLOBAL_STATUS_TRACE_TOPAPMI BIT_ULL(55) + static inline ssize_t vhci_get_user(struct vhci_data *data, + struct iov_iter *from) + { +@@ -189,11 +204,6 @@ static inline ssize_t vhci_get_user(struct vhci_data *data, + break; - /* - * IBS cpuid feature detection -diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h -index 8b2d4bea9962..39171b3646bb 100644 ---- a/arch/x86/include/asm/xen/hypervisor.h -+++ b/arch/x86/include/asm/xen/hypervisor.h -@@ -62,4 +62,6 @@ void xen_arch_register_cpu(int num); - void xen_arch_unregister_cpu(int num); - #endif + case HCI_VENDOR_PKT: +- if (data->hdev) { +- kfree_skb(skb); +- return -EBADFD; +- } +- + cancel_delayed_work_sync(&data->open_timeout); -+extern void xen_set_iopl_mask(unsigned mask); -+ - #endif /* _ASM_X86_XEN_HYPERVISOR_H */ -diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c -index 3b670df4ba7b..ef495511f019 100644 ---- a/arch/x86/kernel/apic/vector.c -+++ b/arch/x86/kernel/apic/vector.c -@@ -213,6 +213,7 @@ update: - */ - cpumask_and(d->old_domain, d->old_domain, cpu_online_mask); - d->move_in_progress = !cpumask_empty(d->old_domain); -+ d->cfg.old_vector = d->move_in_progress ? d->cfg.vector : 0; - d->cfg.vector = vector; - cpumask_copy(d->domain, vector_cpumask); - success: -@@ -255,7 +256,8 @@ static void clear_irq_vector(int irq, struct apic_chip_data *data) - struct irq_desc *desc; - int cpu, vector; - -- BUG_ON(!data->cfg.vector); -+ if (!data->cfg.vector) -+ return; + opcode = *((__u8 *) skb->data); +@@ -320,6 +330,7 @@ static int vhci_open(struct inode *inode, struct file *file) + skb_queue_head_init(&data->readq); + init_waitqueue_head(&data->read_wait); - vector = data->cfg.vector; - for_each_cpu_and(cpu, data->domain, cpu_online_mask) -@@ -655,46 +657,97 @@ void irq_complete_move(struct irq_cfg *cfg) - } ++ mutex_init(&data->open_mutex); + INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout); - /* -- * Called with @desc->lock held and interrupts disabled. -+ * Called from fixup_irqs() with @desc->lock held and interrupts disabled. - */ - void irq_force_complete_move(struct irq_desc *desc) + file->private_data = data; +@@ -333,15 +344,18 @@ static int vhci_open(struct inode *inode, struct file *file) + static int vhci_release(struct inode *inode, struct file *file) { - struct irq_data *irqdata = irq_desc_get_irq_data(desc); - struct apic_chip_data *data = apic_chip_data(irqdata); - struct irq_cfg *cfg = data ? &data->cfg : NULL; -+ unsigned int cpu; + struct vhci_data *data = file->private_data; +- struct hci_dev *hdev = data->hdev; ++ struct hci_dev *hdev; - if (!cfg) - return; + cancel_delayed_work_sync(&data->open_timeout); -- __irq_complete_move(cfg, cfg->vector); -- - /* - * This is tricky. If the cleanup of @data->old_domain has not been - * done yet, then the following setaffinity call will fail with - * -EBUSY. This can leave the interrupt in a stale state. - * -- * The cleanup cannot make progress because we hold @desc->lock. So in -- * case @data->old_domain is not yet cleaned up, we need to drop the -- * lock and acquire it again. @desc cannot go away, because the -- * hotplug code holds the sparse irq lock. -+ * All CPUs are stuck in stop machine with interrupts disabled so -+ * calling __irq_complete_move() would be completely pointless. - */ - raw_spin_lock(&vector_lock); -- /* Clean out all offline cpus (including ourself) first. */ -+ /* -+ * Clean out all offline cpus (including the outgoing one) from the -+ * old_domain mask. -+ */ - cpumask_and(data->old_domain, data->old_domain, cpu_online_mask); -- while (!cpumask_empty(data->old_domain)) { -+ -+ /* -+ * If move_in_progress is cleared and the old_domain mask is empty, -+ * then there is nothing to cleanup. fixup_irqs() will take care of -+ * the stale vectors on the outgoing cpu. -+ */ -+ if (!data->move_in_progress && cpumask_empty(data->old_domain)) { - raw_spin_unlock(&vector_lock); -- raw_spin_unlock(&desc->lock); -- cpu_relax(); -- raw_spin_lock(&desc->lock); -+ return; -+ } ++ hdev = data->hdev; + -+ /* -+ * 1) The interrupt is in move_in_progress state. That means that we -+ * have not seen an interrupt since the io_apic was reprogrammed to -+ * the new vector. -+ * -+ * 2) The interrupt has fired on the new vector, but the cleanup IPIs -+ * have not been processed yet. -+ */ -+ if (data->move_in_progress) { - /* -- * Reevaluate apic_chip_data. It might have been cleared after -- * we dropped @desc->lock. -+ * In theory there is a race: -+ * -+ * set_ioapic(new_vector) <-- Interrupt is raised before update -+ * is effective, i.e. it's raised on -+ * the old vector. -+ * -+ * So if the target cpu cannot handle that interrupt before -+ * the old vector is cleaned up, we get a spurious interrupt -+ * and in the worst case the ioapic irq line becomes stale. -+ * -+ * But in case of cpu hotplug this should be a non issue -+ * because if the affinity update happens right before all -+ * cpus rendevouz in stop machine, there is no way that the -+ * interrupt can be blocked on the target cpu because all cpus -+ * loops first with interrupts enabled in stop machine, so the -+ * old vector is not yet cleaned up when the interrupt fires. -+ * -+ * So the only way to run into this issue is if the delivery -+ * of the interrupt on the apic/system bus would be delayed -+ * beyond the point where the target cpu disables interrupts -+ * in stop machine. I doubt that it can happen, but at least -+ * there is a theroretical chance. Virtualization might be -+ * able to expose this, but AFAICT the IOAPIC emulation is not -+ * as stupid as the real hardware. -+ * -+ * Anyway, there is nothing we can do about that at this point -+ * w/o refactoring the whole fixup_irq() business completely. -+ * We print at least the irq number and the old vector number, -+ * so we have the necessary information when a problem in that -+ * area arises. - */ -- data = apic_chip_data(irqdata); -- if (!data) -- return; -- raw_spin_lock(&vector_lock); -+ pr_warn("IRQ fixup: irq %d move in progress, old vector %d\n", -+ irqdata->irq, cfg->old_vector); + if (hdev) { + hci_unregister_dev(hdev); + hci_free_dev(hdev); } -+ /* -+ * If old_domain is not empty, then other cpus still have the irq -+ * descriptor set in their vector array. Clean it up. -+ */ -+ for_each_cpu(cpu, data->old_domain) -+ per_cpu(vector_irq, cpu)[cfg->old_vector] = VECTOR_UNUSED; -+ -+ /* Cleanup the left overs of the (half finished) move */ -+ cpumask_clear(data->old_domain); -+ data->move_in_progress = 0; - raw_spin_unlock(&vector_lock); - } - #endif -diff --git a/arch/x86/kernel/cpu/mcheck/mce-genpool.c b/arch/x86/kernel/cpu/mcheck/mce-genpool.c -index 0a850100c594..2658e2af74ec 100644 ---- a/arch/x86/kernel/cpu/mcheck/mce-genpool.c -+++ b/arch/x86/kernel/cpu/mcheck/mce-genpool.c -@@ -29,7 +29,7 @@ static char gen_pool_buf[MCE_POOLSZ]; - void mce_gen_pool_process(void) - { - struct llist_node *head; -- struct mce_evt_llist *node; -+ struct mce_evt_llist *node, *tmp; - struct mce *mce; - - head = llist_del_all(&mce_event_llist); -@@ -37,7 +37,7 @@ void mce_gen_pool_process(void) - return; - - head = llist_reverse_order(head); -- llist_for_each_entry(node, head, llnode) { -+ llist_for_each_entry_safe(node, tmp, head, llnode) { - mce = &node->mce; - atomic_notifier_call_chain(&x86_mce_decoder_chain, 0, mce); - gen_pool_free(mce_evt_pool, (unsigned long)node, sizeof(*node)); -diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c -index 2c5aaf8c2e2f..05538582a809 100644 ---- a/arch/x86/kernel/cpu/mcheck/therm_throt.c -+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c -@@ -385,6 +385,9 @@ static void intel_thermal_interrupt(void) - { - __u64 msr_val; -+ if (static_cpu_has(X86_FEATURE_HWP)) -+ wrmsrl_safe(MSR_HWP_STATUS, 0); -+ - rdmsrl(MSR_IA32_THERM_STATUS, msr_val); - - /* Check for violation of core thermal thresholds*/ -diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c -index ee81c544ee0d..4f4735bd8698 100644 ---- a/arch/x86/kernel/cpu/microcode/intel.c -+++ b/arch/x86/kernel/cpu/microcode/intel.c -@@ -551,10 +551,14 @@ scan_microcode(struct mc_saved_data *mc_saved_data, unsigned long *initrd, - cd.data = NULL; - cd.size = 0; - -- cd = find_cpio_data(p, (void *)start, size, &offset); -- if (!cd.data) { -+ /* try built-in microcode if no initrd */ -+ if (!size) { - if (!load_builtin_intel_microcode(&cd)) - return UCODE_ERROR; -+ } else { -+ cd = find_cpio_data(p, (void *)start, size, &offset); -+ if (!cd.data) -+ return UCODE_ERROR; - } ++ skb_queue_purge(&data->readq); + file->private_data = NULL; + kfree(data); - return get_matching_model_microcode(0, start, cd.data, cd.size, -@@ -690,7 +694,7 @@ int __init save_microcode_in_initrd_intel(void) - if (count == 0) - return ret; +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index 9f4df8f645f8..dd2856b5633c 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -1078,10 +1078,12 @@ static void bcm2835_pll_divider_off(struct clk_hw *hw) + struct bcm2835_cprman *cprman = divider->cprman; + const struct bcm2835_pll_divider_data *data = divider->data; -- copy_initrd_ptrs(mc_saved, mc_saved_in_initrd, initrd_start, count); -+ copy_initrd_ptrs(mc_saved, mc_saved_in_initrd, get_initrd_start(), count); - ret = save_microcode(&mc_saved_data, mc_saved, count); - if (ret) - pr_err("Cannot save microcode patches from initrd.\n"); -@@ -728,16 +732,20 @@ void __init load_ucode_intel_bsp(void) - struct boot_params *p; - - p = (struct boot_params *)__pa_nodebug(&boot_params); -- start = p->hdr.ramdisk_image; - size = p->hdr.ramdisk_size; - -- _load_ucode_intel_bsp( -- (struct mc_saved_data *)__pa_nodebug(&mc_saved_data), -- (unsigned long *)__pa_nodebug(&mc_saved_in_initrd), -- start, size); -+ /* -+ * Set start only if we have an initrd image. We cannot use initrd_start -+ * because it is not set that early yet. -+ */ -+ start = (size ? p->hdr.ramdisk_image : 0); -+ -+ _load_ucode_intel_bsp((struct mc_saved_data *)__pa_nodebug(&mc_saved_data), -+ (unsigned long *)__pa_nodebug(&mc_saved_in_initrd), -+ start, size); - #else -- start = boot_params.hdr.ramdisk_image + PAGE_OFFSET; - size = boot_params.hdr.ramdisk_size; -+ start = (size ? boot_params.hdr.ramdisk_image + PAGE_OFFSET : 0); ++ spin_lock(&cprman->regs_lock); + cprman_write(cprman, data->cm_reg, + (cprman_read(cprman, data->cm_reg) & + ~data->load_mask) | data->hold_mask); + cprman_write(cprman, data->a2w_reg, A2W_PLL_CHANNEL_DISABLE); ++ spin_unlock(&cprman->regs_lock); + } - _load_ucode_intel_bsp(&mc_saved_data, mc_saved_in_initrd, start, size); - #endif -@@ -748,20 +756,14 @@ void load_ucode_intel_ap(void) - struct mc_saved_data *mc_saved_data_p; - struct ucode_cpu_info uci; - unsigned long *mc_saved_in_initrd_p; -- unsigned long initrd_start_addr; - enum ucode_state ret; - #ifdef CONFIG_X86_32 -- unsigned long *initrd_start_p; - -- mc_saved_in_initrd_p = -- (unsigned long *)__pa_nodebug(mc_saved_in_initrd); -+ mc_saved_in_initrd_p = (unsigned long *)__pa_nodebug(mc_saved_in_initrd); - mc_saved_data_p = (struct mc_saved_data *)__pa_nodebug(&mc_saved_data); -- initrd_start_p = (unsigned long *)__pa_nodebug(&initrd_start); -- initrd_start_addr = (unsigned long)__pa_nodebug(*initrd_start_p); - #else -- mc_saved_data_p = &mc_saved_data; - mc_saved_in_initrd_p = mc_saved_in_initrd; -- initrd_start_addr = initrd_start; -+ mc_saved_data_p = &mc_saved_data; - #endif + static int bcm2835_pll_divider_on(struct clk_hw *hw) +@@ -1090,12 +1092,14 @@ static int bcm2835_pll_divider_on(struct clk_hw *hw) + struct bcm2835_cprman *cprman = divider->cprman; + const struct bcm2835_pll_divider_data *data = divider->data; - /* -@@ -773,7 +775,7 @@ void load_ucode_intel_ap(void) ++ spin_lock(&cprman->regs_lock); + cprman_write(cprman, data->a2w_reg, + cprman_read(cprman, data->a2w_reg) & + ~A2W_PLL_CHANNEL_DISABLE); - collect_cpu_info_early(&uci); - ret = load_microcode(mc_saved_data_p, mc_saved_in_initrd_p, -- initrd_start_addr, &uci); -+ get_initrd_start_addr(), &uci); + cprman_write(cprman, data->cm_reg, + cprman_read(cprman, data->cm_reg) & ~data->hold_mask); ++ spin_unlock(&cprman->regs_lock); - if (ret != UCODE_OK) - return; -diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c -index 1b443db2db50..6532f5b40646 100644 ---- a/arch/x86/kernel/cpu/perf_event.c -+++ b/arch/x86/kernel/cpu/perf_event.c -@@ -596,6 +596,19 @@ void x86_pmu_disable_all(void) - } + return 0; } - -+/* -+ * There may be PMI landing after enabled=0. The PMI hitting could be before or -+ * after disable_all. -+ * -+ * If PMI hits before disable_all, the PMU will be disabled in the NMI handler. -+ * It will not be re-enabled in the NMI handler again, because enabled=0. After -+ * handling the NMI, disable_all will be called, which will not change the -+ * state either. If PMI hits after disable_all, the PMU is already disabled -+ * before entering NMI handler. The NMI handler will not change the state -+ * either. -+ * -+ * So either situation is harmless. -+ */ - static void x86_pmu_disable(struct pmu *pmu) +diff --git a/drivers/clk/qcom/gcc-msm8916.c b/drivers/clk/qcom/gcc-msm8916.c +index 8cc9b2868b41..5f56d6aae31d 100644 +--- a/drivers/clk/qcom/gcc-msm8916.c ++++ b/drivers/clk/qcom/gcc-msm8916.c +@@ -2346,6 +2346,7 @@ static struct clk_branch gcc_crypto_ahb_clk = { + "pcnoc_bfdcd_clk_src", + }, + .num_parents = 1, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -2381,6 +2382,7 @@ static struct clk_branch gcc_crypto_clk = { + "crypto_clk_src", + }, + .num_parents = 1, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c +index f7e0d8d4c3da..8f50a02ff68d 100644 +--- a/drivers/crypto/caam/jr.c ++++ b/drivers/crypto/caam/jr.c +@@ -248,7 +248,7 @@ static void caam_jr_dequeue(unsigned long devarg) + struct device *caam_jr_alloc(void) { - struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); -diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h -index 7bb61e32fb29..98be6d6d32fa 100644 ---- a/arch/x86/kernel/cpu/perf_event.h -+++ b/arch/x86/kernel/cpu/perf_event.h -@@ -586,6 +586,7 @@ struct x86_pmu { - pebs_broken :1, - pebs_prec_dist :1; - int pebs_record_size; -+ int pebs_buffer_size; - void (*drain_pebs)(struct pt_regs *regs); - struct event_constraint *pebs_constraints; - void (*pebs_aliases)(struct perf_event *event); -@@ -904,6 +905,8 @@ void intel_pmu_lbr_init_skl(void); - - void intel_pmu_lbr_init_knl(void); - -+void intel_pmu_pebs_data_source_nhm(void); -+ - int intel_pmu_setup_lbr_filter(struct perf_event *event); - - void intel_pt_interrupt(void); -diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c -index fed2ab1f1065..760aec1e8f82 100644 ---- a/arch/x86/kernel/cpu/perf_event_intel.c -+++ b/arch/x86/kernel/cpu/perf_event_intel.c -@@ -1502,7 +1502,15 @@ static __initconst const u64 knl_hw_cache_extra_regs - }; + struct caam_drv_private_jr *jrpriv, *min_jrpriv = NULL; +- struct device *dev = NULL; ++ struct device *dev = ERR_PTR(-ENODEV); + int min_tfm_cnt = INT_MAX; + int tfm_cnt; - /* -- * Use from PMIs where the LBRs are already disabled. -+ * Used from PMIs where the LBRs are already disabled. -+ * -+ * This function could be called consecutively. It is required to remain in -+ * disabled state if called consecutively. -+ * -+ * During consecutive calls, the same disable value will be written to related -+ * registers, so the PMU state remains unchanged. hw.state in -+ * intel_bts_disable_local will remain PERF_HES_STOPPED too in consecutive -+ * calls. - */ - static void __intel_pmu_disable_all(void) - { -@@ -1884,6 +1892,16 @@ again: - if (__test_and_clear_bit(62, (unsigned long *)&status)) { - handled++; - x86_pmu.drain_pebs(regs); -+ /* -+ * There are cases where, even though, the PEBS ovfl bit is set -+ * in GLOBAL_OVF_STATUS, the PEBS events may also have their -+ * overflow bits set for their counters. We must clear them -+ * here because they have been processed as exact samples in -+ * the drain_pebs() routine. They must not be processed again -+ * in the for_each_bit_set() loop for regular samples below. -+ */ -+ status &= ~cpuc->pebs_enabled; -+ status &= x86_pmu.intel_ctrl | GLOBAL_STATUS_TRACE_TOPAPMI; +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +index a19ee127edca..e72fea737a0d 100644 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +@@ -35,6 +35,7 @@ static int sun4i_ss_opti_poll(struct ablkcipher_request *areq) + unsigned int todo; + struct sg_mapping_iter mi, mo; + unsigned int oi, oo; /* offset for in and out */ ++ unsigned long flags; + + if (areq->nbytes == 0) + return 0; +@@ -49,7 +50,7 @@ static int sun4i_ss_opti_poll(struct ablkcipher_request *areq) + return -EINVAL; } - /* -@@ -1929,7 +1947,10 @@ again: - goto again; - - done: -- __intel_pmu_enable_all(0, true); -+ /* Only restore PMU state when it's active. See x86_pmu_disable(). */ -+ if (cpuc->enabled) -+ __intel_pmu_enable_all(0, true); -+ - /* - * Only unmask the NMI after the overflow counters - * have been reset. This avoids spurious NMIs on -@@ -3396,6 +3417,7 @@ __init int intel_pmu_init(void) - intel_perfmon_event_map[PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = - X86_CONFIG(.event=0xb1, .umask=0x3f, .inv=1, .cmask=1); - -+ intel_pmu_pebs_data_source_nhm(); - x86_add_quirk(intel_nehalem_quirk); - - pr_cont("Nehalem events, "); -@@ -3459,6 +3481,7 @@ __init int intel_pmu_init(void) - intel_perfmon_event_map[PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = - X86_CONFIG(.event=0xb1, .umask=0x3f, .inv=1, .cmask=1); - -+ intel_pmu_pebs_data_source_nhm(); - pr_cont("Westmere events, "); - break; +- spin_lock_bh(&ss->slock); ++ spin_lock_irqsave(&ss->slock, flags); -diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c -index 10602f0a438f..955140140fd4 100644 ---- a/arch/x86/kernel/cpu/perf_event_intel_ds.c -+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c -@@ -51,7 +51,8 @@ union intel_x86_pebs_dse { - #define OP_LH (P(OP, LOAD) | P(LVL, HIT)) - #define SNOOP_NONE_MISS (P(SNOOP, NONE) | P(SNOOP, MISS)) - --static const u64 pebs_data_source[] = { -+/* Version for Sandy Bridge and later */ -+static u64 pebs_data_source[] = { - P(OP, LOAD) | P(LVL, MISS) | P(LVL, L3) | P(SNOOP, NA),/* 0x00:ukn L3 */ - OP_LH | P(LVL, L1) | P(SNOOP, NONE), /* 0x01: L1 local */ - OP_LH | P(LVL, LFB) | P(SNOOP, NONE), /* 0x02: LFB hit */ -@@ -70,6 +71,14 @@ static const u64 pebs_data_source[] = { - OP_LH | P(LVL, UNC) | P(SNOOP, NONE), /* 0x0f: uncached */ - }; + for (i = 0; i < op->keylen; i += 4) + writel(*(op->key + i / 4), ss->base + SS_KEY0 + i); +@@ -117,7 +118,7 @@ release_ss: + sg_miter_stop(&mi); + sg_miter_stop(&mo); + writel(0, ss->base + SS_CTL); +- spin_unlock_bh(&ss->slock); ++ spin_unlock_irqrestore(&ss->slock, flags); + return err; + } -+/* Patch up minor differences in the bits */ -+void __init intel_pmu_pebs_data_source_nhm(void) -+{ -+ pebs_data_source[0x05] = OP_LH | P(LVL, L3) | P(SNOOP, HIT); -+ pebs_data_source[0x06] = OP_LH | P(LVL, L3) | P(SNOOP, HITM); -+ pebs_data_source[0x07] = OP_LH | P(LVL, L3) | P(SNOOP, HITM); -+} -+ - static u64 precise_store_data(u64 status) - { - union intel_x86_pebs_dse dse; -@@ -269,7 +278,7 @@ static int alloc_pebs_buffer(int cpu) - if (!x86_pmu.pebs) - return 0; +@@ -149,6 +150,7 @@ static int sun4i_ss_cipher_poll(struct ablkcipher_request *areq) + unsigned int ob = 0; /* offset in buf */ + unsigned int obo = 0; /* offset in bufo*/ + unsigned int obl = 0; /* length of data in bufo */ ++ unsigned long flags; -- buffer = kzalloc_node(PEBS_BUFFER_SIZE, GFP_KERNEL, node); -+ buffer = kzalloc_node(x86_pmu.pebs_buffer_size, GFP_KERNEL, node); - if (unlikely(!buffer)) - return -ENOMEM; + if (areq->nbytes == 0) + return 0; +@@ -181,7 +183,7 @@ static int sun4i_ss_cipher_poll(struct ablkcipher_request *areq) + if (no_chunk == 1) + return sun4i_ss_opti_poll(areq); -@@ -286,7 +295,7 @@ static int alloc_pebs_buffer(int cpu) - per_cpu(insn_buffer, cpu) = ibuffer; - } +- spin_lock_bh(&ss->slock); ++ spin_lock_irqsave(&ss->slock, flags); -- max = PEBS_BUFFER_SIZE / x86_pmu.pebs_record_size; -+ max = x86_pmu.pebs_buffer_size / x86_pmu.pebs_record_size; - - ds->pebs_buffer_base = (u64)(unsigned long)buffer; - ds->pebs_index = ds->pebs_buffer_base; -@@ -1319,6 +1328,7 @@ void __init intel_ds_init(void) - - x86_pmu.bts = boot_cpu_has(X86_FEATURE_BTS); - x86_pmu.pebs = boot_cpu_has(X86_FEATURE_PEBS); -+ x86_pmu.pebs_buffer_size = PEBS_BUFFER_SIZE; - if (x86_pmu.pebs) { - char pebs_type = x86_pmu.intel_cap.pebs_trap ? '+' : '-'; - int format = x86_pmu.intel_cap.pebs_format; -@@ -1327,6 +1337,14 @@ void __init intel_ds_init(void) - case 0: - printk(KERN_CONT "PEBS fmt0%c, ", pebs_type); - x86_pmu.pebs_record_size = sizeof(struct pebs_record_core); -+ /* -+ * Using >PAGE_SIZE buffers makes the WRMSR to -+ * PERF_GLOBAL_CTRL in intel_pmu_enable_all() -+ * mysteriously hang on Core2. -+ * -+ * As a workaround, we don't do this. -+ */ -+ x86_pmu.pebs_buffer_size = PAGE_SIZE; - x86_pmu.drain_pebs = intel_pmu_drain_pebs_core; - break; - -diff --git a/arch/x86/kernel/cpu/perf_event_intel_pt.c b/arch/x86/kernel/cpu/perf_event_intel_pt.c -index c0bbd1033b7c..a5286d0bbb43 100644 ---- a/arch/x86/kernel/cpu/perf_event_intel_pt.c -+++ b/arch/x86/kernel/cpu/perf_event_intel_pt.c -@@ -695,6 +695,7 @@ static int pt_buffer_reset_markers(struct pt_buffer *buf, - - /* clear STOP and INT from current entry */ - buf->topa_index[buf->stop_pos]->stop = 0; -+ buf->topa_index[buf->stop_pos]->intr = 0; - buf->topa_index[buf->intr_pos]->intr = 0; - - /* how many pages till the STOP marker */ -@@ -719,6 +720,7 @@ static int pt_buffer_reset_markers(struct pt_buffer *buf, - buf->intr_pos = idx; - - buf->topa_index[buf->stop_pos]->stop = 1; -+ buf->topa_index[buf->stop_pos]->intr = 1; - buf->topa_index[buf->intr_pos]->intr = 1; - - return 0; -diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c -index 33acb884ccf1..4547b2cca71b 100644 ---- a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c -+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c -@@ -2875,11 +2875,13 @@ static struct intel_uncore_type bdx_uncore_sbox = { - .format_group = &hswep_uncore_sbox_format_group, - }; + for (i = 0; i < op->keylen; i += 4) + writel(*(op->key + i / 4), ss->base + SS_KEY0 + i); +@@ -308,7 +310,7 @@ release_ss: + sg_miter_stop(&mi); + sg_miter_stop(&mo); + writel(0, ss->base + SS_CTL); +- spin_unlock_bh(&ss->slock); ++ spin_unlock_irqrestore(&ss->slock, flags); -+#define BDX_MSR_UNCORE_SBOX 3 -+ - static struct intel_uncore_type *bdx_msr_uncores[] = { - &bdx_uncore_ubox, - &bdx_uncore_cbox, -- &bdx_uncore_sbox, - &hswep_uncore_pcu, -+ &bdx_uncore_sbox, - NULL, + return err; + } +diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c +index aae05547b924..b7ee8d30147d 100644 +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -835,6 +835,16 @@ struct talitos_ahash_req_ctx { + struct scatterlist *psrc; }; -@@ -2888,6 +2890,10 @@ void bdx_uncore_cpu_init(void) - if (bdx_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores) - bdx_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores; - uncore_msr_uncores = bdx_msr_uncores; ++struct talitos_export_state { ++ u32 hw_context[TALITOS_MDEU_MAX_CONTEXT_SIZE / sizeof(u32)]; ++ u8 buf[HASH_MAX_BLOCK_SIZE]; ++ unsigned int swinit; ++ unsigned int first; ++ unsigned int last; ++ unsigned int to_hash_later; ++ unsigned int nbuf; ++}; + -+ /* BDX-DE doesn't have SBOX */ -+ if (boot_cpu_data.x86_model == 86) -+ uncore_msr_uncores[BDX_MSR_UNCORE_SBOX] = NULL; - } - - static struct intel_uncore_type bdx_uncore_ha = { -diff --git a/arch/x86/kernel/cpu/perf_event_knc.c b/arch/x86/kernel/cpu/perf_event_knc.c -index 5b0c232d1ee6..b931095e86d4 100644 ---- a/arch/x86/kernel/cpu/perf_event_knc.c -+++ b/arch/x86/kernel/cpu/perf_event_knc.c -@@ -263,7 +263,9 @@ again: - goto again; - - done: -- knc_pmu_enable_all(0); -+ /* Only restore PMU state when it's active. See x86_pmu_disable(). */ -+ if (cpuc->enabled) -+ knc_pmu_enable_all(0); - - return handled; - } -diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c -index 37dae792dbbe..589b3193f102 100644 ---- a/arch/x86/kernel/ioport.c -+++ b/arch/x86/kernel/ioport.c -@@ -96,9 +96,14 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on) - SYSCALL_DEFINE1(iopl, unsigned int, level) + static int aead_setkey(struct crypto_aead *authenc, + const u8 *key, unsigned int keylen) { - struct pt_regs *regs = current_pt_regs(); -- unsigned int old = (regs->flags >> 12) & 3; - struct thread_struct *t = ¤t->thread; +@@ -1981,6 +1991,46 @@ static int ahash_digest(struct ahash_request *areq) + return ahash_process_req(areq, areq->nbytes); + } -+ /* -+ * Careful: the IOPL bits in regs->flags are undefined under Xen PV -+ * and changing them has no effect. -+ */ -+ unsigned int old = t->iopl >> X86_EFLAGS_IOPL_BIT; ++static int ahash_export(struct ahash_request *areq, void *out) ++{ ++ struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq); ++ struct talitos_export_state *export = out; + - if (level > 3) - return -EINVAL; - /* Trying to gain more privileges? */ -@@ -106,8 +111,9 @@ SYSCALL_DEFINE1(iopl, unsigned int, level) - if (!capable(CAP_SYS_RAWIO)) - return -EPERM; - } -- regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12); -- t->iopl = level << 12; -+ regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | -+ (level << X86_EFLAGS_IOPL_BIT); -+ t->iopl = level << X86_EFLAGS_IOPL_BIT; - set_iopl_mask(t->iopl); - - return 0; -diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c -index b9d99e0f82c4..9f751876066f 100644 ---- a/arch/x86/kernel/process_64.c -+++ b/arch/x86/kernel/process_64.c -@@ -48,6 +48,7 @@ - #include - #include - #include -+#include - - asmlinkage extern void ret_from_fork(void); - -@@ -411,6 +412,17 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) - task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV)) - __switch_to_xtra(prev_p, next_p, tss); - -+#ifdef CONFIG_XEN -+ /* -+ * On Xen PV, IOPL bits in pt_regs->flags have no effect, and -+ * current_pt_regs()->flags may not match the current task's -+ * intended IOPL. We need to switch it manually. -+ */ -+ if (unlikely(static_cpu_has(X86_FEATURE_XENPV) && -+ prev->iopl != next->iopl)) -+ xen_set_iopl_mask(next->iopl); -+#endif ++ memcpy(export->hw_context, req_ctx->hw_context, ++ req_ctx->hw_context_size); ++ memcpy(export->buf, req_ctx->buf, req_ctx->nbuf); ++ export->swinit = req_ctx->swinit; ++ export->first = req_ctx->first; ++ export->last = req_ctx->last; ++ export->to_hash_later = req_ctx->to_hash_later; ++ export->nbuf = req_ctx->nbuf; + - if (static_cpu_has_bug(X86_BUG_SYSRET_SS_ATTRS)) { - /* - * AMD CPUs have a misfeature: SYSRET sets the SS selector but -diff --git a/arch/x86/kernel/sysfb_efi.c b/arch/x86/kernel/sysfb_efi.c -index b285d4e8c68e..5da924bbf0a0 100644 ---- a/arch/x86/kernel/sysfb_efi.c -+++ b/arch/x86/kernel/sysfb_efi.c -@@ -106,14 +106,24 @@ static int __init efifb_set_system(const struct dmi_system_id *id) - continue; - for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) { - resource_size_t start, end; -+ unsigned long flags; ++ return 0; ++} + -+ flags = pci_resource_flags(dev, i); -+ if (!(flags & IORESOURCE_MEM)) -+ continue; ++static int ahash_import(struct ahash_request *areq, const void *in) ++{ ++ struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq); ++ struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq); ++ const struct talitos_export_state *export = in; + -+ if (flags & IORESOURCE_UNSET) -+ continue; ++ memset(req_ctx, 0, sizeof(*req_ctx)); ++ req_ctx->hw_context_size = ++ (crypto_ahash_digestsize(tfm) <= SHA256_DIGEST_SIZE) ++ ? TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256 ++ : TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512; ++ memcpy(req_ctx->hw_context, export->hw_context, ++ req_ctx->hw_context_size); ++ memcpy(req_ctx->buf, export->buf, export->nbuf); ++ req_ctx->swinit = export->swinit; ++ req_ctx->first = export->first; ++ req_ctx->last = export->last; ++ req_ctx->to_hash_later = export->to_hash_later; ++ req_ctx->nbuf = export->nbuf; + -+ if (pci_resource_len(dev, i) == 0) -+ continue; - - start = pci_resource_start(dev, i); -- if (start == 0) -- break; - end = pci_resource_end(dev, i); - if (screen_info.lfb_base >= start && - screen_info.lfb_base < end) { - found_bar = 1; -+ break; - } - } - } -diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c -index 92ae6acac8a7..6aa0f4d9eea6 100644 ---- a/arch/x86/kernel/tsc_msr.c -+++ b/arch/x86/kernel/tsc_msr.c -@@ -92,7 +92,7 @@ unsigned long try_msr_calibrate_tsc(void) - - if (freq_desc_tables[cpu_index].msr_plat) { - rdmsr(MSR_PLATFORM_INFO, lo, hi); -- ratio = (lo >> 8) & 0x1f; -+ ratio = (lo >> 8) & 0xff; - } else { - rdmsr(MSR_IA32_PERF_STATUS, lo, hi); - ratio = (hi >> 8) & 0x1f; -diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index 6525e926f566..2e1fd586b895 100644 ---- a/arch/x86/kvm/cpuid.c -+++ b/arch/x86/kvm/cpuid.c -@@ -509,6 +509,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, - do_cpuid_1_ent(&entry[i], function, idx); - if (idx == 1) { - entry[i].eax &= kvm_supported_word10_x86_features; -+ cpuid_mask(&entry[i].eax, 10); - entry[i].ebx = 0; - if (entry[i].eax & (F(XSAVES)|F(XSAVEC))) - entry[i].ebx = -diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c -index b0ea42b78ccd..ab5318727579 100644 ---- a/arch/x86/kvm/i8254.c -+++ b/arch/x86/kvm/i8254.c -@@ -245,7 +245,7 @@ static void kvm_pit_ack_irq(struct kvm_irq_ack_notifier *kian) - * PIC is being reset. Handle it gracefully here - */ - atomic_inc(&ps->pending); -- else if (value > 0) -+ else if (value > 0 && ps->reinject) - /* in this case, we had multiple outstanding pit interrupts - * that we needed to inject. Reinject - */ -@@ -288,7 +288,9 @@ static void pit_do_work(struct kthread_work *work) - * last one has been acked. - */ - spin_lock(&ps->inject_lock); -- if (ps->irq_ack) { -+ if (!ps->reinject) -+ inject = 1; -+ else if (ps->irq_ack) { - ps->irq_ack = 0; - inject = 1; - } -@@ -317,10 +319,10 @@ static enum hrtimer_restart pit_timer_fn(struct hrtimer *data) - struct kvm_kpit_state *ps = container_of(data, struct kvm_kpit_state, timer); - struct kvm_pit *pt = ps->kvm->arch.vpit; - -- if (ps->reinject || !atomic_read(&ps->pending)) { -+ if (ps->reinject) - atomic_inc(&ps->pending); -- queue_kthread_work(&pt->worker, &pt->expired); -- } ++ return 0; ++} + -+ queue_kthread_work(&pt->worker, &pt->expired); + struct keyhash_result { + struct completion completion; + int err; +@@ -2458,6 +2508,7 @@ static struct talitos_alg_template driver_algs[] = { + { .type = CRYPTO_ALG_TYPE_AHASH, + .alg.hash = { + .halg.digestsize = MD5_DIGEST_SIZE, ++ .halg.statesize = sizeof(struct talitos_export_state), + .halg.base = { + .cra_name = "md5", + .cra_driver_name = "md5-talitos", +@@ -2473,6 +2524,7 @@ static struct talitos_alg_template driver_algs[] = { + { .type = CRYPTO_ALG_TYPE_AHASH, + .alg.hash = { + .halg.digestsize = SHA1_DIGEST_SIZE, ++ .halg.statesize = sizeof(struct talitos_export_state), + .halg.base = { + .cra_name = "sha1", + .cra_driver_name = "sha1-talitos", +@@ -2488,6 +2540,7 @@ static struct talitos_alg_template driver_algs[] = { + { .type = CRYPTO_ALG_TYPE_AHASH, + .alg.hash = { + .halg.digestsize = SHA224_DIGEST_SIZE, ++ .halg.statesize = sizeof(struct talitos_export_state), + .halg.base = { + .cra_name = "sha224", + .cra_driver_name = "sha224-talitos", +@@ -2503,6 +2556,7 @@ static struct talitos_alg_template driver_algs[] = { + { .type = CRYPTO_ALG_TYPE_AHASH, + .alg.hash = { + .halg.digestsize = SHA256_DIGEST_SIZE, ++ .halg.statesize = sizeof(struct talitos_export_state), + .halg.base = { + .cra_name = "sha256", + .cra_driver_name = "sha256-talitos", +@@ -2518,6 +2572,7 @@ static struct talitos_alg_template driver_algs[] = { + { .type = CRYPTO_ALG_TYPE_AHASH, + .alg.hash = { + .halg.digestsize = SHA384_DIGEST_SIZE, ++ .halg.statesize = sizeof(struct talitos_export_state), + .halg.base = { + .cra_name = "sha384", + .cra_driver_name = "sha384-talitos", +@@ -2533,6 +2588,7 @@ static struct talitos_alg_template driver_algs[] = { + { .type = CRYPTO_ALG_TYPE_AHASH, + .alg.hash = { + .halg.digestsize = SHA512_DIGEST_SIZE, ++ .halg.statesize = sizeof(struct talitos_export_state), + .halg.base = { + .cra_name = "sha512", + .cra_driver_name = "sha512-talitos", +@@ -2548,6 +2604,7 @@ static struct talitos_alg_template driver_algs[] = { + { .type = CRYPTO_ALG_TYPE_AHASH, + .alg.hash = { + .halg.digestsize = MD5_DIGEST_SIZE, ++ .halg.statesize = sizeof(struct talitos_export_state), + .halg.base = { + .cra_name = "hmac(md5)", + .cra_driver_name = "hmac-md5-talitos", +@@ -2563,6 +2620,7 @@ static struct talitos_alg_template driver_algs[] = { + { .type = CRYPTO_ALG_TYPE_AHASH, + .alg.hash = { + .halg.digestsize = SHA1_DIGEST_SIZE, ++ .halg.statesize = sizeof(struct talitos_export_state), + .halg.base = { + .cra_name = "hmac(sha1)", + .cra_driver_name = "hmac-sha1-talitos", +@@ -2578,6 +2636,7 @@ static struct talitos_alg_template driver_algs[] = { + { .type = CRYPTO_ALG_TYPE_AHASH, + .alg.hash = { + .halg.digestsize = SHA224_DIGEST_SIZE, ++ .halg.statesize = sizeof(struct talitos_export_state), + .halg.base = { + .cra_name = "hmac(sha224)", + .cra_driver_name = "hmac-sha224-talitos", +@@ -2593,6 +2652,7 @@ static struct talitos_alg_template driver_algs[] = { + { .type = CRYPTO_ALG_TYPE_AHASH, + .alg.hash = { + .halg.digestsize = SHA256_DIGEST_SIZE, ++ .halg.statesize = sizeof(struct talitos_export_state), + .halg.base = { + .cra_name = "hmac(sha256)", + .cra_driver_name = "hmac-sha256-talitos", +@@ -2608,6 +2668,7 @@ static struct talitos_alg_template driver_algs[] = { + { .type = CRYPTO_ALG_TYPE_AHASH, + .alg.hash = { + .halg.digestsize = SHA384_DIGEST_SIZE, ++ .halg.statesize = sizeof(struct talitos_export_state), + .halg.base = { + .cra_name = "hmac(sha384)", + .cra_driver_name = "hmac-sha384-talitos", +@@ -2623,6 +2684,7 @@ static struct talitos_alg_template driver_algs[] = { + { .type = CRYPTO_ALG_TYPE_AHASH, + .alg.hash = { + .halg.digestsize = SHA512_DIGEST_SIZE, ++ .halg.statesize = sizeof(struct talitos_export_state), + .halg.base = { + .cra_name = "hmac(sha512)", + .cra_driver_name = "hmac-sha512-talitos", +@@ -2814,6 +2876,8 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev, + t_alg->algt.alg.hash.finup = ahash_finup; + t_alg->algt.alg.hash.digest = ahash_digest; + t_alg->algt.alg.hash.setkey = ahash_setkey; ++ t_alg->algt.alg.hash.import = ahash_import; ++ t_alg->algt.alg.hash.export = ahash_export; - if (ps->is_periodic) { - hrtimer_add_expires_ns(&ps->timer, ps->period); -diff --git a/arch/x86/kvm/mtrr.c b/arch/x86/kvm/mtrr.c -index 3f8c732117ec..c146f3c262c3 100644 ---- a/arch/x86/kvm/mtrr.c -+++ b/arch/x86/kvm/mtrr.c -@@ -44,8 +44,6 @@ static bool msr_mtrr_valid(unsigned msr) - case MSR_MTRRdefType: - case MSR_IA32_CR_PAT: - return true; -- case 0x2f8: -- return true; - } - return false; - } -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 9bd8f44baded..60946a5d3812 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -2702,8 +2702,15 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx) - } else - vmx->nested.nested_vmx_ept_caps = 0; + if (!(priv->features & TALITOS_FTR_HMAC_OK) && + !strncmp(alg->cra_name, "hmac", 4)) { +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 03022f6420d7..a09841abae50 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -1541,7 +1541,7 @@ static int srp_map_idb(struct srp_rdma_ch *ch, struct srp_request *req, -+ /* -+ * Old versions of KVM use the single-context version without -+ * checking for support, so declare that it is supported even -+ * though it is treated as global context. The alternative is -+ * not failing the single-context invvpid, and it is worse. -+ */ - if (enable_vpid) - vmx->nested.nested_vmx_vpid_caps = VMX_VPID_INVVPID_BIT | -+ VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT | - VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT; - else - vmx->nested.nested_vmx_vpid_caps = 0; -@@ -5014,8 +5021,8 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event) - vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid); + if (dev->use_fast_reg) { + state.sg = idb_sg; +- sg_set_buf(idb_sg, req->indirect_desc, idb_len); ++ sg_init_one(idb_sg, req->indirect_desc, idb_len); + idb_sg->dma_address = req->indirect_dma_addr; /* hack! */ + #ifdef CONFIG_NEED_SG_DMA_LENGTH + idb_sg->dma_length = idb_sg->length; /* hack^2 */ +diff --git a/drivers/input/misc/pwm-beeper.c b/drivers/input/misc/pwm-beeper.c +index f2261ab54701..18663d4edae5 100644 +--- a/drivers/input/misc/pwm-beeper.c ++++ b/drivers/input/misc/pwm-beeper.c +@@ -20,21 +20,40 @@ + #include + #include + #include ++#include - cr0 = X86_CR0_NW | X86_CR0_CD | X86_CR0_ET; -- vmx_set_cr0(vcpu, cr0); /* enter rmode */ - vmx->vcpu.arch.cr0 = cr0; -+ vmx_set_cr0(vcpu, cr0); /* enter rmode */ - vmx_set_cr4(vcpu, 0); - vmx_set_efer(vcpu, 0); - vmx_fpu_activate(vcpu); -@@ -7398,6 +7405,7 @@ static int handle_invept(struct kvm_vcpu *vcpu) - if (!(types & (1UL << type))) { - nested_vmx_failValid(vcpu, - VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID); -+ skip_emulated_instruction(vcpu); - return 1; - } + struct pwm_beeper { + struct input_dev *input; + struct pwm_device *pwm; ++ struct work_struct work; + unsigned long period; + }; -@@ -7456,6 +7464,7 @@ static int handle_invvpid(struct kvm_vcpu *vcpu) - if (!(types & (1UL << type))) { - nested_vmx_failValid(vcpu, - VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID); -+ skip_emulated_instruction(vcpu); - return 1; - } + #define HZ_TO_NANOSECONDS(x) (1000000000UL/(x)) -@@ -7472,12 +7481,17 @@ static int handle_invvpid(struct kvm_vcpu *vcpu) - } ++static void __pwm_beeper_set(struct pwm_beeper *beeper) ++{ ++ unsigned long period = beeper->period; ++ ++ if (period) { ++ pwm_config(beeper->pwm, period / 2, period); ++ pwm_enable(beeper->pwm); ++ } else ++ pwm_disable(beeper->pwm); ++} ++ ++static void pwm_beeper_work(struct work_struct *work) ++{ ++ struct pwm_beeper *beeper = ++ container_of(work, struct pwm_beeper, work); ++ ++ __pwm_beeper_set(beeper); ++} ++ + static int pwm_beeper_event(struct input_dev *input, + unsigned int type, unsigned int code, int value) + { +- int ret = 0; + struct pwm_beeper *beeper = input_get_drvdata(input); +- unsigned long period; - switch (type) { -+ case VMX_VPID_EXTENT_SINGLE_CONTEXT: -+ /* -+ * Old versions of KVM use the single-context version so we -+ * have to support it; just treat it the same as all-context. -+ */ - case VMX_VPID_EXTENT_ALL_CONTEXT: - __vmx_flush_tlb(vcpu, to_vmx(vcpu)->nested.vpid02); - nested_vmx_succeed(vcpu); - break; - default: -- /* Trap single context invalidation invvpid calls */ -+ /* Trap individual address invalidation invvpid calls */ - BUG_ON(1); - break; - } -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index eaf6ee8c28b8..ac4963c38aa3 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -697,7 +697,6 @@ static int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr) - if ((xcr0 & XFEATURE_MASK_AVX512) != XFEATURE_MASK_AVX512) - return 1; + if (type != EV_SND || value < 0) + return -EINVAL; +@@ -49,22 +68,31 @@ static int pwm_beeper_event(struct input_dev *input, + return -EINVAL; } -- kvm_put_guest_xcr0(vcpu); - vcpu->arch.xcr0 = xcr0; - if ((xcr0 ^ old_xcr0) & XFEATURE_MASK_EXTEND) -@@ -2752,6 +2751,7 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu) - } +- if (value == 0) { +- pwm_disable(beeper->pwm); +- } else { +- period = HZ_TO_NANOSECONDS(value); +- ret = pwm_config(beeper->pwm, period / 2, period); +- if (ret) +- return ret; +- ret = pwm_enable(beeper->pwm); +- if (ret) +- return ret; +- beeper->period = period; +- } ++ if (value == 0) ++ beeper->period = 0; ++ else ++ beeper->period = HZ_TO_NANOSECONDS(value); ++ ++ schedule_work(&beeper->work); - kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu); -+ vcpu->arch.switch_db_regs |= KVM_DEBUGREG_RELOAD; + return 0; } - void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu) -@@ -6073,12 +6073,10 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win) - } - - /* try to inject new event if pending */ -- if (vcpu->arch.nmi_pending) { -- if (kvm_x86_ops->nmi_allowed(vcpu)) { -- --vcpu->arch.nmi_pending; -- vcpu->arch.nmi_injected = true; -- kvm_x86_ops->set_nmi(vcpu); -- } -+ if (vcpu->arch.nmi_pending && kvm_x86_ops->nmi_allowed(vcpu)) { -+ --vcpu->arch.nmi_pending; -+ vcpu->arch.nmi_injected = true; -+ kvm_x86_ops->set_nmi(vcpu); - } else if (kvm_cpu_has_injectable_intr(vcpu)) { - /* - * Because interrupts can be injected asynchronously, we are -@@ -6547,10 +6545,12 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - if (inject_pending_event(vcpu, req_int_win) != 0) - req_immediate_exit = true; - /* enable NMI/IRQ window open exits if needed */ -- else if (vcpu->arch.nmi_pending) -- kvm_x86_ops->enable_nmi_window(vcpu); -- else if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win) -- kvm_x86_ops->enable_irq_window(vcpu); -+ else { -+ if (vcpu->arch.nmi_pending) -+ kvm_x86_ops->enable_nmi_window(vcpu); -+ if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win) -+ kvm_x86_ops->enable_irq_window(vcpu); -+ } - - if (kvm_lapic_enabled(vcpu)) { - update_cr8_intercept(vcpu); -@@ -6568,8 +6568,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - kvm_x86_ops->prepare_guest_switch(vcpu); - if (vcpu->fpu_active) - kvm_load_guest_fpu(vcpu); -- kvm_load_guest_xcr0(vcpu); -- - vcpu->mode = IN_GUEST_MODE; - - srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx); -@@ -6592,6 +6590,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - goto cancel_injection; - } - -+ kvm_load_guest_xcr0(vcpu); ++static void pwm_beeper_stop(struct pwm_beeper *beeper) ++{ ++ cancel_work_sync(&beeper->work); + - if (req_immediate_exit) - smp_send_reschedule(vcpu->cpu); - -@@ -6641,6 +6641,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - vcpu->mode = OUTSIDE_GUEST_MODE; - smp_wmb(); - -+ kvm_put_guest_xcr0(vcpu); ++ if (beeper->period) ++ pwm_disable(beeper->pwm); ++} + - /* Interrupt is enabled by handle_external_intr() */ - kvm_x86_ops->handle_external_intr(vcpu); - -@@ -7288,7 +7290,6 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu) - * and assume host would use all available bits. - * Guest xcr0 would be loaded later. - */ -- kvm_put_guest_xcr0(vcpu); - vcpu->guest_fpu_loaded = 1; - __kernel_fpu_begin(); - __copy_kernel_to_fpregs(&vcpu->arch.guest_fpu.state); -@@ -7297,8 +7298,6 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu) - - void kvm_put_guest_fpu(struct kvm_vcpu *vcpu) - { -- kvm_put_guest_xcr0(vcpu); -- - if (!vcpu->guest_fpu_loaded) { - vcpu->fpu_counter = 0; - return; -diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c -index 637ab34ed632..ddb2244b06a1 100644 ---- a/arch/x86/mm/kmmio.c -+++ b/arch/x86/mm/kmmio.c -@@ -33,7 +33,7 @@ - struct kmmio_fault_page { - struct list_head list; - struct kmmio_fault_page *release_next; -- unsigned long page; /* location of the fault page */ -+ unsigned long addr; /* the requested address */ - pteval_t old_presence; /* page presence prior to arming */ - bool armed; - -@@ -70,9 +70,16 @@ unsigned int kmmio_count; - static struct list_head kmmio_page_table[KMMIO_PAGE_TABLE_SIZE]; - static LIST_HEAD(kmmio_probes); - --static struct list_head *kmmio_page_list(unsigned long page) -+static struct list_head *kmmio_page_list(unsigned long addr) - { -- return &kmmio_page_table[hash_long(page, KMMIO_PAGE_HASH_BITS)]; -+ unsigned int l; -+ pte_t *pte = lookup_address(addr, &l); ++static void pwm_beeper_close(struct input_dev *input) ++{ ++ struct pwm_beeper *beeper = input_get_drvdata(input); + -+ if (!pte) -+ return NULL; -+ addr &= page_level_mask(l); ++ pwm_beeper_stop(beeper); ++} + -+ return &kmmio_page_table[hash_long(addr, KMMIO_PAGE_HASH_BITS)]; - } - - /* Accessed per-cpu */ -@@ -98,15 +105,19 @@ static struct kmmio_probe *get_kmmio_probe(unsigned long addr) - } - - /* You must be holding RCU read lock. */ --static struct kmmio_fault_page *get_kmmio_fault_page(unsigned long page) -+static struct kmmio_fault_page *get_kmmio_fault_page(unsigned long addr) - { - struct list_head *head; - struct kmmio_fault_page *f; -+ unsigned int l; -+ pte_t *pte = lookup_address(addr, &l); - -- page &= PAGE_MASK; -- head = kmmio_page_list(page); -+ if (!pte) -+ return NULL; -+ addr &= page_level_mask(l); -+ head = kmmio_page_list(addr); - list_for_each_entry_rcu(f, head, list) { -- if (f->page == page) -+ if (f->addr == addr) - return f; - } - return NULL; -@@ -137,10 +148,10 @@ static void clear_pte_presence(pte_t *pte, bool clear, pteval_t *old) - static int clear_page_presence(struct kmmio_fault_page *f, bool clear) + static int pwm_beeper_probe(struct platform_device *pdev) { - unsigned int level; -- pte_t *pte = lookup_address(f->page, &level); -+ pte_t *pte = lookup_address(f->addr, &level); - - if (!pte) { -- pr_err("no pte for page 0x%08lx\n", f->page); -+ pr_err("no pte for addr 0x%08lx\n", f->addr); - return -1; + unsigned long pwm_id = (unsigned long)dev_get_platdata(&pdev->dev); +@@ -87,6 +115,8 @@ static int pwm_beeper_probe(struct platform_device *pdev) + goto err_free; } -@@ -156,7 +167,7 @@ static int clear_page_presence(struct kmmio_fault_page *f, bool clear) - return -1; - } ++ INIT_WORK(&beeper->work, pwm_beeper_work); ++ + beeper->input = input_allocate_device(); + if (!beeper->input) { + dev_err(&pdev->dev, "Failed to allocate input device\n"); +@@ -106,6 +136,7 @@ static int pwm_beeper_probe(struct platform_device *pdev) + beeper->input->sndbit[0] = BIT(SND_TONE) | BIT(SND_BELL); -- __flush_tlb_one(f->page); -+ __flush_tlb_one(f->addr); - return 0; - } + beeper->input->event = pwm_beeper_event; ++ beeper->input->close = pwm_beeper_close; -@@ -176,12 +187,12 @@ static int arm_kmmio_fault_page(struct kmmio_fault_page *f) - int ret; - WARN_ONCE(f->armed, KERN_ERR pr_fmt("kmmio page already armed.\n")); - if (f->armed) { -- pr_warning("double-arm: page 0x%08lx, ref %d, old %d\n", -- f->page, f->count, !!f->old_presence); -+ pr_warning("double-arm: addr 0x%08lx, ref %d, old %d\n", -+ f->addr, f->count, !!f->old_presence); - } - ret = clear_page_presence(f, true); -- WARN_ONCE(ret < 0, KERN_ERR pr_fmt("arming 0x%08lx failed.\n"), -- f->page); -+ WARN_ONCE(ret < 0, KERN_ERR pr_fmt("arming at 0x%08lx failed.\n"), -+ f->addr); - f->armed = true; - return ret; - } -@@ -191,7 +202,7 @@ static void disarm_kmmio_fault_page(struct kmmio_fault_page *f) - { - int ret = clear_page_presence(f, false); - WARN_ONCE(ret < 0, -- KERN_ERR "kmmio disarming 0x%08lx failed.\n", f->page); -+ KERN_ERR "kmmio disarming at 0x%08lx failed.\n", f->addr); - f->armed = false; - } + input_set_drvdata(beeper->input, beeper); -@@ -215,6 +226,12 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr) - struct kmmio_context *ctx; - struct kmmio_fault_page *faultpage; - int ret = 0; /* default to fault not handled */ -+ unsigned long page_base = addr; -+ unsigned int l; -+ pte_t *pte = lookup_address(addr, &l); -+ if (!pte) -+ return -EINVAL; -+ page_base &= page_level_mask(l); +@@ -135,7 +166,6 @@ static int pwm_beeper_remove(struct platform_device *pdev) - /* - * Preemption is now disabled to prevent process switch during -@@ -227,7 +244,7 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr) - preempt_disable(); - rcu_read_lock(); + input_unregister_device(beeper->input); -- faultpage = get_kmmio_fault_page(addr); -+ faultpage = get_kmmio_fault_page(page_base); - if (!faultpage) { - /* - * Either this page fault is not caused by kmmio, or -@@ -239,7 +256,7 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr) - - ctx = &get_cpu_var(kmmio_ctx); - if (ctx->active) { -- if (addr == ctx->addr) { -+ if (page_base == ctx->addr) { - /* - * A second fault on the same page means some other - * condition needs handling by do_page_fault(), the -@@ -267,9 +284,9 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr) - ctx->active++; - - ctx->fpage = faultpage; -- ctx->probe = get_kmmio_probe(addr); -+ ctx->probe = get_kmmio_probe(page_base); - ctx->saved_flags = (regs->flags & (X86_EFLAGS_TF | X86_EFLAGS_IF)); -- ctx->addr = addr; -+ ctx->addr = page_base; - - if (ctx->probe && ctx->probe->pre_handler) - ctx->probe->pre_handler(ctx->probe, regs, addr); -@@ -354,12 +371,11 @@ out: - } +- pwm_disable(beeper->pwm); + pwm_free(beeper->pwm); - /* You must be holding kmmio_lock. */ --static int add_kmmio_fault_page(unsigned long page) -+static int add_kmmio_fault_page(unsigned long addr) + kfree(beeper); +@@ -147,8 +177,7 @@ static int __maybe_unused pwm_beeper_suspend(struct device *dev) { - struct kmmio_fault_page *f; - -- page &= PAGE_MASK; -- f = get_kmmio_fault_page(page); -+ f = get_kmmio_fault_page(addr); - if (f) { - if (!f->count) - arm_kmmio_fault_page(f); -@@ -372,26 +388,25 @@ static int add_kmmio_fault_page(unsigned long page) - return -1; - - f->count = 1; -- f->page = page; -+ f->addr = addr; - - if (arm_kmmio_fault_page(f)) { - kfree(f); - return -1; - } + struct pwm_beeper *beeper = dev_get_drvdata(dev); -- list_add_rcu(&f->list, kmmio_page_list(f->page)); -+ list_add_rcu(&f->list, kmmio_page_list(f->addr)); +- if (beeper->period) +- pwm_disable(beeper->pwm); ++ pwm_beeper_stop(beeper); return 0; } - - /* You must be holding kmmio_lock. */ --static void release_kmmio_fault_page(unsigned long page, -+static void release_kmmio_fault_page(unsigned long addr, - struct kmmio_fault_page **release_list) +@@ -157,10 +186,8 @@ static int __maybe_unused pwm_beeper_resume(struct device *dev) { - struct kmmio_fault_page *f; - -- page &= PAGE_MASK; -- f = get_kmmio_fault_page(page); -+ f = get_kmmio_fault_page(addr); - if (!f) - return; - -@@ -420,18 +435,27 @@ int register_kmmio_probe(struct kmmio_probe *p) - int ret = 0; - unsigned long size = 0; - const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK); -+ unsigned int l; -+ pte_t *pte; - - spin_lock_irqsave(&kmmio_lock, flags); - if (get_kmmio_probe(p->addr)) { - ret = -EEXIST; - goto out; - } -+ -+ pte = lookup_address(p->addr, &l); -+ if (!pte) { -+ ret = -EINVAL; -+ goto out; -+ } -+ - kmmio_count++; - list_add_rcu(&p->list, &kmmio_probes); - while (size < size_lim) { - if (add_kmmio_fault_page(p->addr + size)) - pr_err("Unable to set page fault.\n"); -- size += PAGE_SIZE; -+ size += page_level_size(l); - } - out: - spin_unlock_irqrestore(&kmmio_lock, flags); -@@ -506,11 +530,17 @@ void unregister_kmmio_probe(struct kmmio_probe *p) - const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK); - struct kmmio_fault_page *release_list = NULL; - struct kmmio_delayed_release *drelease; -+ unsigned int l; -+ pte_t *pte; -+ -+ pte = lookup_address(p->addr, &l); -+ if (!pte) -+ return; + struct pwm_beeper *beeper = dev_get_drvdata(dev); - spin_lock_irqsave(&kmmio_lock, flags); - while (size < size_lim) { - release_kmmio_fault_page(p->addr + size, &release_list); -- size += PAGE_SIZE; -+ size += page_level_size(l); - } - list_del_rcu(&p->list); - kmmio_count--; -diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c -index 8f4cc3dfac32..5fb6adaaa796 100644 ---- a/arch/x86/mm/tlb.c -+++ b/arch/x86/mm/tlb.c -@@ -106,8 +106,6 @@ static void flush_tlb_func(void *info) - - if (f->flush_mm != this_cpu_read(cpu_tlbstate.active_mm)) - return; -- if (!f->flush_end) -- f->flush_end = f->flush_start + PAGE_SIZE; +- if (beeper->period) { +- pwm_config(beeper->pwm, beeper->period / 2, beeper->period); +- pwm_enable(beeper->pwm); +- } ++ if (beeper->period) ++ __pwm_beeper_set(beeper); - count_vm_tlb_event(NR_TLB_REMOTE_FLUSH_RECEIVED); - if (this_cpu_read(cpu_tlbstate.state) == TLBSTATE_OK) { -@@ -135,12 +133,20 @@ void native_flush_tlb_others(const struct cpumask *cpumask, - unsigned long end) - { - struct flush_tlb_info info; -+ -+ if (end == 0) -+ end = start + PAGE_SIZE; - info.flush_mm = mm; - info.flush_start = start; - info.flush_end = end; - - count_vm_tlb_event(NR_TLB_REMOTE_FLUSH); -- trace_tlb_flush(TLB_REMOTE_SEND_IPI, end - start); -+ if (end == TLB_FLUSH_ALL) -+ trace_tlb_flush(TLB_REMOTE_SEND_IPI, TLB_FLUSH_ALL); -+ else -+ trace_tlb_flush(TLB_REMOTE_SEND_IPI, -+ (end - start) >> PAGE_SHIFT); -+ - if (is_uv_system()) { - unsigned int cpu; - -diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c -index e58565556703..0ae7e9fa348d 100644 ---- a/arch/x86/pci/fixup.c -+++ b/arch/x86/pci/fixup.c -@@ -540,3 +540,10 @@ static void twinhead_reserve_killing_zone(struct pci_dev *dev) - } + return 0; } - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone); -+ -+static void pci_bdwep_bar(struct pci_dev *dev) -+{ -+ dev->non_compliant_bars = 1; -+} -+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_bdwep_bar); -+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_bdwep_bar); -diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c -index beac4dfdade6..349b8ce92bf2 100644 ---- a/arch/x86/pci/xen.c -+++ b/arch/x86/pci/xen.c -@@ -491,8 +491,11 @@ int __init pci_xen_initial_domain(void) - #endif - __acpi_register_gsi = acpi_register_gsi_xen; - __acpi_unregister_gsi = NULL; -- /* Pre-allocate legacy irqs */ -- for (irq = 0; irq < nr_legacy_irqs(); irq++) { +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index d7be6ddc34f6..2fc499a2207e 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -361,6 +361,13 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs + if (static_key_true(&supports_deactivate)) + gic_write_dir(irqnr); + #ifdef CONFIG_SMP ++ /* ++ * Unlike GICv2, we don't need an smp_rmb() here. ++ * The control dependency from gic_read_iar to ++ * the ISB in gic_write_eoir is enough to ensure ++ * that any shared data read by handle_IPI will ++ * be read after the ACK. ++ */ + handle_IPI(irqnr, regs); + #else + WARN_ONCE(true, "Unexpected SGI received!\n"); +@@ -380,6 +387,15 @@ static void __init gic_dist_init(void) + writel_relaxed(0, base + GICD_CTLR); + gic_dist_wait_for_rwp(); + + /* -+ * Pre-allocate the legacy IRQs. Use NR_LEGACY_IRQS here -+ * because we don't have a PIC and thus nr_legacy_irqs() is zero. ++ * Configure SPIs as non-secure Group-1. This will only matter ++ * if the GIC only has a single security state. This will not ++ * do the right thing if the kernel is running in secure mode, ++ * but that's not the intended use case anyway. + */ -+ for (irq = 0; irq < NR_IRQS_LEGACY; irq++) { - int trigger, polarity; - - if (acpi_get_override_irq(irq, &trigger, &polarity) == -1) -diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index d09e4c9d7cc5..e3679db17545 100644 ---- a/arch/x86/xen/enlighten.c -+++ b/arch/x86/xen/enlighten.c -@@ -961,7 +961,7 @@ static void xen_load_sp0(struct tss_struct *tss, - tss->x86_tss.sp0 = thread->sp0; - } - --static void xen_set_iopl_mask(unsigned mask) -+void xen_set_iopl_mask(unsigned mask) - { - struct physdev_set_iopl set_iopl; - -diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S -index 9ed55649ac8e..05e1df943856 100644 ---- a/arch/xtensa/kernel/head.S -+++ b/arch/xtensa/kernel/head.S -@@ -128,7 +128,7 @@ ENTRY(_startup) - wsr a0, icountlevel - - .set _index, 0 -- .rept XCHAL_NUM_DBREAK - 1 -+ .rept XCHAL_NUM_DBREAK - wsr a0, SREG_DBREAKC + _index - .set _index, _index + 1 - .endr -diff --git a/arch/xtensa/mm/cache.c b/arch/xtensa/mm/cache.c -index d75aa1476da7..1a804a2f9a5b 100644 ---- a/arch/xtensa/mm/cache.c -+++ b/arch/xtensa/mm/cache.c -@@ -97,11 +97,11 @@ void clear_user_highpage(struct page *page, unsigned long vaddr) - unsigned long paddr; - void *kvaddr = coherent_kvaddr(page, TLBTEMP_BASE_1, vaddr, &paddr); - -- pagefault_disable(); -+ preempt_disable(); - kmap_invalidate_coherent(page, vaddr); - set_bit(PG_arch_1, &page->flags); - clear_page_alias(kvaddr, paddr); -- pagefault_enable(); -+ preempt_enable(); - } - - void copy_user_highpage(struct page *dst, struct page *src, -@@ -113,11 +113,11 @@ void copy_user_highpage(struct page *dst, struct page *src, - void *src_vaddr = coherent_kvaddr(src, TLBTEMP_BASE_2, vaddr, - &src_paddr); - -- pagefault_disable(); -+ preempt_disable(); - kmap_invalidate_coherent(dst, vaddr); - set_bit(PG_arch_1, &dst->flags); - copy_page_alias(dst_vaddr, src_vaddr, dst_paddr, src_paddr); -- pagefault_enable(); -+ preempt_enable(); - } - - #endif /* DCACHE_WAY_SIZE > PAGE_SIZE */ -diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c -index 70cb408bc20d..92d785fefb6d 100644 ---- a/arch/xtensa/platforms/iss/console.c -+++ b/arch/xtensa/platforms/iss/console.c -@@ -100,21 +100,23 @@ static void rs_poll(unsigned long priv) - { - struct tty_port *port = (struct tty_port *)priv; - int i = 0; -+ int rd = 1; - unsigned char c; - - spin_lock(&timer_lock); - - while (simc_poll(0)) { -- simc_read(0, &c, 1); -+ rd = simc_read(0, &c, 1); -+ if (rd <= 0) -+ break; - tty_insert_flip_char(port, c, TTY_NORMAL); - i++; - } - - if (i) - tty_flip_buffer_push(port); -- -- -- mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE); -+ if (rd) -+ mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE); - spin_unlock(&timer_lock); - } - -diff --git a/block/blk-core.c b/block/blk-core.c -index b83d29755b5a..45f4d7efbf34 100644 ---- a/block/blk-core.c -+++ b/block/blk-core.c -@@ -2198,7 +2198,7 @@ int blk_insert_cloned_request(struct request_queue *q, struct request *rq) - if (q->mq_ops) { - if (blk_queue_io_stat(q)) - blk_account_io_start(rq, true); -- blk_mq_insert_request(rq, false, true, true); -+ blk_mq_insert_request(rq, false, true, false); - return 0; - } - -diff --git a/block/partition-generic.c b/block/partition-generic.c -index fefd01b496a0..cfcfe1b0ecbc 100644 ---- a/block/partition-generic.c -+++ b/block/partition-generic.c -@@ -350,15 +350,20 @@ struct hd_struct *add_partition(struct gendisk *disk, int partno, - goto out_del; - } - -+ err = hd_ref_init(p); -+ if (err) { -+ if (flags & ADDPART_FLAG_WHOLEDISK) -+ goto out_remove_file; -+ goto out_del; -+ } ++ for (i = 32; i < gic_data.irq_nr; i += 32) ++ writel_relaxed(~0, base + GICD_IGROUPR + i / 8); + - /* everything is up and running, commence */ - rcu_assign_pointer(ptbl->part[partno], p); + gic_dist_config(base, gic_data.irq_nr, gic_dist_wait_for_rwp); - /* suppress uevent if the disk suppresses it */ - if (!dev_get_uevent_suppress(ddev)) - kobject_uevent(&pdev->kobj, KOBJ_ADD); -- -- if (!hd_ref_init(p)) -- return p; -+ return p; - - out_free_info: - free_part_info(p); -@@ -367,6 +372,8 @@ out_free_stats: - out_free: - kfree(p); - return ERR_PTR(err); -+out_remove_file: -+ device_remove_file(pdev, &dev_attr_whole_disk); - out_del: - kobject_put(p->holder_dir); - device_del(pdev); -diff --git a/crypto/ahash.c b/crypto/ahash.c -index d19b52324cf5..dac1c24e9c3e 100644 ---- a/crypto/ahash.c -+++ b/crypto/ahash.c -@@ -69,8 +69,9 @@ static int hash_walk_new_entry(struct crypto_hash_walk *walk) - struct scatterlist *sg; - - sg = walk->sg; -- walk->pg = sg_page(sg); - walk->offset = sg->offset; -+ walk->pg = sg_page(walk->sg) + (walk->offset >> PAGE_SHIFT); -+ walk->offset = offset_in_page(walk->offset); - walk->entrylen = sg->length; - - if (walk->entrylen > walk->total) -diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c -index 90d6d47965b0..ecdb5a2ce085 100644 ---- a/crypto/asymmetric_keys/pkcs7_trust.c -+++ b/crypto/asymmetric_keys/pkcs7_trust.c -@@ -178,6 +178,8 @@ int pkcs7_validate_trust(struct pkcs7_message *pkcs7, - int cached_ret = -ENOKEY; - int ret; + /* Enable distributor with ARE, Group1 */ +@@ -494,6 +510,9 @@ static void gic_cpu_init(void) -+ *_trusted = false; -+ - for (p = pkcs7->certs; p; p = p->next) - p->seen = false; - -diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c -index 021d39c0ba75..13c4e5a5fe8c 100644 ---- a/crypto/asymmetric_keys/x509_cert_parser.c -+++ b/crypto/asymmetric_keys/x509_cert_parser.c -@@ -494,7 +494,7 @@ int x509_decode_time(time64_t *_t, size_t hdrlen, - unsigned char tag, - const unsigned char *value, size_t vlen) - { -- static const unsigned char month_lengths[] = { 31, 29, 31, 30, 31, 30, -+ static const unsigned char month_lengths[] = { 31, 28, 31, 30, 31, 30, - 31, 31, 30, 31, 30, 31 }; - const unsigned char *p = value; - unsigned year, mon, day, hour, min, sec, mon_len; -@@ -540,9 +540,9 @@ int x509_decode_time(time64_t *_t, size_t hdrlen, - if (year % 4 == 0) { - mon_len = 29; - if (year % 100 == 0) { -- year /= 100; -- if (year % 4 != 0) -- mon_len = 28; -+ mon_len = 28; -+ if (year % 400 == 0) -+ mon_len = 29; - } - } - } -diff --git a/crypto/keywrap.c b/crypto/keywrap.c -index b1d106ce55f3..72014f963ba7 100644 ---- a/crypto/keywrap.c -+++ b/crypto/keywrap.c -@@ -212,7 +212,7 @@ static int crypto_kw_decrypt(struct blkcipher_desc *desc, - SEMIBSIZE)) - ret = -EBADMSG; + rbase = gic_data_rdist_sgi_base(); -- memzero_explicit(&block, sizeof(struct crypto_kw_block)); -+ memzero_explicit(block, sizeof(struct crypto_kw_block)); ++ /* Configure SGIs/PPIs as non-secure Group-1 */ ++ writel_relaxed(~0, rbase + GICR_IGROUPR0); ++ + gic_cpu_config(rbase, gic_redist_wait_for_rwp); - return ret; - } -@@ -297,7 +297,7 @@ static int crypto_kw_encrypt(struct blkcipher_desc *desc, - /* establish the IV for the caller to pick up */ - memcpy(desc->info, block->A, SEMIBSIZE); - -- memzero_explicit(&block, sizeof(struct crypto_kw_block)); -+ memzero_explicit(block, sizeof(struct crypto_kw_block)); - - return 0; - } -diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c -index 50f5c97e1087..0cbc5a5025c2 100644 ---- a/crypto/rsa-pkcs1pad.c -+++ b/crypto/rsa-pkcs1pad.c -@@ -310,16 +310,16 @@ static int pkcs1pad_decrypt(struct akcipher_request *req) - req_ctx->child_req.src = req->src; - req_ctx->child_req.src_len = req->src_len; - req_ctx->child_req.dst = req_ctx->out_sg; -- req_ctx->child_req.dst_len = ctx->key_size - 1; -+ req_ctx->child_req.dst_len = ctx->key_size ; - -- req_ctx->out_buf = kmalloc(ctx->key_size - 1, -+ req_ctx->out_buf = kmalloc(ctx->key_size, - (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) ? - GFP_KERNEL : GFP_ATOMIC); - if (!req_ctx->out_buf) - return -ENOMEM; - - pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf, -- ctx->key_size - 1, NULL); -+ ctx->key_size, NULL); - - akcipher_request_set_tfm(&req_ctx->child_req, ctx->child); - akcipher_request_set_callback(&req_ctx->child_req, req->base.flags, -@@ -491,16 +491,16 @@ static int pkcs1pad_verify(struct akcipher_request *req) - req_ctx->child_req.src = req->src; - req_ctx->child_req.src_len = req->src_len; - req_ctx->child_req.dst = req_ctx->out_sg; -- req_ctx->child_req.dst_len = ctx->key_size - 1; -+ req_ctx->child_req.dst_len = ctx->key_size; - -- req_ctx->out_buf = kmalloc(ctx->key_size - 1, -+ req_ctx->out_buf = kmalloc(ctx->key_size, - (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) ? - GFP_KERNEL : GFP_ATOMIC); - if (!req_ctx->out_buf) - return -ENOMEM; - - pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf, -- ctx->key_size - 1, NULL); -+ ctx->key_size, NULL); - - akcipher_request_set_tfm(&req_ctx->child_req, ctx->child); - akcipher_request_set_callback(&req_ctx->child_req, req->base.flags, -diff --git a/crypto/testmgr.c b/crypto/testmgr.c -index ae8c57fd8bc7..d4944318ca1f 100644 ---- a/crypto/testmgr.c -+++ b/crypto/testmgr.c -@@ -1849,6 +1849,7 @@ static int alg_test_drbg(const struct alg_test_desc *desc, const char *driver, - static int do_test_rsa(struct crypto_akcipher *tfm, - struct akcipher_testvec *vecs) - { -+ char *xbuf[XBUFSIZE]; - struct akcipher_request *req; - void *outbuf_enc = NULL; - void *outbuf_dec = NULL; -@@ -1857,9 +1858,12 @@ static int do_test_rsa(struct crypto_akcipher *tfm, - int err = -ENOMEM; - struct scatterlist src, dst, src_tab[2]; - -+ if (testmgr_alloc_buf(xbuf)) -+ return err; -+ - req = akcipher_request_alloc(tfm, GFP_KERNEL); - if (!req) -- return err; -+ goto free_xbuf; - - init_completion(&result.completion); + /* Give LPIs a spin */ +diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c +index 8f9ebf714e2b..eef950046ac0 100644 +--- a/drivers/irqchip/irq-gic.c ++++ b/drivers/irqchip/irq-gic.c +@@ -344,6 +344,14 @@ static void __exception_irq_entry gic_handle_irq(struct pt_regs *regs) + if (static_key_true(&supports_deactivate)) + writel_relaxed(irqstat, cpu_base + GIC_CPU_DEACTIVATE); + #ifdef CONFIG_SMP ++ /* ++ * Ensure any shared data written by the CPU sending ++ * the IPI is read after we've read the ACK register ++ * on the GIC. ++ * ++ * Pairs with the write barrier in gic_raise_softirq ++ */ ++ smp_rmb(); + handle_IPI(irqnr, regs); + #endif + continue; +diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c +index 004926955263..b0155b05cddb 100644 +--- a/drivers/mcb/mcb-parse.c ++++ b/drivers/mcb/mcb-parse.c +@@ -57,7 +57,7 @@ static int chameleon_parse_gdd(struct mcb_bus *bus, + mdev->id = GDD_DEV(reg1); + mdev->rev = GDD_REV(reg1); + mdev->var = GDD_VAR(reg1); +- mdev->bar = GDD_BAR(reg1); ++ mdev->bar = GDD_BAR(reg2); + mdev->group = GDD_GRP(reg2); + mdev->inst = GDD_INS(reg2); -@@ -1877,9 +1881,14 @@ static int do_test_rsa(struct crypto_akcipher *tfm, - if (!outbuf_enc) - goto free_req; +diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c +index b7b3e8ee64f2..c30290f33430 100644 +--- a/drivers/mfd/omap-usb-tll.c ++++ b/drivers/mfd/omap-usb-tll.c +@@ -269,6 +269,8 @@ static int usbtll_omap_probe(struct platform_device *pdev) -+ if (WARN_ON(vecs->m_size > PAGE_SIZE)) -+ goto free_all; -+ -+ memcpy(xbuf[0], vecs->m, vecs->m_size); -+ - sg_init_table(src_tab, 2); -- sg_set_buf(&src_tab[0], vecs->m, 8); -- sg_set_buf(&src_tab[1], vecs->m + 8, vecs->m_size - 8); -+ sg_set_buf(&src_tab[0], xbuf[0], 8); -+ sg_set_buf(&src_tab[1], xbuf[0] + 8, vecs->m_size - 8); - sg_init_one(&dst, outbuf_enc, out_len_max); - akcipher_request_set_crypt(req, src_tab, &dst, vecs->m_size, - out_len_max); -@@ -1898,7 +1907,7 @@ static int do_test_rsa(struct crypto_akcipher *tfm, - goto free_all; - } - /* verify that encrypted message is equal to expected */ -- if (memcmp(vecs->c, sg_virt(req->dst), vecs->c_size)) { -+ if (memcmp(vecs->c, outbuf_enc, vecs->c_size)) { - pr_err("alg: rsa: encrypt test failed. Invalid output\n"); - err = -EINVAL; - goto free_all; -@@ -1913,7 +1922,13 @@ static int do_test_rsa(struct crypto_akcipher *tfm, - err = -ENOMEM; - goto free_all; + if (IS_ERR(tll->ch_clk[i])) + dev_dbg(dev, "can't get clock : %s\n", clkname); ++ else ++ clk_prepare(tll->ch_clk[i]); } -- sg_init_one(&src, vecs->c, vecs->c_size); -+ -+ if (WARN_ON(vecs->c_size > PAGE_SIZE)) -+ goto free_all; -+ -+ memcpy(xbuf[0], vecs->c, vecs->c_size); -+ -+ sg_init_one(&src, xbuf[0], vecs->c_size); - sg_init_one(&dst, outbuf_dec, out_len_max); - init_completion(&result.completion); - akcipher_request_set_crypt(req, &src, &dst, vecs->c_size, out_len_max); -@@ -1940,6 +1955,8 @@ free_all: - kfree(outbuf_enc); - free_req: - akcipher_request_free(req); -+free_xbuf: -+ testmgr_free_buf(xbuf); - return err; - } - -diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c -index 6979186dbd4b..9f77943653fb 100644 ---- a/drivers/acpi/acpi_processor.c -+++ b/drivers/acpi/acpi_processor.c -@@ -491,6 +491,58 @@ static void acpi_processor_remove(struct acpi_device *device) - } - #endif /* CONFIG_ACPI_HOTPLUG_CPU */ - -+#ifdef CONFIG_X86 -+static bool acpi_hwp_native_thermal_lvt_set; -+static acpi_status __init acpi_hwp_native_thermal_lvt_osc(acpi_handle handle, -+ u32 lvl, -+ void *context, -+ void **rv) -+{ -+ u8 sb_uuid_str[] = "4077A616-290C-47BE-9EBD-D87058713953"; -+ u32 capbuf[2]; -+ struct acpi_osc_context osc_context = { -+ .uuid_str = sb_uuid_str, -+ .rev = 1, -+ .cap.length = 8, -+ .cap.pointer = capbuf, -+ }; -+ -+ if (acpi_hwp_native_thermal_lvt_set) -+ return AE_CTRL_TERMINATE; -+ -+ capbuf[0] = 0x0000; -+ capbuf[1] = 0x1000; /* set bit 12 */ -+ -+ if (ACPI_SUCCESS(acpi_run_osc(handle, &osc_context))) { -+ if (osc_context.ret.pointer && osc_context.ret.length > 1) { -+ u32 *capbuf_ret = osc_context.ret.pointer; -+ -+ if (capbuf_ret[1] & 0x1000) { -+ acpi_handle_info(handle, -+ "_OSC native thermal LVT Acked\n"); -+ acpi_hwp_native_thermal_lvt_set = true; -+ } -+ } -+ kfree(osc_context.ret.pointer); -+ } -+ -+ return AE_OK; -+} -+ -+void __init acpi_early_processor_osc(void) -+{ -+ if (boot_cpu_has(X86_FEATURE_HWP)) { -+ acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT, -+ ACPI_UINT32_MAX, -+ acpi_hwp_native_thermal_lvt_osc, -+ NULL, NULL, NULL); -+ acpi_get_devices(ACPI_PROCESSOR_DEVICE_HID, -+ acpi_hwp_native_thermal_lvt_osc, -+ NULL, NULL); -+ } -+} -+#endif -+ - /* - * The following ACPI IDs are known to be suitable for representing as - * processor devices. -diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c -index 6a72047aae1c..c3a052d43317 100644 ---- a/drivers/acpi/acpica/dsmethod.c -+++ b/drivers/acpi/acpica/dsmethod.c -@@ -428,6 +428,9 @@ acpi_ds_begin_method_execution(struct acpi_namespace_node *method_node, - obj_desc->method.mutex->mutex. - original_sync_level = - obj_desc->method.mutex->mutex.sync_level; -+ -+ obj_desc->method.mutex->mutex.thread_id = -+ acpi_os_get_thread_id(); - } - } -diff --git a/drivers/acpi/acpica/nsinit.c b/drivers/acpi/acpica/nsinit.c -index bd75d46234a4..ddb436f86415 100644 ---- a/drivers/acpi/acpica/nsinit.c -+++ b/drivers/acpi/acpica/nsinit.c -@@ -83,6 +83,8 @@ acpi_status acpi_ns_initialize_objects(void) - - ACPI_FUNCTION_TRACE(ns_initialize_objects); - -+ ACPI_DEBUG_PRINT((ACPI_DB_EXEC, -+ "[Init] Completing Initialization of ACPI Objects\n")); - ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH, - "**** Starting initialization of namespace objects ****\n")); - ACPI_DEBUG_PRINT_RAW((ACPI_DB_INIT, -diff --git a/drivers/acpi/acpica/tbxfload.c b/drivers/acpi/acpica/tbxfload.c -index 278666e39563..c37d47982fbe 100644 ---- a/drivers/acpi/acpica/tbxfload.c -+++ b/drivers/acpi/acpica/tbxfload.c -@@ -83,6 +83,20 @@ acpi_status __init acpi_load_tables(void) - "While loading namespace from ACPI tables")); - } + pm_runtime_put_sync(dev); +@@ -301,9 +303,12 @@ static int usbtll_omap_remove(struct platform_device *pdev) + tll_dev = NULL; + spin_unlock(&tll_lock); -+ if (!acpi_gbl_group_module_level_code) { -+ /* -+ * Initialize the objects that remain uninitialized. This -+ * runs the executable AML that may be part of the -+ * declaration of these objects: -+ * operation_regions, buffer_fields, Buffers, and Packages. -+ */ -+ status = acpi_ns_initialize_objects(); -+ if (ACPI_FAILURE(status)) { -+ return_ACPI_STATUS(status); +- for (i = 0; i < tll->nch; i++) +- if (!IS_ERR(tll->ch_clk[i])) ++ for (i = 0; i < tll->nch; i++) { ++ if (!IS_ERR(tll->ch_clk[i])) { ++ clk_unprepare(tll->ch_clk[i]); + clk_put(tll->ch_clk[i]); + } + } -+ -+ acpi_gbl_reg_methods_enabled = TRUE; - return_ACPI_STATUS(status); - } -diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c -index 721b87cce908..638fbd4ad72b 100644 ---- a/drivers/acpi/acpica/utxfinit.c -+++ b/drivers/acpi/acpica/utxfinit.c -@@ -267,7 +267,6 @@ acpi_status __init acpi_initialize_objects(u32 flags) - * initialized, even if they contain executable AML (see the call to - * acpi_ns_initialize_objects below). - */ -- acpi_gbl_reg_methods_enabled = TRUE; - if (!(flags & ACPI_NO_ADDRESS_SPACE_INIT)) { - ACPI_DEBUG_PRINT((ACPI_DB_EXEC, - "[Init] Executing _REG OpRegion methods\n")); -@@ -299,20 +298,18 @@ acpi_status __init acpi_initialize_objects(u32 flags) - */ - if (acpi_gbl_group_module_level_code) { - acpi_ns_exec_module_code_list(); -- } + pm_runtime_disable(&pdev->dev); + return 0; +@@ -420,7 +425,7 @@ int omap_tll_enable(struct usbhs_omap_platform_data *pdata) + if (IS_ERR(tll->ch_clk[i])) + continue; -- /* -- * Initialize the objects that remain uninitialized. This runs the -- * executable AML that may be part of the declaration of these objects: -- * operation_regions, buffer_fields, Buffers, and Packages. -- */ -- if (!(flags & ACPI_NO_OBJECT_INIT)) { -- ACPI_DEBUG_PRINT((ACPI_DB_EXEC, -- "[Init] Completing Initialization of ACPI Objects\n")); -- -- status = acpi_ns_initialize_objects(); -- if (ACPI_FAILURE(status)) { -- return_ACPI_STATUS(status); -+ /* -+ * Initialize the objects that remain uninitialized. This -+ * runs the executable AML that may be part of the -+ * declaration of these objects: -+ * operation_regions, buffer_fields, Buffers, and Packages. -+ */ -+ if (!(flags & ACPI_NO_OBJECT_INIT)) { -+ status = acpi_ns_initialize_objects(); -+ if (ACPI_FAILURE(status)) { -+ return_ACPI_STATUS(status); -+ } +- r = clk_prepare_enable(tll->ch_clk[i]); ++ r = clk_enable(tll->ch_clk[i]); + if (r) { + dev_err(tll_dev, + "Error enabling ch %d clock: %d\n", i, r); +@@ -448,7 +453,7 @@ int omap_tll_disable(struct usbhs_omap_platform_data *pdata) + for (i = 0; i < tll->nch; i++) { + if (omap_usb_mode_needs_tll(pdata->port_mode[i])) { + if (!IS_ERR(tll->ch_clk[i])) +- clk_disable_unprepare(tll->ch_clk[i]); ++ clk_disable(tll->ch_clk[i]); } } -diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c -index 891c42d1cd65..f9081b791b81 100644 ---- a/drivers/acpi/bus.c -+++ b/drivers/acpi/bus.c -@@ -1005,6 +1005,9 @@ static int __init acpi_bus_init(void) - goto error1; - } +diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c +index cd0403f09267..e79c0371ee6f 100644 +--- a/drivers/misc/mei/amthif.c ++++ b/drivers/misc/mei/amthif.c +@@ -417,8 +417,10 @@ int mei_amthif_irq_read_msg(struct mei_cl *cl, -+ /* Set capability bits for _OSC under processor scope */ -+ acpi_early_processor_osc(); -+ - /* - * _OSC method may exist in module level code, - * so it must be run after ACPI_FULL_INITIALIZATION -diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c -index cd2c3d6d40e0..993fd31394c8 100644 ---- a/drivers/acpi/device_pm.c -+++ b/drivers/acpi/device_pm.c -@@ -319,6 +319,7 @@ int acpi_device_fix_up_power(struct acpi_device *device) + dev = cl->dev; - return ret; - } -+EXPORT_SYMBOL_GPL(acpi_device_fix_up_power); +- if (dev->iamthif_state != MEI_IAMTHIF_READING) ++ if (dev->iamthif_state != MEI_IAMTHIF_READING) { ++ mei_irq_discard_msg(dev, mei_hdr); + return 0; ++ } - int acpi_device_update_power(struct acpi_device *device, int *state_p) + ret = mei_cl_irq_read_msg(cl, mei_hdr, cmpl_list); + if (ret) +diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c +index 1a173d0af694..a77643954523 100644 +--- a/drivers/misc/mei/bus.c ++++ b/drivers/misc/mei/bus.c +@@ -222,17 +222,23 @@ EXPORT_SYMBOL_GPL(mei_cldev_recv); + static void mei_cl_bus_event_work(struct work_struct *work) { -diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h -index 1e6833a5cd44..6f41c73f82bb 100644 ---- a/drivers/acpi/internal.h -+++ b/drivers/acpi/internal.h -@@ -138,6 +138,12 @@ void acpi_early_processor_set_pdc(void); - static inline void acpi_early_processor_set_pdc(void) {} - #endif - -+#ifdef CONFIG_X86 -+void acpi_early_processor_osc(void); -+#else -+static inline void acpi_early_processor_osc(void) {} -+#endif -+ - /* -------------------------------------------------------------------------- - Embedded Controller - -------------------------------------------------------------------------- */ -diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c -index 67da6fb72274..c45fdc49ff28 100644 ---- a/drivers/acpi/osl.c -+++ b/drivers/acpi/osl.c -@@ -135,7 +135,7 @@ static struct osi_linux { - unsigned int enable:1; - unsigned int dmi:1; - unsigned int cmdline:1; -- unsigned int default_disabling:1; -+ u8 default_disabling; - } osi_linux = {0, 0, 0, 0}; - - static u32 acpi_osi_handler(acpi_string interface, u32 supported) -@@ -1713,10 +1713,13 @@ void __init acpi_osi_setup(char *str) - if (*str == '!') { - str++; - if (*str == '\0') { -- osi_linux.default_disabling = 1; -+ /* Do not override acpi_osi=!* */ -+ if (!osi_linux.default_disabling) -+ osi_linux.default_disabling = -+ ACPI_DISABLE_ALL_VENDOR_STRINGS; - return; - } else if (*str == '*') { -- acpi_update_interfaces(ACPI_DISABLE_ALL_STRINGS); -+ osi_linux.default_disabling = ACPI_DISABLE_ALL_STRINGS; - for (i = 0; i < OSI_STRING_ENTRIES_MAX; i++) { - osi = &osi_setup_entries[i]; - osi->enable = false; -@@ -1789,10 +1792,13 @@ static void __init acpi_osi_setup_late(void) - acpi_status status; - - if (osi_linux.default_disabling) { -- status = acpi_update_interfaces(ACPI_DISABLE_ALL_VENDOR_STRINGS); -+ status = acpi_update_interfaces(osi_linux.default_disabling); - - if (ACPI_SUCCESS(status)) -- printk(KERN_INFO PREFIX "Disabled all _OSI OS vendors\n"); -+ printk(KERN_INFO PREFIX "Disabled all _OSI OS vendors%s\n", -+ osi_linux.default_disabling == -+ ACPI_DISABLE_ALL_STRINGS ? -+ " and feature groups" : ""); - } - - for (i = 0; i < OSI_STRING_ENTRIES_MAX; i++) { -diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c -index d02fd53042a5..56241eb341f4 100644 ---- a/drivers/acpi/resource.c -+++ b/drivers/acpi/resource.c -@@ -27,8 +27,20 @@ - - #ifdef CONFIG_X86 - #define valid_IRQ(i) (((i) != 0) && ((i) != 2)) -+static inline bool acpi_iospace_resource_valid(struct resource *res) -+{ -+ /* On X86 IO space is limited to the [0 - 64K] IO port range */ -+ return res->end < 0x10003; -+} - #else - #define valid_IRQ(i) (true) -+/* -+ * ACPI IO descriptors on arches other than X86 contain MMIO CPU physical -+ * addresses mapping IO space in CPU physical address space, IO space -+ * resources can be placed anywhere in the 64-bit physical address space. -+ */ -+static inline bool -+acpi_iospace_resource_valid(struct resource *res) { return true; } - #endif - - static bool acpi_dev_resource_len_valid(u64 start, u64 end, u64 len, bool io) -@@ -127,7 +139,7 @@ static void acpi_dev_ioresource_flags(struct resource *res, u64 len, - if (!acpi_dev_resource_len_valid(res->start, res->end, len, true)) - res->flags |= IORESOURCE_DISABLED | IORESOURCE_UNSET; - -- if (res->end >= 0x10003) -+ if (!acpi_iospace_resource_valid(res)) - res->flags |= IORESOURCE_DISABLED | IORESOURCE_UNSET; + struct mei_cl_device *cldev; ++ struct mei_device *bus; - if (io_decode == ACPI_DECODE_16) -diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c -index 9cb975200cac..f054cadf30d8 100644 ---- a/drivers/acpi/sleep.c -+++ b/drivers/acpi/sleep.c -@@ -714,6 +714,7 @@ static int acpi_hibernation_enter(void) + cldev = container_of(work, struct mei_cl_device, event_work); - static void acpi_hibernation_leave(void) - { -+ pm_set_resume_via_firmware(); - /* - * If ACPI is not enabled by the BIOS and the boot kernel, we need to - * enable it here. -diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c -index 04975b851c23..639adb1f8abd 100644 ---- a/drivers/ata/ahci_platform.c -+++ b/drivers/ata/ahci_platform.c -@@ -51,6 +51,9 @@ static int ahci_probe(struct platform_device *pdev) - if (rc) - return rc; - -+ of_property_read_u32(dev->of_node, -+ "ports-implemented", &hpriv->force_port_map); ++ bus = cldev->bus; + - if (of_device_is_compatible(dev->of_node, "hisilicon,hisi-ahci")) - hpriv->flags |= AHCI_HFLAG_NO_FBS | AHCI_HFLAG_NO_NCQ; - -diff --git a/drivers/ata/ahci_xgene.c b/drivers/ata/ahci_xgene.c -index 8e3f7faf00d3..73b19b277138 100644 ---- a/drivers/ata/ahci_xgene.c -+++ b/drivers/ata/ahci_xgene.c -@@ -821,9 +821,9 @@ static int xgene_ahci_probe(struct platform_device *pdev) - dev_warn(&pdev->dev, "%s: Error reading device info. Assume version1\n", - __func__); - version = XGENE_AHCI_V1; -- } -- if (info->valid & ACPI_VALID_CID) -+ } else if (info->valid & ACPI_VALID_CID) { - version = XGENE_AHCI_V2; -+ } - } - } - #endif -diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c -index 85ea5142a095..bb050ea26101 100644 ---- a/drivers/ata/libahci.c -+++ b/drivers/ata/libahci.c -@@ -469,6 +469,7 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv) - dev_info(dev, "forcing port_map 0x%x -> 0x%x\n", - port_map, hpriv->force_port_map); - port_map = hpriv->force_port_map; -+ hpriv->saved_port_map = port_map; - } + if (cldev->event_cb) + cldev->event_cb(cldev, cldev->events, cldev->event_context); - if (hpriv->mask_port_map) { -diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c -index 301b785f9f56..0caf92ae25f3 100644 ---- a/drivers/base/power/domain.c -+++ b/drivers/base/power/domain.c -@@ -1378,7 +1378,7 @@ int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd, - mutex_lock(&subdomain->lock); - mutex_lock_nested(&genpd->lock, SINGLE_DEPTH_NESTING); - -- if (!list_empty(&subdomain->slave_links) || subdomain->device_count) { -+ if (!list_empty(&subdomain->master_links) || subdomain->device_count) { - pr_warn("%s: unable to remove subdomain %s\n", genpd->name, - subdomain->name); - ret = -EBUSY; -diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c -index cf351d3dab1c..0708f301ad97 100644 ---- a/drivers/base/power/opp/core.c -+++ b/drivers/base/power/opp/core.c -@@ -844,8 +844,14 @@ static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev, - } + cldev->events = 0; - opp->u_volt = microvolt[0]; -- opp->u_volt_min = microvolt[1]; -- opp->u_volt_max = microvolt[2]; -+ -+ if (count == 1) { -+ opp->u_volt_min = opp->u_volt; -+ opp->u_volt_max = opp->u_volt; -+ } else { -+ opp->u_volt_min = microvolt[1]; -+ opp->u_volt_max = microvolt[2]; + /* Prepare for the next read */ +- if (cldev->events_mask & BIT(MEI_CL_EVENT_RX)) ++ if (cldev->events_mask & BIT(MEI_CL_EVENT_RX)) { ++ mutex_lock(&bus->device_lock); + mei_cl_read_start(cldev->cl, 0, NULL); ++ mutex_unlock(&bus->device_lock); + } + } - /* Search for "opp-microamp-" */ - prop = NULL; -diff --git a/drivers/base/regmap/regmap-spmi.c b/drivers/base/regmap/regmap-spmi.c -index 7e58f6560399..4a36e415e938 100644 ---- a/drivers/base/regmap/regmap-spmi.c -+++ b/drivers/base/regmap/regmap-spmi.c -@@ -142,7 +142,7 @@ static int regmap_spmi_ext_read(void *context, - while (val_size) { - len = min_t(size_t, val_size, 8); - -- err = spmi_ext_register_readl(context, addr, val, val_size); -+ err = spmi_ext_register_readl(context, addr, val, len); - if (err) - goto err_out; - -diff --git a/drivers/block/brd.c b/drivers/block/brd.c -index cb27190e9f39..f7ecc287d733 100644 ---- a/drivers/block/brd.c -+++ b/drivers/block/brd.c -@@ -341,7 +341,7 @@ static blk_qc_t brd_make_request(struct request_queue *q, struct bio *bio) - - if (unlikely(bio->bi_rw & REQ_DISCARD)) { - if (sector & ((PAGE_SIZE >> SECTOR_SHIFT) - 1) || -- bio->bi_iter.bi_size & PAGE_MASK) -+ bio->bi_iter.bi_size & ~PAGE_MASK) - goto io_error; - discard_from_brd(brd, sector, bio->bi_iter.bi_size); - goto out; -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index 423f4ca7d712..80cf8add46ff 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -488,6 +488,12 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd, - bvec = __bvec_iter_bvec(bio->bi_io_vec, bio->bi_iter); - iov_iter_bvec(&iter, ITER_BVEC | rw, bvec, - bio_segments(bio), blk_rq_bytes(cmd->rq)); -+ /* -+ * This bio may be started from the middle of the 'bvec' -+ * because of bio splitting, so offset from the bvec must -+ * be passed to iov iterator -+ */ -+ iter.iov_offset = bio->bi_iter.bi_bvec_done; - - cmd->iocb.ki_pos = pos; - cmd->iocb.ki_filp = file; -diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c -index 9b180dbbd03c..1c330b61f05d 100644 ---- a/drivers/block/mtip32xx/mtip32xx.c -+++ b/drivers/block/mtip32xx/mtip32xx.c -@@ -173,7 +173,13 @@ static struct mtip_cmd *mtip_get_int_command(struct driver_data *dd) + /** +@@ -296,6 +302,7 @@ int mei_cldev_register_event_cb(struct mei_cl_device *cldev, + unsigned long events_mask, + mei_cldev_event_cb_t event_cb, void *context) { - struct request *rq; ++ struct mei_device *bus = cldev->bus; + int ret; -+ if (mtip_check_surprise_removal(dd->pdev)) -+ return NULL; -+ - rq = blk_mq_alloc_request(dd->queue, 0, BLK_MQ_REQ_RESERVED); -+ if (IS_ERR(rq)) -+ return NULL; -+ - return blk_mq_rq_to_pdu(rq); - } + if (cldev->event_cb) +@@ -308,15 +315,17 @@ int mei_cldev_register_event_cb(struct mei_cl_device *cldev, + INIT_WORK(&cldev->event_work, mei_cl_bus_event_work); -@@ -233,15 +239,9 @@ static void mtip_async_complete(struct mtip_port *port, - "Command tag %d failed due to TFE\n", tag); + if (cldev->events_mask & BIT(MEI_CL_EVENT_RX)) { ++ mutex_lock(&bus->device_lock); + ret = mei_cl_read_start(cldev->cl, 0, NULL); ++ mutex_unlock(&bus->device_lock); + if (ret && ret != -EBUSY) + return ret; } -- /* Unmap the DMA scatter list entries */ -- dma_unmap_sg(&dd->pdev->dev, cmd->sg, cmd->scatter_ents, cmd->direction); -- - rq = mtip_rq_from_tag(dd, tag); - -- if (unlikely(cmd->unaligned)) -- up(&port->cmd_slot_unal); -- -- blk_mq_end_request(rq, status ? -EIO : 0); -+ blk_mq_complete_request(rq, status); - } - - /* -@@ -581,6 +581,8 @@ static void mtip_completion(struct mtip_port *port, - dev_warn(&port->dd->pdev->dev, - "Internal command %d completed with TFE\n", tag); - -+ command->comp_func = NULL; -+ command->comp_data = NULL; - complete(waiting); - } - -@@ -618,8 +620,6 @@ static void mtip_handle_tfe(struct driver_data *dd) - - port = dd->port; - -- set_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags); -- - if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags)) { - cmd = mtip_cmd_from_tag(dd, MTIP_TAG_INTERNAL); - dbg_printk(MTIP_DRV_NAME " TFE for the internal command\n"); -@@ -628,7 +628,7 @@ static void mtip_handle_tfe(struct driver_data *dd) - cmd->comp_func(port, MTIP_TAG_INTERNAL, - cmd, PORT_IRQ_TF_ERR); - } -- goto handle_tfe_exit; -+ return; + if (cldev->events_mask & BIT(MEI_CL_EVENT_NOTIF)) { +- mutex_lock(&cldev->cl->dev->device_lock); ++ mutex_lock(&bus->device_lock); + ret = mei_cl_notify_request(cldev->cl, NULL, event_cb ? 1 : 0); +- mutex_unlock(&cldev->cl->dev->device_lock); ++ mutex_unlock(&bus->device_lock); + if (ret) + return ret; } +diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c +index a6c87c713193..958af84884b5 100644 +--- a/drivers/misc/mei/client.c ++++ b/drivers/misc/mei/client.c +@@ -1735,6 +1735,10 @@ void mei_cl_complete(struct mei_cl *cl, struct mei_cl_cb *cb) + wake_up(&cl->wait); - /* clear the tag accumulator */ -@@ -701,7 +701,7 @@ static void mtip_handle_tfe(struct driver_data *dd) - fail_reason = "thermal shutdown"; - } - if (buf[288] == 0xBF) { -- set_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag); -+ set_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag); - dev_info(&dd->pdev->dev, - "Drive indicates rebuild has failed. Secure erase required.\n"); - fail_all_ncq_cmds = 1; -@@ -771,11 +771,6 @@ static void mtip_handle_tfe(struct driver_data *dd) - } + break; ++ case MEI_FOP_DISCONNECT_RSP: ++ mei_io_cb_free(cb); ++ mei_cl_set_disconnected(cl); ++ break; + default: + BUG_ON(0); } - print_tags(dd, "reissued (TFE)", tagaccum, cmd_cnt); -- --handle_tfe_exit: -- /* clear eh_active */ -- clear_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags); -- wake_up_interruptible(&port->svc_wait); +diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c +index e7b7aad0999b..fd8a9f057ea6 100644 +--- a/drivers/misc/mei/hbm.c ++++ b/drivers/misc/mei/hbm.c +@@ -873,8 +873,7 @@ static int mei_hbm_fw_disconnect_req(struct mei_device *dev, + cb = mei_io_cb_init(cl, MEI_FOP_DISCONNECT_RSP, NULL); + if (!cb) + return -ENOMEM; +- cl_dbg(dev, cl, "add disconnect response as first\n"); +- list_add(&cb->list, &dev->ctrl_wr_list.list); ++ list_add_tail(&cb->list, &dev->ctrl_wr_list.list); + } + return 0; } - - /* -@@ -1007,6 +1002,7 @@ static bool mtip_pause_ncq(struct mtip_port *port, - (fis->features == 0x27 || fis->features == 0x72 || - fis->features == 0x62 || fis->features == 0x26))) { - clear_bit(MTIP_DDF_SEC_LOCK_BIT, &port->dd->dd_flag); -+ clear_bit(MTIP_DDF_REBUILD_FAILED_BIT, &port->dd->dd_flag); - /* Com reset after secure erase or lowlevel format */ - mtip_restart_port(port); - clear_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags); -@@ -1021,12 +1017,14 @@ static bool mtip_pause_ncq(struct mtip_port *port, - * - * @port Pointer to port data structure - * @timeout Max duration to wait (ms) -+ * @atomic gfp_t flag to indicate blockable context or not - * - * return value - * 0 Success - * -EBUSY Commands still active +diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c +index 64b568a0268d..d1df797c7568 100644 +--- a/drivers/misc/mei/interrupt.c ++++ b/drivers/misc/mei/interrupt.c +@@ -76,7 +76,6 @@ static inline int mei_cl_hbm_equal(struct mei_cl *cl, + * @dev: mei device + * @hdr: message header */ --static int mtip_quiesce_io(struct mtip_port *port, unsigned long timeout) -+static int mtip_quiesce_io(struct mtip_port *port, unsigned long timeout, -+ gfp_t atomic) +-static inline + void mei_irq_discard_msg(struct mei_device *dev, struct mei_msg_hdr *hdr) { - unsigned long to; - unsigned int n; -@@ -1037,16 +1035,21 @@ static int mtip_quiesce_io(struct mtip_port *port, unsigned long timeout) - to = jiffies + msecs_to_jiffies(timeout); - do { - if (test_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags) && -- test_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags)) { -+ test_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags) && -+ atomic == GFP_KERNEL) { - msleep(20); - continue; /* svc thd is actively issuing commands */ - } - -- msleep(100); -+ if (atomic == GFP_KERNEL) -+ msleep(100); -+ else { -+ cpu_relax(); -+ udelay(100); -+ } -+ - if (mtip_check_surprise_removal(port->dd->pdev)) - goto err_fault; -- if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &port->dd->dd_flag)) -- goto err_fault; - - /* - * Ignore s_active bit 0 of array element 0. -@@ -1099,6 +1102,7 @@ static int mtip_exec_internal_command(struct mtip_port *port, - struct mtip_cmd *int_cmd; - struct driver_data *dd = port->dd; - int rv = 0; -+ unsigned long start; - - /* Make sure the buffer is 8 byte aligned. This is asic specific. */ - if (buffer & 0x00000007) { -@@ -1107,6 +1111,10 @@ static int mtip_exec_internal_command(struct mtip_port *port, - } - - int_cmd = mtip_get_int_command(dd); -+ if (!int_cmd) { -+ dbg_printk(MTIP_DRV_NAME "Unable to allocate tag for PIO cmd\n"); -+ return -EFAULT; -+ } + /* +@@ -184,10 +183,7 @@ static int mei_cl_irq_disconnect_rsp(struct mei_cl *cl, struct mei_cl_cb *cb, + return -EMSGSIZE; - set_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags); - -@@ -1119,7 +1127,7 @@ static int mtip_exec_internal_command(struct mtip_port *port, - if (fis->command != ATA_CMD_STANDBYNOW1) { - /* wait for io to complete if non atomic */ - if (mtip_quiesce_io(port, -- MTIP_QUIESCE_IO_TIMEOUT_MS) < 0) { -+ MTIP_QUIESCE_IO_TIMEOUT_MS, atomic) < 0) { - dev_warn(&dd->pdev->dev, - "Failed to quiesce IO\n"); - mtip_put_int_command(dd, int_cmd); -@@ -1162,6 +1170,8 @@ static int mtip_exec_internal_command(struct mtip_port *port, - /* Populate the command header */ - int_cmd->command_header->byte_count = 0; - -+ start = jiffies; -+ - /* Issue the command to the hardware */ - mtip_issue_non_ncq_command(port, MTIP_TAG_INTERNAL); + ret = mei_hbm_cl_disconnect_rsp(dev, cl); +- mei_cl_set_disconnected(cl); +- mei_io_cb_free(cb); +- mei_me_cl_put(cl->me_cl); +- cl->me_cl = NULL; ++ list_move_tail(&cb->list, &cmpl_list->list); -@@ -1170,10 +1180,12 @@ static int mtip_exec_internal_command(struct mtip_port *port, - if ((rv = wait_for_completion_interruptible_timeout( - &wait, - msecs_to_jiffies(timeout))) <= 0) { -+ - if (rv == -ERESTARTSYS) { /* interrupted */ - dev_err(&dd->pdev->dev, -- "Internal command [%02X] was interrupted after %lu ms\n", -- fis->command, timeout); -+ "Internal command [%02X] was interrupted after %u ms\n", -+ fis->command, -+ jiffies_to_msecs(jiffies - start)); - rv = -EINTR; - goto exec_ic_exit; - } else if (rv == 0) /* timeout */ -@@ -2890,6 +2902,42 @@ static int mtip_ftl_rebuild_poll(struct driver_data *dd) - return -EFAULT; + return ret; } +diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h +index 4250555d5e72..1b06e2fd6858 100644 +--- a/drivers/misc/mei/mei_dev.h ++++ b/drivers/misc/mei/mei_dev.h +@@ -782,6 +782,8 @@ bool mei_hbuf_acquire(struct mei_device *dev); -+static void mtip_softirq_done_fn(struct request *rq) -+{ -+ struct mtip_cmd *cmd = blk_mq_rq_to_pdu(rq); -+ struct driver_data *dd = rq->q->queuedata; -+ -+ /* Unmap the DMA scatter list entries */ -+ dma_unmap_sg(&dd->pdev->dev, cmd->sg, cmd->scatter_ents, -+ cmd->direction); -+ -+ if (unlikely(cmd->unaligned)) -+ up(&dd->port->cmd_slot_unal); -+ -+ blk_mq_end_request(rq, rq->errors); -+} -+ -+static void mtip_abort_cmd(struct request *req, void *data, -+ bool reserved) -+{ -+ struct driver_data *dd = data; -+ -+ dbg_printk(MTIP_DRV_NAME " Aborting request, tag = %d\n", req->tag); -+ -+ clear_bit(req->tag, dd->port->cmds_to_issue); -+ req->errors = -EIO; -+ mtip_softirq_done_fn(req); -+} -+ -+static void mtip_queue_cmd(struct request *req, void *data, -+ bool reserved) -+{ -+ struct driver_data *dd = data; -+ -+ set_bit(req->tag, dd->port->cmds_to_issue); -+ blk_abort_request(req); -+} -+ - /* - * service thread to issue queued commands - * -@@ -2902,7 +2950,7 @@ static int mtip_ftl_rebuild_poll(struct driver_data *dd) - static int mtip_service_thread(void *data) - { - struct driver_data *dd = (struct driver_data *)data; -- unsigned long slot, slot_start, slot_wrap; -+ unsigned long slot, slot_start, slot_wrap, to; - unsigned int num_cmd_slots = dd->slot_groups * 32; - struct mtip_port *port = dd->port; - -@@ -2917,9 +2965,7 @@ static int mtip_service_thread(void *data) - * is in progress nor error handling is active - */ - wait_event_interruptible(port->svc_wait, (port->flags) && -- !(port->flags & MTIP_PF_PAUSE_IO)); -- -- set_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags); -+ (port->flags & MTIP_PF_SVC_THD_WORK)); - - if (kthread_should_stop() || - test_bit(MTIP_PF_SVC_THD_STOP_BIT, &port->flags)) -@@ -2929,6 +2975,8 @@ static int mtip_service_thread(void *data) - &dd->dd_flag))) - goto st_out; + bool mei_write_is_idle(struct mei_device *dev); -+ set_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags); -+ - restart_eh: - /* Demux bits: start with error handling */ - if (test_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags)) { -@@ -2939,6 +2987,32 @@ restart_eh: - if (test_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags)) - goto restart_eh; - -+ if (test_bit(MTIP_PF_TO_ACTIVE_BIT, &port->flags)) { -+ to = jiffies + msecs_to_jiffies(5000); -+ -+ do { -+ mdelay(100); -+ } while (atomic_read(&dd->irq_workers_active) != 0 && -+ time_before(jiffies, to)); -+ -+ if (atomic_read(&dd->irq_workers_active) != 0) -+ dev_warn(&dd->pdev->dev, -+ "Completion workers still active!"); -+ -+ spin_lock(dd->queue->queue_lock); -+ blk_mq_all_tag_busy_iter(*dd->tags.tags, -+ mtip_queue_cmd, dd); -+ spin_unlock(dd->queue->queue_lock); -+ -+ set_bit(MTIP_PF_ISSUE_CMDS_BIT, &dd->port->flags); -+ -+ if (mtip_device_reset(dd)) -+ blk_mq_all_tag_busy_iter(*dd->tags.tags, -+ mtip_abort_cmd, dd); -+ -+ clear_bit(MTIP_PF_TO_ACTIVE_BIT, &dd->port->flags); -+ } ++void mei_irq_discard_msg(struct mei_device *dev, struct mei_msg_hdr *hdr); + - if (test_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags)) { - slot = 1; - /* used to restrict the loop to one iteration */ -@@ -2971,10 +3045,8 @@ restart_eh: - } - - if (test_bit(MTIP_PF_REBUILD_BIT, &port->flags)) { -- if (mtip_ftl_rebuild_poll(dd) < 0) -- set_bit(MTIP_DDF_REBUILD_FAILED_BIT, -- &dd->dd_flag); -- clear_bit(MTIP_PF_REBUILD_BIT, &port->flags); -+ if (mtip_ftl_rebuild_poll(dd) == 0) -+ clear_bit(MTIP_PF_REBUILD_BIT, &port->flags); - } - } - -@@ -3089,7 +3161,7 @@ static int mtip_hw_get_identify(struct driver_data *dd) - if (buf[288] == 0xBF) { - dev_info(&dd->pdev->dev, - "Drive indicates rebuild has failed.\n"); -- /* TODO */ -+ set_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag); - } - } - -@@ -3263,20 +3335,25 @@ out1: - return rv; - } - --static void mtip_standby_drive(struct driver_data *dd) -+static int mtip_standby_drive(struct driver_data *dd) - { -- if (dd->sr) -- return; -+ int rv = 0; + #if IS_ENABLED(CONFIG_DEBUG_FS) + int mei_dbgfs_register(struct mei_device *dev, const char *name); + void mei_dbgfs_deregister(struct mei_device *dev); +diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c +index c6f36f3ca5d2..7630b6b7eb75 100644 +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -2494,11 +2494,12 @@ static const struct mmc_fixup blk_fixups[] = + MMC_QUIRK_BLK_NO_CMD23), -+ if (dd->sr || !dd->port) -+ return -ENODEV; /* - * Send standby immediate (E0h) to the drive so that it - * saves its state. +- * Some Micron MMC cards needs longer data read timeout than +- * indicated in CSD. ++ * Some MMC cards need longer data read timeout than indicated in CSD. */ - if (!test_bit(MTIP_PF_REBUILD_BIT, &dd->port->flags) && -- !test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag)) -- if (mtip_standby_immediate(dd->port)) -+ !test_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag) && -+ !test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag)) { -+ rv = mtip_standby_immediate(dd->port); -+ if (rv) - dev_warn(&dd->pdev->dev, - "STANDBY IMMEDIATE failed\n"); -+ } -+ return rv; - } + MMC_FIXUP(CID_NAME_ANY, CID_MANFID_MICRON, 0x200, add_quirk_mmc, + MMC_QUIRK_LONG_READ_TIME), ++ MMC_FIXUP("008GE0", CID_MANFID_TOSHIBA, CID_OEMID_ANY, add_quirk_mmc, ++ MMC_QUIRK_LONG_READ_TIME), - /* -@@ -3289,10 +3366,6 @@ static void mtip_standby_drive(struct driver_data *dd) - */ - static int mtip_hw_exit(struct driver_data *dd) - { -- /* -- * Send standby immediate (E0h) to the drive so that it -- * saves its state. -- */ - if (!dd->sr) { - /* de-initialize the port. */ - mtip_deinit_port(dd->port); -@@ -3334,8 +3407,7 @@ static int mtip_hw_shutdown(struct driver_data *dd) - * Send standby immediate (E0h) to the drive so that it - * saves its state. + /* + * On these Samsung MoviNAND parts, performing secure erase or +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index f95d41ffc766..228a81bcea49 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -868,11 +868,11 @@ void mmc_set_data_timeout(struct mmc_data *data, const struct mmc_card *card) + /* + * Some cards require longer data read timeout than indicated in CSD. + * Address this by setting the read timeout to a "reasonably high" +- * value. For the cards tested, 300ms has proven enough. If necessary, ++ * value. For the cards tested, 600ms has proven enough. If necessary, + * this value can be increased if other problematic cards require this. */ -- if (!dd->sr && dd->port) -- mtip_standby_immediate(dd->port); -+ mtip_standby_drive(dd); + if (mmc_card_long_read_time(card) && data->flags & MMC_DATA_READ) { +- data->timeout_ns = 300000000; ++ data->timeout_ns = 600000000; + data->timeout_clks = 0; + } - return 0; - } -@@ -3358,7 +3430,7 @@ static int mtip_hw_suspend(struct driver_data *dd) - * Send standby immediate (E0h) to the drive - * so that it saves its state. - */ -- if (mtip_standby_immediate(dd->port) != 0) { -+ if (mtip_standby_drive(dd) != 0) { - dev_err(&dd->pdev->dev, - "Failed standby-immediate command\n"); - return -EFAULT; -@@ -3596,6 +3668,28 @@ static int mtip_block_getgeo(struct block_device *dev, - return 0; +diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c +index bf49e44571f2..07a419fedd43 100644 +--- a/drivers/mmc/core/mmc.c ++++ b/drivers/mmc/core/mmc.c +@@ -333,6 +333,9 @@ static void mmc_manage_gp_partitions(struct mmc_card *card, u8 *ext_csd) + } } -+static int mtip_block_open(struct block_device *dev, fmode_t mode) -+{ -+ struct driver_data *dd; -+ -+ if (dev && dev->bd_disk) { -+ dd = (struct driver_data *) dev->bd_disk->private_data; -+ -+ if (dd) { -+ if (test_bit(MTIP_DDF_REMOVAL_BIT, -+ &dd->dd_flag)) { -+ return -ENODEV; -+ } -+ return 0; -+ } -+ } -+ return -ENODEV; -+} -+ -+void mtip_block_release(struct gendisk *disk, fmode_t mode) -+{ -+} ++/* Minimum partition switch timeout in milliseconds */ ++#define MMC_MIN_PART_SWITCH_TIME 300 + /* - * Block device operation function. - * -@@ -3603,6 +3697,8 @@ static int mtip_block_getgeo(struct block_device *dev, - * layer. + * Decode extended CSD. */ - static const struct block_device_operations mtip_block_ops = { -+ .open = mtip_block_open, -+ .release = mtip_block_release, - .ioctl = mtip_block_ioctl, - #ifdef CONFIG_COMPAT - .compat_ioctl = mtip_block_compat_ioctl, -@@ -3664,10 +3760,9 @@ static int mtip_submit_request(struct blk_mq_hw_ctx *hctx, struct request *rq) - rq_data_dir(rq))) { - return -ENODATA; - } -- if (unlikely(test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag))) -+ if (unlikely(test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag) || -+ test_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag))) - return -ENODATA; -- if (test_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag)) -- return -ENXIO; - } +@@ -397,6 +400,10 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd) - if (rq->cmd_flags & REQ_DISCARD) { -@@ -3779,11 +3874,33 @@ static int mtip_init_cmd(void *data, struct request *rq, unsigned int hctx_idx, - return 0; - } + /* EXT_CSD value is in units of 10ms, but we store in ms */ + card->ext_csd.part_time = 10 * ext_csd[EXT_CSD_PART_SWITCH_TIME]; ++ /* Some eMMC set the value too low so set a minimum */ ++ if (card->ext_csd.part_time && ++ card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME) ++ card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME; -+static enum blk_eh_timer_return mtip_cmd_timeout(struct request *req, -+ bool reserved) -+{ -+ struct driver_data *dd = req->q->queuedata; -+ int ret = BLK_EH_RESET_TIMER; -+ -+ if (reserved) -+ goto exit_handler; -+ -+ if (test_bit(req->tag, dd->port->cmds_to_issue)) -+ goto exit_handler; -+ -+ if (test_and_set_bit(MTIP_PF_TO_ACTIVE_BIT, &dd->port->flags)) -+ goto exit_handler; -+ -+ wake_up_interruptible(&dd->port->svc_wait); -+exit_handler: -+ return ret; -+} -+ - static struct blk_mq_ops mtip_mq_ops = { - .queue_rq = mtip_queue_rq, - .map_queue = blk_mq_map_queue, - .init_request = mtip_init_cmd, - .exit_request = mtip_free_cmd, -+ .complete = mtip_softirq_done_fn, -+ .timeout = mtip_cmd_timeout, + /* Sleep / awake timeout in 100ns units */ + if (sa_shift > 0 && sa_shift <= 0x17) +diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c +index 975139f97498..e517be7f03bf 100644 +--- a/drivers/mmc/host/sdhci-acpi.c ++++ b/drivers/mmc/host/sdhci-acpi.c +@@ -307,7 +307,7 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_int_emmc = { + .chip = &sdhci_acpi_chip_int, + .caps = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE | + MMC_CAP_HW_RESET | MMC_CAP_1_8V_DDR | +- MMC_CAP_BUS_WIDTH_TEST | MMC_CAP_WAIT_WHILE_BUSY, ++ MMC_CAP_WAIT_WHILE_BUSY, + .caps2 = MMC_CAP2_HC_ERASE_SZ, + .flags = SDHCI_ACPI_RUNTIME_PM, + .quirks = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC, +@@ -322,7 +322,7 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_int_sdio = { + SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC, + .quirks2 = SDHCI_QUIRK2_HOST_OFF_CARD_ON, + .caps = MMC_CAP_NONREMOVABLE | MMC_CAP_POWER_OFF_CARD | +- MMC_CAP_BUS_WIDTH_TEST | MMC_CAP_WAIT_WHILE_BUSY, ++ MMC_CAP_WAIT_WHILE_BUSY, + .flags = SDHCI_ACPI_RUNTIME_PM, + .pm_caps = MMC_PM_KEEP_POWER, + .probe_slot = sdhci_acpi_sdio_probe_slot, +@@ -334,7 +334,7 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_int_sd = { + .quirks = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC, + .quirks2 = SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON | + SDHCI_QUIRK2_STOP_WITH_TC, +- .caps = MMC_CAP_BUS_WIDTH_TEST | MMC_CAP_WAIT_WHILE_BUSY, ++ .caps = MMC_CAP_WAIT_WHILE_BUSY, + .probe_slot = sdhci_acpi_sd_probe_slot, }; - /* -@@ -3850,7 +3967,6 @@ static int mtip_block_initialize(struct driver_data *dd) - - mtip_hw_debugfs_init(dd); - --skip_create_disk: - memset(&dd->tags, 0, sizeof(dd->tags)); - dd->tags.ops = &mtip_mq_ops; - dd->tags.nr_hw_queues = 1; -@@ -3860,12 +3976,13 @@ skip_create_disk: - dd->tags.numa_node = dd->numa_node; - dd->tags.flags = BLK_MQ_F_SHOULD_MERGE; - dd->tags.driver_data = dd; -+ dd->tags.timeout = MTIP_NCQ_CMD_TIMEOUT_MS; - - rv = blk_mq_alloc_tag_set(&dd->tags); - if (rv) { - dev_err(&dd->pdev->dev, - "Unable to allocate request queue\n"); -- goto block_queue_alloc_init_error; -+ goto block_queue_alloc_tag_error; - } - - /* Allocate the request queue. */ -@@ -3880,6 +3997,7 @@ skip_create_disk: - dd->disk->queue = dd->queue; - dd->queue->queuedata = dd; - -+skip_create_disk: - /* Initialize the protocol layer. */ - wait_for_rebuild = mtip_hw_get_identify(dd); - if (wait_for_rebuild < 0) { -@@ -3976,8 +4094,9 @@ kthread_run_error: - read_capacity_error: - init_hw_cmds_error: - blk_cleanup_queue(dd->queue); -- blk_mq_free_tag_set(&dd->tags); - block_queue_alloc_init_error: -+ blk_mq_free_tag_set(&dd->tags); -+block_queue_alloc_tag_error: - mtip_hw_debugfs_exit(dd); - disk_index_error: - spin_lock(&rssd_index_lock); -@@ -3994,6 +4113,22 @@ protocol_init_error: - return rv; - } +@@ -396,7 +396,7 @@ static int sdhci_acpi_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + acpi_handle handle = ACPI_HANDLE(dev); +- struct acpi_device *device; ++ struct acpi_device *device, *child; + struct sdhci_acpi_host *c; + struct sdhci_host *host; + struct resource *iomem; +@@ -408,6 +408,11 @@ static int sdhci_acpi_probe(struct platform_device *pdev) + if (acpi_bus_get_device(handle, &device)) + return -ENODEV; -+static void mtip_no_dev_cleanup(struct request *rq, void *data, bool reserv) -+{ -+ struct driver_data *dd = (struct driver_data *)data; -+ struct mtip_cmd *cmd; -+ -+ if (likely(!reserv)) -+ blk_mq_complete_request(rq, -ENODEV); -+ else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) { -+ -+ cmd = mtip_cmd_from_tag(dd, MTIP_TAG_INTERNAL); -+ if (cmd->comp_func) -+ cmd->comp_func(dd->port, MTIP_TAG_INTERNAL, -+ cmd, -ENODEV); -+ } -+} -+ - /* - * Block layer deinitialization function. - * -@@ -4025,12 +4160,23 @@ static int mtip_block_remove(struct driver_data *dd) - } - } - -- if (!dd->sr) -- mtip_standby_drive(dd); -+ if (!dd->sr) { -+ /* -+ * Explicitly wait here for IOs to quiesce, -+ * as mtip_standby_drive usually won't wait for IOs. -+ */ -+ if (!mtip_quiesce_io(dd->port, MTIP_QUIESCE_IO_TIMEOUT_MS, -+ GFP_KERNEL)) -+ mtip_standby_drive(dd); -+ } - else - dev_info(&dd->pdev->dev, "device %s surprise removal\n", - dd->disk->disk_name); - -+ blk_mq_freeze_queue_start(dd->queue); -+ blk_mq_stop_hw_queues(dd->queue); -+ blk_mq_all_tag_busy_iter(dd->tags.tags[0], mtip_no_dev_cleanup, dd); -+ - /* - * Delete our gendisk structure. This also removes the device - * from /dev -@@ -4040,7 +4186,8 @@ static int mtip_block_remove(struct driver_data *dd) - dd->bdev = NULL; - } - if (dd->disk) { -- del_gendisk(dd->disk); -+ if (test_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag)) -+ del_gendisk(dd->disk); - if (dd->disk->queue) { - blk_cleanup_queue(dd->queue); - blk_mq_free_tag_set(&dd->tags); -@@ -4081,7 +4228,8 @@ static int mtip_block_shutdown(struct driver_data *dd) - dev_info(&dd->pdev->dev, - "Shutting down %s ...\n", dd->disk->disk_name); - -- del_gendisk(dd->disk); -+ if (test_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag)) -+ del_gendisk(dd->disk); - if (dd->disk->queue) { - blk_cleanup_queue(dd->queue); - blk_mq_free_tag_set(&dd->tags); -@@ -4426,7 +4574,7 @@ static void mtip_pci_remove(struct pci_dev *pdev) - struct driver_data *dd = pci_get_drvdata(pdev); - unsigned long flags, to; - -- set_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag); -+ set_bit(MTIP_DDF_REMOVAL_BIT, &dd->dd_flag); - - spin_lock_irqsave(&dev_lock, flags); - list_del_init(&dd->online_list); -@@ -4443,12 +4591,17 @@ static void mtip_pci_remove(struct pci_dev *pdev) - } while (atomic_read(&dd->irq_workers_active) != 0 && - time_before(jiffies, to)); - -+ if (!dd->sr) -+ fsync_bdev(dd->bdev); -+ - if (atomic_read(&dd->irq_workers_active) != 0) { - dev_warn(&dd->pdev->dev, - "Completion workers still active!\n"); - } - -- blk_mq_stop_hw_queues(dd->queue); -+ blk_set_queue_dying(dd->queue); -+ set_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag); -+ - /* Clean up the block layer. */ - mtip_block_remove(dd); - -diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h -index 3274784008eb..7617888f7944 100644 ---- a/drivers/block/mtip32xx/mtip32xx.h -+++ b/drivers/block/mtip32xx/mtip32xx.h -@@ -134,16 +134,24 @@ enum { - MTIP_PF_EH_ACTIVE_BIT = 1, /* error handling */ - MTIP_PF_SE_ACTIVE_BIT = 2, /* secure erase */ - MTIP_PF_DM_ACTIVE_BIT = 3, /* download microcde */ -+ MTIP_PF_TO_ACTIVE_BIT = 9, /* timeout handling */ - MTIP_PF_PAUSE_IO = ((1 << MTIP_PF_IC_ACTIVE_BIT) | - (1 << MTIP_PF_EH_ACTIVE_BIT) | - (1 << MTIP_PF_SE_ACTIVE_BIT) | -- (1 << MTIP_PF_DM_ACTIVE_BIT)), -+ (1 << MTIP_PF_DM_ACTIVE_BIT) | -+ (1 << MTIP_PF_TO_ACTIVE_BIT)), - - MTIP_PF_SVC_THD_ACTIVE_BIT = 4, - MTIP_PF_ISSUE_CMDS_BIT = 5, - MTIP_PF_REBUILD_BIT = 6, - MTIP_PF_SVC_THD_STOP_BIT = 8, - -+ MTIP_PF_SVC_THD_WORK = ((1 << MTIP_PF_EH_ACTIVE_BIT) | -+ (1 << MTIP_PF_ISSUE_CMDS_BIT) | -+ (1 << MTIP_PF_REBUILD_BIT) | -+ (1 << MTIP_PF_SVC_THD_STOP_BIT) | -+ (1 << MTIP_PF_TO_ACTIVE_BIT)), -+ - /* below are bit numbers in 'dd_flag' defined in driver_data */ - MTIP_DDF_SEC_LOCK_BIT = 0, - MTIP_DDF_REMOVE_PENDING_BIT = 1, -@@ -153,6 +161,7 @@ enum { - MTIP_DDF_RESUME_BIT = 6, - MTIP_DDF_INIT_DONE_BIT = 7, - MTIP_DDF_REBUILD_FAILED_BIT = 8, -+ MTIP_DDF_REMOVAL_BIT = 9, - - MTIP_DDF_STOP_IO = ((1 << MTIP_DDF_REMOVE_PENDING_BIT) | - (1 << MTIP_DDF_SEC_LOCK_BIT) | -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index e4c5cc107934..c65d41f4007a 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -618,8 +618,8 @@ static void nbd_request_handler(struct request_queue *q) - req, req->cmd_type); - - if (unlikely(!nbd->sock)) { -- dev_err(disk_to_dev(nbd->disk), -- "Attempted send on closed socket\n"); -+ dev_err_ratelimited(disk_to_dev(nbd->disk), -+ "Attempted send on closed socket\n"); - req->errors++; - nbd_end_request(nbd, req); - spin_lock_irq(q->queue_lock); -diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c -index 64a7b5971b57..cab97593ba54 100644 ---- a/drivers/block/null_blk.c -+++ b/drivers/block/null_blk.c -@@ -742,10 +742,11 @@ static int null_add_dev(void) - - add_disk(disk); - -+done: - mutex_lock(&lock); - list_add_tail(&nullb->list, &nullb_list); - mutex_unlock(&lock); --done: ++ /* Power on the SDHCI controller and its children */ ++ acpi_device_fix_up_power(device); ++ list_for_each_entry(child, &device->children, node) ++ acpi_device_fix_up_power(child); + - return 0; - - out_cleanup_lightnvm: -diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c -index 562b5a4ca7b7..78a39f736c64 100644 ---- a/drivers/block/paride/pd.c -+++ b/drivers/block/paride/pd.c -@@ -126,7 +126,7 @@ - */ - #include - --static bool verbose = 0; -+static int verbose = 0; - static int major = PD_MAJOR; - static char *name = PD_NAME; - static int cluster = 64; -@@ -161,7 +161,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_GEO, D_SBY, D_DLY, D_SLV}; - static DEFINE_MUTEX(pd_mutex); - static DEFINE_SPINLOCK(pd_lock); - --module_param(verbose, bool, 0); -+module_param(verbose, int, 0); - module_param(major, int, 0); - module_param(name, charp, 0); - module_param(cluster, int, 0); -diff --git a/drivers/block/paride/pt.c b/drivers/block/paride/pt.c -index 1740d75e8a32..216a94fed5b4 100644 ---- a/drivers/block/paride/pt.c -+++ b/drivers/block/paride/pt.c -@@ -117,7 +117,7 @@ - - */ - --static bool verbose = 0; -+static int verbose = 0; - static int major = PT_MAJOR; - static char *name = PT_NAME; - static int disable = 0; -@@ -152,7 +152,7 @@ static int (*drives[4])[6] = {&drive0, &drive1, &drive2, &drive3}; - - #include - --module_param(verbose, bool, 0); -+module_param(verbose, int, 0); - module_param(major, int, 0); - module_param(name, charp, 0); - module_param_array(drive0, int, NULL, 0); -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index 4a876785b68c..9745cf9fcd3c 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -1955,7 +1955,7 @@ static struct ceph_osd_request *rbd_osd_req_create( - - osdc = &rbd_dev->rbd_client->client->osdc; - osd_req = ceph_osdc_alloc_request(osdc, snapc, num_ops, false, -- GFP_ATOMIC); -+ GFP_NOIO); - if (!osd_req) - return NULL; /* ENOMEM */ - -@@ -2004,7 +2004,7 @@ rbd_osd_req_create_copyup(struct rbd_obj_request *obj_request) - rbd_dev = img_request->rbd_dev; - osdc = &rbd_dev->rbd_client->client->osdc; - osd_req = ceph_osdc_alloc_request(osdc, snapc, num_osd_ops, -- false, GFP_ATOMIC); -+ false, GFP_NOIO); - if (!osd_req) - return NULL; /* ENOMEM */ - -@@ -2506,7 +2506,7 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request, - bio_chain_clone_range(&bio_list, - &bio_offset, - clone_size, -- GFP_ATOMIC); -+ GFP_NOIO); - if (!obj_request->bio_list) - goto out_unwind; - } else if (type == OBJ_REQUEST_PAGES) { -diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c -index fa893c3ec408..0beaa52df66b 100644 ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -82,6 +82,7 @@ static const struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x0489, 0xe05f) }, - { USB_DEVICE(0x0489, 0xe076) }, - { USB_DEVICE(0x0489, 0xe078) }, -+ { USB_DEVICE(0x0489, 0xe095) }, - { USB_DEVICE(0x04c5, 0x1330) }, - { USB_DEVICE(0x04CA, 0x3004) }, - { USB_DEVICE(0x04CA, 0x3005) }, -@@ -92,6 +93,7 @@ static const struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x04CA, 0x300d) }, - { USB_DEVICE(0x04CA, 0x300f) }, - { USB_DEVICE(0x04CA, 0x3010) }, -+ { USB_DEVICE(0x04CA, 0x3014) }, - { USB_DEVICE(0x0930, 0x0219) }, - { USB_DEVICE(0x0930, 0x021c) }, - { USB_DEVICE(0x0930, 0x0220) }, -@@ -113,10 +115,12 @@ static const struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x13d3, 0x3362) }, - { USB_DEVICE(0x13d3, 0x3375) }, - { USB_DEVICE(0x13d3, 0x3393) }, -+ { USB_DEVICE(0x13d3, 0x3395) }, - { USB_DEVICE(0x13d3, 0x3402) }, - { USB_DEVICE(0x13d3, 0x3408) }, - { USB_DEVICE(0x13d3, 0x3423) }, - { USB_DEVICE(0x13d3, 0x3432) }, -+ { USB_DEVICE(0x13d3, 0x3472) }, - { USB_DEVICE(0x13d3, 0x3474) }, - - /* Atheros AR5BBU12 with sflash firmware */ -@@ -144,6 +148,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { - { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, -@@ -154,6 +159,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { - { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, -@@ -175,10 +181,12 @@ static const struct usb_device_id ath3k_blist_tbl[] = { - { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU22 with sflash firmware */ -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index a191e318fab8..0d4e372e426d 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -196,6 +196,7 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, -@@ -206,6 +207,7 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, -@@ -227,10 +229,12 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU12 with sflash firmware */ -diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c -index 80783dcb7f57..aba31210c802 100644 ---- a/drivers/bluetooth/hci_vhci.c -+++ b/drivers/bluetooth/hci_vhci.c -@@ -50,6 +50,7 @@ struct vhci_data { - wait_queue_head_t read_wait; - struct sk_buff_head readq; - -+ struct mutex open_mutex; - struct delayed_work open_timeout; - }; + if (acpi_bus_get_status(device) || !device->status.present) + return -ENODEV; -@@ -87,12 +88,15 @@ static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) +diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c +index a04d0f7ee00e..807f930a7c14 100644 +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -361,7 +361,6 @@ static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot) + { + slot->host->mmc->caps |= MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE | + MMC_CAP_HW_RESET | MMC_CAP_1_8V_DDR | +- MMC_CAP_BUS_WIDTH_TEST | + MMC_CAP_WAIT_WHILE_BUSY; + slot->host->mmc->caps2 |= MMC_CAP2_HC_ERASE_SZ; + slot->hw_reset = sdhci_pci_int_hw_reset; +@@ -377,15 +376,13 @@ static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot) + static int byt_sdio_probe_slot(struct sdhci_pci_slot *slot) + { + slot->host->mmc->caps |= MMC_CAP_POWER_OFF_CARD | MMC_CAP_NONREMOVABLE | +- MMC_CAP_BUS_WIDTH_TEST | + MMC_CAP_WAIT_WHILE_BUSY; return 0; } --static int vhci_create_device(struct vhci_data *data, __u8 opcode) -+static int __vhci_create_device(struct vhci_data *data, __u8 opcode) + static int byt_sd_probe_slot(struct sdhci_pci_slot *slot) { - struct hci_dev *hdev; - struct sk_buff *skb; - __u8 dev_type; +- slot->host->mmc->caps |= MMC_CAP_BUS_WIDTH_TEST | +- MMC_CAP_WAIT_WHILE_BUSY; ++ slot->host->mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY; + slot->cd_con_id = NULL; + slot->cd_idx = 0; + slot->cd_override_level = true; +diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c +index 5b9834cf2820..96fddb016bf1 100644 +--- a/drivers/mtd/ubi/eba.c ++++ b/drivers/mtd/ubi/eba.c +@@ -426,8 +426,25 @@ retry: + pnum, vol_id, lnum); + err = -EBADMSG; + } else { +- err = -EINVAL; +- ubi_ro_mode(ubi); ++ /* ++ * Ending up here in the non-Fastmap case ++ * is a clear bug as the VID header had to ++ * be present at scan time to have it referenced. ++ * With fastmap the story is more complicated. ++ * Fastmap has the mapping info without the need ++ * of a full scan. So the LEB could have been ++ * unmapped, Fastmap cannot know this and keeps ++ * the LEB referenced. ++ * This is valid and works as the layer above UBI ++ * has to do bookkeeping about used/referenced ++ * LEBs in any case. ++ */ ++ if (ubi->fast_attach) { ++ err = -EBADMSG; ++ } else { ++ err = -EINVAL; ++ ubi_ro_mode(ubi); ++ } + } + } + goto out_free; +diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c +index 263b439e21a8..990898b9dc72 100644 +--- a/drivers/mtd/ubi/fastmap.c ++++ b/drivers/mtd/ubi/fastmap.c +@@ -1058,6 +1058,7 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai, + ubi_msg(ubi, "fastmap WL pool size: %d", + ubi->fm_wl_pool.max_size); + ubi->fm_disabled = 0; ++ ubi->fast_attach = 1; -+ if (data->hdev) -+ return -EBADFD; + ubi_free_vid_hdr(ubi, vh); + kfree(ech); +diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h +index 2974b67f6c6c..de1ea2e4c37d 100644 +--- a/drivers/mtd/ubi/ubi.h ++++ b/drivers/mtd/ubi/ubi.h +@@ -462,6 +462,7 @@ struct ubi_debug_info { + * @fm_eba_sem: allows ubi_update_fastmap() to block EBA table changes + * @fm_work: fastmap work queue + * @fm_work_scheduled: non-zero if fastmap work was scheduled ++ * @fast_attach: non-zero if UBI was attached by fastmap + * + * @used: RB-tree of used physical eraseblocks + * @erroneous: RB-tree of erroneous used physical eraseblocks +@@ -570,6 +571,7 @@ struct ubi_device { + size_t fm_size; + struct work_struct fm_work; + int fm_work_scheduled; ++ int fast_attach; + + /* Wear-leveling sub-system's stuff */ + struct rb_root used; +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index 141c2a42d7ed..910c12e2638e 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -696,11 +696,17 @@ int can_change_mtu(struct net_device *dev, int new_mtu) + /* allow change of MTU according to the CANFD ability of the device */ + switch (new_mtu) { + case CAN_MTU: ++ /* 'CANFD-only' controllers can not switch to CAN_MTU */ ++ if (priv->ctrlmode_static & CAN_CTRLMODE_FD) ++ return -EINVAL; + - /* bits 0-1 are dev_type (BR/EDR or AMP) */ - dev_type = opcode & 0x03; + priv->ctrlmode &= ~CAN_CTRLMODE_FD; + break; -@@ -151,6 +155,17 @@ static int vhci_create_device(struct vhci_data *data, __u8 opcode) - return 0; - } + case CANFD_MTU: +- if (!(priv->ctrlmode_supported & CAN_CTRLMODE_FD)) ++ /* check for potential CANFD ability */ ++ if (!(priv->ctrlmode_supported & CAN_CTRLMODE_FD) && ++ !(priv->ctrlmode_static & CAN_CTRLMODE_FD)) + return -EINVAL; -+static int vhci_create_device(struct vhci_data *data, __u8 opcode) + priv->ctrlmode |= CAN_CTRLMODE_FD; +@@ -782,6 +788,35 @@ static const struct nla_policy can_policy[IFLA_CAN_MAX + 1] = { + = { .len = sizeof(struct can_bittiming_const) }, + }; + ++static int can_validate(struct nlattr *tb[], struct nlattr *data[]) +{ -+ int err; ++ bool is_can_fd = false; + -+ mutex_lock(&data->open_mutex); -+ err = __vhci_create_device(data, opcode); -+ mutex_unlock(&data->open_mutex); ++ /* Make sure that valid CAN FD configurations always consist of ++ * - nominal/arbitration bittiming ++ * - data bittiming ++ * - control mode with CAN_CTRLMODE_FD set ++ */ + -+ return err; ++ if (data[IFLA_CAN_CTRLMODE]) { ++ struct can_ctrlmode *cm = nla_data(data[IFLA_CAN_CTRLMODE]); ++ ++ is_can_fd = cm->flags & cm->mask & CAN_CTRLMODE_FD; ++ } ++ ++ if (is_can_fd) { ++ if (!data[IFLA_CAN_BITTIMING] || !data[IFLA_CAN_DATA_BITTIMING]) ++ return -EOPNOTSUPP; ++ } ++ ++ if (data[IFLA_CAN_DATA_BITTIMING]) { ++ if (!is_can_fd || !data[IFLA_CAN_BITTIMING]) ++ return -EOPNOTSUPP; ++ } ++ ++ return 0; +} + - static inline ssize_t vhci_get_user(struct vhci_data *data, - struct iov_iter *from) - { -@@ -189,11 +204,6 @@ static inline ssize_t vhci_get_user(struct vhci_data *data, - break; - - case HCI_VENDOR_PKT: -- if (data->hdev) { -- kfree_skb(skb); -- return -EBADFD; -- } -- - cancel_delayed_work_sync(&data->open_timeout); - - opcode = *((__u8 *) skb->data); -@@ -320,6 +330,7 @@ static int vhci_open(struct inode *inode, struct file *file) - skb_queue_head_init(&data->readq); - init_waitqueue_head(&data->read_wait); - -+ mutex_init(&data->open_mutex); - INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout); - - file->private_data = data; -@@ -333,15 +344,18 @@ static int vhci_open(struct inode *inode, struct file *file) - static int vhci_release(struct inode *inode, struct file *file) + static int can_changelink(struct net_device *dev, + struct nlattr *tb[], struct nlattr *data[]) { - struct vhci_data *data = file->private_data; -- struct hci_dev *hdev = data->hdev; -+ struct hci_dev *hdev; +@@ -813,19 +848,31 @@ static int can_changelink(struct net_device *dev, - cancel_delayed_work_sync(&data->open_timeout); + if (data[IFLA_CAN_CTRLMODE]) { + struct can_ctrlmode *cm; ++ u32 ctrlstatic; ++ u32 maskedflags; -+ hdev = data->hdev; + /* Do not allow changing controller mode while running */ + if (dev->flags & IFF_UP) + return -EBUSY; + cm = nla_data(data[IFLA_CAN_CTRLMODE]); ++ ctrlstatic = priv->ctrlmode_static; ++ maskedflags = cm->flags & cm->mask; + - if (hdev) { - hci_unregister_dev(hdev); - hci_free_dev(hdev); - } - -+ skb_queue_purge(&data->readq); - file->private_data = NULL; - kfree(data); - -diff --git a/drivers/bus/imx-weim.c b/drivers/bus/imx-weim.c -index e98d15eaa799..1827fc4d15c1 100644 ---- a/drivers/bus/imx-weim.c -+++ b/drivers/bus/imx-weim.c -@@ -150,7 +150,7 @@ static int __init weim_parse_dt(struct platform_device *pdev, - return ret; - } - -- for_each_child_of_node(pdev->dev.of_node, child) { -+ for_each_available_child_of_node(pdev->dev.of_node, child) { - if (!child->name) - continue; - -diff --git a/drivers/bus/uniphier-system-bus.c b/drivers/bus/uniphier-system-bus.c -index 834a2aeaf27a..350b7309c26d 100644 ---- a/drivers/bus/uniphier-system-bus.c -+++ b/drivers/bus/uniphier-system-bus.c -@@ -108,7 +108,7 @@ static int uniphier_system_bus_check_overlap( - - for (i = 0; i < ARRAY_SIZE(priv->bank); i++) { - for (j = i + 1; j < ARRAY_SIZE(priv->bank); j++) { -- if (priv->bank[i].end > priv->bank[j].base || -+ if (priv->bank[i].end > priv->bank[j].base && - priv->bank[i].base < priv->bank[j].end) { - dev_err(priv->dev, - "region overlap between bank%d and bank%d\n", -diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c -index 45cc39aabeee..252142524ff2 100644 ---- a/drivers/char/tpm/tpm-chip.c -+++ b/drivers/char/tpm/tpm-chip.c -@@ -136,11 +136,13 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev, - chip->cdev.owner = chip->pdev->driver->owner; - chip->cdev.kobj.parent = &chip->dev.kobj; - -+ devm_add_action(dev, (void (*)(void *)) put_device, &chip->dev); ++ /* check whether provided bits are allowed to be passed */ ++ if (cm->mask & ~(priv->ctrlmode_supported | ctrlstatic)) ++ return -EOPNOTSUPP; + - return chip; - } - EXPORT_SYMBOL_GPL(tpmm_chip_alloc); ++ /* do not check for static fd-non-iso if 'fd' is disabled */ ++ if (!(maskedflags & CAN_CTRLMODE_FD)) ++ ctrlstatic &= ~CAN_CTRLMODE_FD_NON_ISO; --static int tpm_dev_add_device(struct tpm_chip *chip) -+static int tpm_add_char_device(struct tpm_chip *chip) - { - int rc; - -@@ -151,7 +153,6 @@ static int tpm_dev_add_device(struct tpm_chip *chip) - chip->devname, MAJOR(chip->dev.devt), - MINOR(chip->dev.devt), rc); - -- device_unregister(&chip->dev); - return rc; - } - -@@ -162,16 +163,17 @@ static int tpm_dev_add_device(struct tpm_chip *chip) - chip->devname, MAJOR(chip->dev.devt), - MINOR(chip->dev.devt), rc); - -+ cdev_del(&chip->cdev); - return rc; - } - - return rc; - } - --static void tpm_dev_del_device(struct tpm_chip *chip) -+static void tpm_del_char_device(struct tpm_chip *chip) - { - cdev_del(&chip->cdev); -- device_unregister(&chip->dev); -+ device_del(&chip->dev); - } - - static int tpm1_chip_register(struct tpm_chip *chip) -@@ -222,7 +224,7 @@ int tpm_chip_register(struct tpm_chip *chip) - - tpm_add_ppi(chip); - -- rc = tpm_dev_add_device(chip); -+ rc = tpm_add_char_device(chip); - if (rc) - goto out_err; - -@@ -274,6 +276,6 @@ void tpm_chip_unregister(struct tpm_chip *chip) - sysfs_remove_link(&chip->pdev->kobj, "ppi"); - - tpm1_chip_unregister(chip); -- tpm_dev_del_device(chip); -+ tpm_del_char_device(chip); - } - EXPORT_SYMBOL_GPL(tpm_chip_unregister); -diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c -index 45a634016f95..b28e4da3d2cf 100644 ---- a/drivers/char/tpm/tpm2-cmd.c -+++ b/drivers/char/tpm/tpm2-cmd.c -@@ -20,7 +20,11 @@ - #include - - enum tpm2_object_attributes { -- TPM2_ATTR_USER_WITH_AUTH = BIT(6), -+ TPM2_OA_USER_WITH_AUTH = BIT(6), -+}; -+ -+enum tpm2_session_attributes { -+ TPM2_SA_CONTINUE_SESSION = BIT(0), - }; - - struct tpm2_startup_in { -@@ -478,22 +482,18 @@ int tpm2_seal_trusted(struct tpm_chip *chip, - tpm_buf_append_u8(&buf, payload->migratable); - - /* public */ -- if (options->policydigest) -- tpm_buf_append_u16(&buf, 14 + options->digest_len); -- else -- tpm_buf_append_u16(&buf, 14); -- -+ tpm_buf_append_u16(&buf, 14 + options->policydigest_len); - tpm_buf_append_u16(&buf, TPM2_ALG_KEYEDHASH); - tpm_buf_append_u16(&buf, hash); - - /* policy */ -- if (options->policydigest) { -+ if (options->policydigest_len) { - tpm_buf_append_u32(&buf, 0); -- tpm_buf_append_u16(&buf, options->digest_len); -+ tpm_buf_append_u16(&buf, options->policydigest_len); - tpm_buf_append(&buf, options->policydigest, -- options->digest_len); -+ options->policydigest_len); - } else { -- tpm_buf_append_u32(&buf, TPM2_ATTR_USER_WITH_AUTH); -+ tpm_buf_append_u32(&buf, TPM2_OA_USER_WITH_AUTH); - tpm_buf_append_u16(&buf, 0); - } - -@@ -631,7 +631,7 @@ static int tpm2_unseal(struct tpm_chip *chip, - options->policyhandle ? - options->policyhandle : TPM2_RS_PW, - NULL /* nonce */, 0, -- 0 /* session_attributes */, -+ TPM2_SA_CONTINUE_SESSION, - options->blobauth /* hmac */, - TPM_DIGEST_SIZE); - -diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c -index 8342cf51ffdc..26bab5a2959f 100644 ---- a/drivers/char/tpm/tpm_crb.c -+++ b/drivers/char/tpm/tpm_crb.c -@@ -302,11 +302,11 @@ static int crb_acpi_remove(struct acpi_device *device) - struct device *dev = &device->dev; - struct tpm_chip *chip = dev_get_drvdata(dev); - -- tpm_chip_unregister(chip); -- - if (chip->flags & TPM_CHIP_FLAG_TPM2) - tpm2_shutdown(chip, TPM2_SU_CLEAR); - -+ tpm_chip_unregister(chip); -+ - return 0; - } - -diff --git a/drivers/char/tpm/tpm_eventlog.c b/drivers/char/tpm/tpm_eventlog.c -index bd72fb04225e..4e6940acf639 100644 ---- a/drivers/char/tpm/tpm_eventlog.c -+++ b/drivers/char/tpm/tpm_eventlog.c -@@ -232,7 +232,7 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v) - { - struct tcpa_event *event = v; - struct tcpa_event temp_event; -- char *tempPtr; -+ char *temp_ptr; - int i; - - memcpy(&temp_event, event, sizeof(struct tcpa_event)); -@@ -242,10 +242,16 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v) - temp_event.event_type = do_endian_conversion(event->event_type); - temp_event.event_size = do_endian_conversion(event->event_size); - -- tempPtr = (char *)&temp_event; -+ temp_ptr = (char *) &temp_event; - -- for (i = 0; i < sizeof(struct tcpa_event) + temp_event.event_size; i++) -- seq_putc(m, tempPtr[i]); -+ for (i = 0; i < (sizeof(struct tcpa_event) - 1) ; i++) -+ seq_putc(m, temp_ptr[i]); -+ -+ temp_ptr = (char *) v; -+ -+ for (i = (sizeof(struct tcpa_event) - 1); -+ i < (sizeof(struct tcpa_event) + temp_event.event_size); i++) -+ seq_putc(m, temp_ptr[i]); - - return 0; - -diff --git a/drivers/clk/bcm/clk-bcm2835-aux.c b/drivers/clk/bcm/clk-bcm2835-aux.c -index e4f89e28b5ec..3a177ade6e6c 100644 ---- a/drivers/clk/bcm/clk-bcm2835-aux.c -+++ b/drivers/clk/bcm/clk-bcm2835-aux.c -@@ -38,8 +38,8 @@ static int bcm2835_aux_clk_probe(struct platform_device *pdev) - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - reg = devm_ioremap_resource(dev, res); -- if (!reg) -- return -ENODEV; -+ if (IS_ERR(reg)) -+ return PTR_ERR(reg); - - onecell = devm_kmalloc(dev, sizeof(*onecell), GFP_KERNEL); - if (!onecell) -diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c -index 015e687ffabe..dd2856b5633c 100644 ---- a/drivers/clk/bcm/clk-bcm2835.c -+++ b/drivers/clk/bcm/clk-bcm2835.c -@@ -1078,10 +1078,12 @@ static void bcm2835_pll_divider_off(struct clk_hw *hw) - struct bcm2835_cprman *cprman = divider->cprman; - const struct bcm2835_pll_divider_data *data = divider->data; - -+ spin_lock(&cprman->regs_lock); - cprman_write(cprman, data->cm_reg, - (cprman_read(cprman, data->cm_reg) & - ~data->load_mask) | data->hold_mask); - cprman_write(cprman, data->a2w_reg, A2W_PLL_CHANNEL_DISABLE); -+ spin_unlock(&cprman->regs_lock); - } - - static int bcm2835_pll_divider_on(struct clk_hw *hw) -@@ -1090,12 +1092,14 @@ static int bcm2835_pll_divider_on(struct clk_hw *hw) - struct bcm2835_cprman *cprman = divider->cprman; - const struct bcm2835_pll_divider_data *data = divider->data; - -+ spin_lock(&cprman->regs_lock); - cprman_write(cprman, data->a2w_reg, - cprman_read(cprman, data->a2w_reg) & - ~A2W_PLL_CHANNEL_DISABLE); - - cprman_write(cprman, data->cm_reg, - cprman_read(cprman, data->cm_reg) & ~data->hold_mask); -+ spin_unlock(&cprman->regs_lock); - - return 0; - } -@@ -1107,13 +1111,15 @@ static int bcm2835_pll_divider_set_rate(struct clk_hw *hw, - struct bcm2835_pll_divider *divider = bcm2835_pll_divider_from_hw(hw); - struct bcm2835_cprman *cprman = divider->cprman; - const struct bcm2835_pll_divider_data *data = divider->data; -- u32 cm; -- int ret; -+ u32 cm, div, max_div = 1 << A2W_PLL_DIV_BITS; - -- ret = clk_divider_ops.set_rate(hw, rate, parent_rate); -- if (ret) -- return ret; -+ div = DIV_ROUND_UP_ULL(parent_rate, rate); -+ -+ div = min(div, max_div); -+ if (div == max_div) -+ div = 0; - -+ cprman_write(cprman, data->a2w_reg, div); - cm = cprman_read(cprman, data->cm_reg); - cprman_write(cprman, data->cm_reg, cm | data->load_mask); - cprman_write(cprman, data->cm_reg, cm & ~data->load_mask); -diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c -index ded3ff4b91b9..aa1dacdaa39d 100644 ---- a/drivers/clk/clk-divider.c -+++ b/drivers/clk/clk-divider.c -@@ -423,6 +423,12 @@ const struct clk_ops clk_divider_ops = { - }; - EXPORT_SYMBOL_GPL(clk_divider_ops); - -+const struct clk_ops clk_divider_ro_ops = { -+ .recalc_rate = clk_divider_recalc_rate, -+ .round_rate = clk_divider_round_rate, -+}; -+EXPORT_SYMBOL_GPL(clk_divider_ro_ops); -+ - static struct clk *_register_divider(struct device *dev, const char *name, - const char *parent_name, unsigned long flags, - void __iomem *reg, u8 shift, u8 width, -@@ -446,7 +452,10 @@ static struct clk *_register_divider(struct device *dev, const char *name, - return ERR_PTR(-ENOMEM); - - init.name = name; -- init.ops = &clk_divider_ops; -+ if (clk_divider_flags & CLK_DIVIDER_READ_ONLY) -+ init.ops = &clk_divider_ro_ops; -+ else -+ init.ops = &clk_divider_ops; - init.flags = flags | CLK_IS_BASIC; - init.parent_names = (parent_name ? &parent_name: NULL); - init.num_parents = (parent_name ? 1 : 0); -diff --git a/drivers/clk/clk-xgene.c b/drivers/clk/clk-xgene.c -index 10224b01b97c..b134a8b15e2c 100644 ---- a/drivers/clk/clk-xgene.c -+++ b/drivers/clk/clk-xgene.c -@@ -351,8 +351,8 @@ static int xgene_clk_set_rate(struct clk_hw *hw, unsigned long rate, - /* Set new divider */ - data = xgene_clk_read(pclk->param.divider_reg + - pclk->param.reg_divider_offset); -- data &= ~((1 << pclk->param.reg_divider_width) - 1) -- << pclk->param.reg_divider_shift; -+ data &= ~(((1 << pclk->param.reg_divider_width) - 1) -+ << pclk->param.reg_divider_shift); - data |= divider; - xgene_clk_write(data, pclk->param.divider_reg + - pclk->param.reg_divider_offset); -diff --git a/drivers/clk/meson/clkc.c b/drivers/clk/meson/clkc.c -index c83ae1367abc..d920d410b51d 100644 ---- a/drivers/clk/meson/clkc.c -+++ b/drivers/clk/meson/clkc.c -@@ -198,7 +198,7 @@ meson_clk_register_fixed_rate(const struct clk_conf *clk_conf, - } - - void __init meson_clk_register_clks(const struct clk_conf *clk_confs, -- size_t nr_confs, -+ unsigned int nr_confs, - void __iomem *clk_base) - { - unsigned int i; -diff --git a/drivers/clk/nxp/clk-lpc18xx-ccu.c b/drivers/clk/nxp/clk-lpc18xx-ccu.c -index 13aabbb3acbe..558da89555af 100644 ---- a/drivers/clk/nxp/clk-lpc18xx-ccu.c -+++ b/drivers/clk/nxp/clk-lpc18xx-ccu.c -@@ -222,7 +222,7 @@ static void lpc18xx_ccu_register_branch_gate_div(struct lpc18xx_clk_branch *bran - div->width = 1; - - div_hw = &div->hw; -- div_ops = &clk_divider_ops; -+ div_ops = &clk_divider_ro_ops; - } - - branch->gate.reg = branch->offset + reg_base; -diff --git a/drivers/clk/qcom/gcc-msm8916.c b/drivers/clk/qcom/gcc-msm8916.c -index 8cc9b2868b41..5f56d6aae31d 100644 ---- a/drivers/clk/qcom/gcc-msm8916.c -+++ b/drivers/clk/qcom/gcc-msm8916.c -@@ -2346,6 +2346,7 @@ static struct clk_branch gcc_crypto_ahb_clk = { - "pcnoc_bfdcd_clk_src", - }, - .num_parents = 1, -+ .flags = CLK_SET_RATE_PARENT, - .ops = &clk_branch2_ops, - }, - }, -@@ -2381,6 +2382,7 @@ static struct clk_branch gcc_crypto_clk = { - "crypto_clk_src", - }, - .num_parents = 1, -+ .flags = CLK_SET_RATE_PARENT, - .ops = &clk_branch2_ops, - }, - }, -diff --git a/drivers/clk/qcom/gcc-msm8960.c b/drivers/clk/qcom/gcc-msm8960.c -index 983dd7dc89a7..0a0c1f533249 100644 ---- a/drivers/clk/qcom/gcc-msm8960.c -+++ b/drivers/clk/qcom/gcc-msm8960.c -@@ -2753,7 +2753,7 @@ static struct clk_rcg ce3_src = { - }, - .freq_tbl = clk_tbl_ce3, - .clkr = { -- .enable_reg = 0x2c08, -+ .enable_reg = 0x36c0, - .enable_mask = BIT(7), - .hw.init = &(struct clk_init_data){ - .name = "ce3_src", -@@ -2769,7 +2769,7 @@ static struct clk_branch ce3_core_clk = { - .halt_reg = 0x2fdc, - .halt_bit = 5, - .clkr = { -- .enable_reg = 0x36c4, -+ .enable_reg = 0x36cc, - .enable_mask = BIT(4), - .hw.init = &(struct clk_init_data){ - .name = "ce3_core_clk", -diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c -index 7f7444cbf6fc..05263571c223 100644 ---- a/drivers/clk/rockchip/clk-rk3188.c -+++ b/drivers/clk/rockchip/clk-rk3188.c -@@ -748,6 +748,7 @@ static const char *const rk3188_critical_clocks[] __initconst = { - "hclk_peri", - "pclk_cpu", - "pclk_peri", -+ "hclk_cpubus" - }; - - static void __init rk3188_common_clk_init(struct device_node *np) -diff --git a/drivers/clk/rockchip/clk-rk3228.c b/drivers/clk/rockchip/clk-rk3228.c -index 981a50205339..97f49aab8d42 100644 ---- a/drivers/clk/rockchip/clk-rk3228.c -+++ b/drivers/clk/rockchip/clk-rk3228.c -@@ -605,13 +605,13 @@ static struct rockchip_clk_branch rk3228_clk_branches[] __initdata = { - - /* PD_MMC */ - MMC(SCLK_SDMMC_DRV, "sdmmc_drv", "sclk_sdmmc", RK3228_SDMMC_CON0, 1), -- MMC(SCLK_SDMMC_SAMPLE, "sdmmc_sample", "sclk_sdmmc", RK3228_SDMMC_CON1, 1), -+ MMC(SCLK_SDMMC_SAMPLE, "sdmmc_sample", "sclk_sdmmc", RK3228_SDMMC_CON1, 0), - - MMC(SCLK_SDIO_DRV, "sdio_drv", "sclk_sdio", RK3228_SDIO_CON0, 1), -- MMC(SCLK_SDIO_SAMPLE, "sdio_sample", "sclk_sdio", RK3228_SDIO_CON1, 1), -+ MMC(SCLK_SDIO_SAMPLE, "sdio_sample", "sclk_sdio", RK3228_SDIO_CON1, 0), - - MMC(SCLK_EMMC_DRV, "emmc_drv", "sclk_emmc", RK3228_EMMC_CON0, 1), -- MMC(SCLK_EMMC_SAMPLE, "emmc_sample", "sclk_emmc", RK3228_EMMC_CON1, 1), -+ MMC(SCLK_EMMC_SAMPLE, "emmc_sample", "sclk_emmc", RK3228_EMMC_CON1, 0), - }; - - static const char *const rk3228_critical_clocks[] __initconst = { -diff --git a/drivers/clk/rockchip/clk-rk3368.c b/drivers/clk/rockchip/clk-rk3368.c -index 21f3ea909fab..57acb625c8ff 100644 ---- a/drivers/clk/rockchip/clk-rk3368.c -+++ b/drivers/clk/rockchip/clk-rk3368.c -@@ -165,7 +165,7 @@ static const struct rockchip_cpuclk_reg_data rk3368_cpuclkb_data = { - .core_reg = RK3368_CLKSEL_CON(0), - .div_core_shift = 0, - .div_core_mask = 0x1f, -- .mux_core_shift = 15, -+ .mux_core_shift = 7, - }; +- /* check whether changed bits are allowed to be modified */ +- if (cm->mask & ~priv->ctrlmode_supported) ++ /* make sure static options are provided by configuration */ ++ if ((maskedflags & ctrlstatic) != ctrlstatic) + return -EOPNOTSUPP; - static const struct rockchip_cpuclk_reg_data rk3368_cpuclkl_data = { -@@ -218,29 +218,29 @@ static const struct rockchip_cpuclk_reg_data rk3368_cpuclkl_data = { - } + /* clear bits to be modified and copy the flag values */ + priv->ctrlmode &= ~cm->mask; +- priv->ctrlmode |= (cm->flags & cm->mask); ++ priv->ctrlmode |= maskedflags; - static struct rockchip_cpuclk_rate_table rk3368_cpuclkb_rates[] __initdata = { -- RK3368_CPUCLKB_RATE(1512000000, 2, 6, 6), -- RK3368_CPUCLKB_RATE(1488000000, 2, 5, 5), -- RK3368_CPUCLKB_RATE(1416000000, 2, 5, 5), -- RK3368_CPUCLKB_RATE(1200000000, 2, 4, 4), -- RK3368_CPUCLKB_RATE(1008000000, 2, 4, 4), -- RK3368_CPUCLKB_RATE( 816000000, 2, 3, 3), -- RK3368_CPUCLKB_RATE( 696000000, 2, 3, 3), -- RK3368_CPUCLKB_RATE( 600000000, 2, 2, 2), -- RK3368_CPUCLKB_RATE( 408000000, 2, 2, 2), -- RK3368_CPUCLKB_RATE( 312000000, 2, 2, 2), -+ RK3368_CPUCLKB_RATE(1512000000, 1, 5, 5), -+ RK3368_CPUCLKB_RATE(1488000000, 1, 4, 4), -+ RK3368_CPUCLKB_RATE(1416000000, 1, 4, 4), -+ RK3368_CPUCLKB_RATE(1200000000, 1, 3, 3), -+ RK3368_CPUCLKB_RATE(1008000000, 1, 3, 3), -+ RK3368_CPUCLKB_RATE( 816000000, 1, 2, 2), -+ RK3368_CPUCLKB_RATE( 696000000, 1, 2, 2), -+ RK3368_CPUCLKB_RATE( 600000000, 1, 1, 1), -+ RK3368_CPUCLKB_RATE( 408000000, 1, 1, 1), -+ RK3368_CPUCLKB_RATE( 312000000, 1, 1, 1), - }; + /* CAN_CTRLMODE_FD can only be set when driver supports FD */ + if (priv->ctrlmode & CAN_CTRLMODE_FD) +@@ -966,6 +1013,7 @@ static struct rtnl_link_ops can_link_ops __read_mostly = { + .maxtype = IFLA_CAN_MAX, + .policy = can_policy, + .setup = can_setup, ++ .validate = can_validate, + .newlink = can_newlink, + .changelink = can_changelink, + .get_size = can_get_size, +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 39cf911f7a1e..195f15edb32e 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -955,7 +955,7 @@ static struct net_device *alloc_m_can_dev(void) + priv->can.do_get_berr_counter = m_can_get_berr_counter; - static struct rockchip_cpuclk_rate_table rk3368_cpuclkl_rates[] __initdata = { -- RK3368_CPUCLKL_RATE(1512000000, 2, 7, 7), -- RK3368_CPUCLKL_RATE(1488000000, 2, 6, 6), -- RK3368_CPUCLKL_RATE(1416000000, 2, 6, 6), -- RK3368_CPUCLKL_RATE(1200000000, 2, 5, 5), -- RK3368_CPUCLKL_RATE(1008000000, 2, 5, 5), -- RK3368_CPUCLKL_RATE( 816000000, 2, 4, 4), -- RK3368_CPUCLKL_RATE( 696000000, 2, 3, 3), -- RK3368_CPUCLKL_RATE( 600000000, 2, 3, 3), -- RK3368_CPUCLKL_RATE( 408000000, 2, 2, 2), -- RK3368_CPUCLKL_RATE( 312000000, 2, 2, 2), -+ RK3368_CPUCLKL_RATE(1512000000, 1, 6, 6), -+ RK3368_CPUCLKL_RATE(1488000000, 1, 5, 5), -+ RK3368_CPUCLKL_RATE(1416000000, 1, 5, 5), -+ RK3368_CPUCLKL_RATE(1200000000, 1, 4, 4), -+ RK3368_CPUCLKL_RATE(1008000000, 1, 4, 4), -+ RK3368_CPUCLKL_RATE( 816000000, 1, 3, 3), -+ RK3368_CPUCLKL_RATE( 696000000, 1, 2, 2), -+ RK3368_CPUCLKL_RATE( 600000000, 1, 2, 2), -+ RK3368_CPUCLKL_RATE( 408000000, 1, 1, 1), -+ RK3368_CPUCLKL_RATE( 312000000, 1, 1, 1), - }; + /* CAN_CTRLMODE_FD_NON_ISO is fixed with M_CAN IP v3.0.1 */ +- priv->can.ctrlmode = CAN_CTRLMODE_FD_NON_ISO; ++ can_set_static_ctrlmode(dev, CAN_CTRLMODE_FD_NON_ISO); - static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = { -@@ -384,10 +384,10 @@ static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = { - * Clock-Architecture Diagram 3 + /* CAN_CTRLMODE_FD_NON_ISO can not be changed with M_CAN IP v3.0.1 */ + priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK | +diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c +index 0c5c22b84da8..7de5ab589e4e 100644 +--- a/drivers/net/usb/asix_common.c ++++ b/drivers/net/usb/asix_common.c +@@ -66,7 +66,7 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb, + * buffer. */ + if (rx->remaining && (rx->remaining + sizeof(u32) <= skb->len)) { +- offset = ((rx->remaining + 1) & 0xfffe) + sizeof(u32); ++ offset = ((rx->remaining + 1) & 0xfffe); + rx->header = get_unaligned_le32(skb->data + offset); + offset = 0; -- COMPOSITE(0, "aclk_vepu", mux_pll_src_cpll_gpll_usb_p, 0, -+ COMPOSITE(0, "aclk_vepu", mux_pll_src_cpll_gpll_npll_usb_p, 0, - RK3368_CLKSEL_CON(15), 6, 2, MFLAGS, 0, 5, DFLAGS, - RK3368_CLKGATE_CON(4), 6, GFLAGS), -- COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_usb_p, 0, -+ COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_npll_usb_p, 0, - RK3368_CLKSEL_CON(15), 14, 2, MFLAGS, 8, 5, DFLAGS, - RK3368_CLKGATE_CON(4), 7, GFLAGS), - -@@ -442,7 +442,7 @@ static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = { - GATE(SCLK_HDMI_HDCP, "sclk_hdmi_hdcp", "xin24m", 0, - RK3368_CLKGATE_CON(4), 13, GFLAGS), - GATE(SCLK_HDMI_CEC, "sclk_hdmi_cec", "xin32k", 0, -- RK3368_CLKGATE_CON(5), 12, GFLAGS), -+ RK3368_CLKGATE_CON(4), 12, GFLAGS), - - COMPOSITE_NODIV(0, "vip_src", mux_pll_src_cpll_gpll_p, 0, - RK3368_CLKSEL_CON(21), 15, 1, MFLAGS, -diff --git a/drivers/clk/rockchip/clk.c b/drivers/clk/rockchip/clk.c -index d9a0b5d4d47f..226af5720c9e 100644 ---- a/drivers/clk/rockchip/clk.c -+++ b/drivers/clk/rockchip/clk.c -@@ -70,7 +70,7 @@ static struct clk *rockchip_clk_register_branch(const char *name, - if (gate_offset >= 0) { - gate = kzalloc(sizeof(*gate), GFP_KERNEL); - if (!gate) -- return ERR_PTR(-ENOMEM); -+ goto err_gate; - - gate->flags = gate_flags; - gate->reg = base + gate_offset; -@@ -82,7 +82,7 @@ static struct clk *rockchip_clk_register_branch(const char *name, - if (div_width > 0) { - div = kzalloc(sizeof(*div), GFP_KERNEL); - if (!div) -- return ERR_PTR(-ENOMEM); -+ goto err_div; - - div->flags = div_flags; - div->reg = base + muxdiv_offset; -@@ -90,7 +90,9 @@ static struct clk *rockchip_clk_register_branch(const char *name, - div->width = div_width; - div->lock = lock; - div->table = div_table; -- div_ops = &clk_divider_ops; -+ div_ops = (div_flags & CLK_DIVIDER_READ_ONLY) -+ ? &clk_divider_ro_ops -+ : &clk_divider_ops; - } - - clk = clk_register_composite(NULL, name, parent_names, num_parents, -@@ -100,6 +102,11 @@ static struct clk *rockchip_clk_register_branch(const char *name, - flags); - - return clk; -+err_div: -+ kfree(gate); -+err_gate: -+ kfree(mux); -+ return ERR_PTR(-ENOMEM); - } - - struct rockchip_clk_frac { -diff --git a/drivers/clk/sunxi/clk-sun8i-apb0.c b/drivers/clk/sunxi/clk-sun8i-apb0.c -index 7ba61103a6f5..2ea61debffc1 100644 ---- a/drivers/clk/sunxi/clk-sun8i-apb0.c -+++ b/drivers/clk/sunxi/clk-sun8i-apb0.c -@@ -36,7 +36,7 @@ static struct clk *sun8i_a23_apb0_register(struct device_node *node, - - /* The A23 APB0 clock is a standard 2 bit wide divider clock */ - clk = clk_register_divider(NULL, clk_name, clk_parent, 0, reg, -- 0, 2, CLK_DIVIDER_POWER_OF_TWO, NULL); -+ 0, 2, 0, NULL); - if (IS_ERR(clk)) - return clk; - -diff --git a/drivers/clk/versatile/clk-sp810.c b/drivers/clk/versatile/clk-sp810.c -index e78755e0ef78..1fe1e8d970cf 100644 ---- a/drivers/clk/versatile/clk-sp810.c -+++ b/drivers/clk/versatile/clk-sp810.c -@@ -92,6 +92,7 @@ static void __init clk_sp810_of_setup(struct device_node *node) - int num = ARRAY_SIZE(parent_names); - char name[12]; - struct clk_init_data init; -+ static int instance; - int i; - bool deprecated; - -@@ -117,7 +118,7 @@ static void __init clk_sp810_of_setup(struct device_node *node) - deprecated = !of_find_property(node, "assigned-clock-parents", NULL); - - for (i = 0; i < ARRAY_SIZE(sp810->timerclken); i++) { -- snprintf(name, ARRAY_SIZE(name), "timerclken%d", i); -+ snprintf(name, sizeof(name), "sp810_%d_%d", instance, i); - - sp810->timerclken[i].sp810 = sp810; - sp810->timerclken[i].channel = i; -@@ -138,5 +139,6 @@ static void __init clk_sp810_of_setup(struct device_node *node) - } - - of_clk_add_provider(node, clk_sp810_timerclken_of_get, sp810); -+ instance++; - } - CLK_OF_DECLARE(sp810, "arm,sp810", clk_sp810_of_setup); -diff --git a/drivers/clocksource/tango_xtal.c b/drivers/clocksource/tango_xtal.c -index 2bcecafdeaea..c407c47a3232 100644 ---- a/drivers/clocksource/tango_xtal.c -+++ b/drivers/clocksource/tango_xtal.c -@@ -42,7 +42,7 @@ static void __init tango_clocksource_init(struct device_node *np) - - ret = clocksource_mmio_init(xtal_in_cnt, "tango-xtal", xtal_freq, 350, - 32, clocksource_mmio_readl_up); -- if (!ret) { -+ if (ret) { - pr_err("%s: registration failed\n", np->full_name); - return; - } -diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index cd83d477e32d..e89512383c3c 100644 ---- a/drivers/cpufreq/intel_pstate.c -+++ b/drivers/cpufreq/intel_pstate.c -@@ -673,6 +673,11 @@ static int core_get_max_pstate(void) - if (err) - goto skip_tar; - -+ /* For level 1 and 2, bits[23:16] contain the ratio */ -+ if (tdp_ctrl) -+ tdp_ratio >>= 16; -+ -+ tdp_ratio &= 0xff; /* ratios are only 8 bits long */ - if (tdp_ratio - 1 == tar) { - max_pstate = tar; - pr_debug("max_pstate=TAC %x\n", max_pstate); -diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c -index a9c659f58974..04042038ec4b 100644 ---- a/drivers/cpufreq/sti-cpufreq.c -+++ b/drivers/cpufreq/sti-cpufreq.c -@@ -259,6 +259,10 @@ static int sti_cpufreq_init(void) - { - int ret; - -+ if ((!of_machine_is_compatible("st,stih407")) && -+ (!of_machine_is_compatible("st,stih410"))) +diff --git a/drivers/nfc/st21nfca/i2c.c b/drivers/nfc/st21nfca/i2c.c +index 1f44a151d206..d5a099b022e4 100644 +--- a/drivers/nfc/st21nfca/i2c.c ++++ b/drivers/nfc/st21nfca/i2c.c +@@ -524,8 +524,10 @@ static int st21nfca_hci_i2c_acpi_request_resources(struct i2c_client *client) + /* Get EN GPIO from ACPI */ + gpiod_ena = devm_gpiod_get_index(dev, ST21NFCA_GPIO_NAME_EN, 1, + GPIOD_OUT_LOW); +- if (!IS_ERR(gpiod_ena)) +- phy->gpio_ena = desc_to_gpio(gpiod_ena); ++ if (!IS_ERR(gpiod_ena)) { ++ nfc_err(dev, "Unable to get ENABLE GPIO\n"); + return -ENODEV; -+ - ddata.cpu = get_cpu_device(0); - if (!ddata.cpu) { - dev_err(ddata.cpu, "Failed to get device for CPU0\n"); -diff --git a/drivers/cpuidle/cpuidle-arm.c b/drivers/cpuidle/cpuidle-arm.c -index 545069d5fdfb..e342565e8715 100644 ---- a/drivers/cpuidle/cpuidle-arm.c -+++ b/drivers/cpuidle/cpuidle-arm.c -@@ -50,7 +50,7 @@ static int arm_enter_idle_state(struct cpuidle_device *dev, - * call the CPU ops suspend protocol with idle index as a - * parameter. - */ -- arm_cpuidle_suspend(idx); -+ ret = arm_cpuidle_suspend(idx); - - cpu_pm_exit(); - } -diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c -index 3eb3f1279fb7..7de007abe46e 100644 ---- a/drivers/crypto/atmel-aes.c -+++ b/drivers/crypto/atmel-aes.c -@@ -2085,9 +2085,9 @@ static int atmel_aes_probe(struct platform_device *pdev) - } - - aes_dd->io_base = devm_ioremap_resource(&pdev->dev, aes_res); -- if (!aes_dd->io_base) { -+ if (IS_ERR(aes_dd->io_base)) { - dev_err(dev, "can't ioremap\n"); -- err = -ENOMEM; -+ err = PTR_ERR(aes_dd->io_base); - goto res_err; - } - -diff --git a/drivers/crypto/atmel-sha.c b/drivers/crypto/atmel-sha.c -index 8bf9914d4d15..68d47a2da4a1 100644 ---- a/drivers/crypto/atmel-sha.c -+++ b/drivers/crypto/atmel-sha.c -@@ -1404,9 +1404,9 @@ static int atmel_sha_probe(struct platform_device *pdev) - } - - sha_dd->io_base = devm_ioremap_resource(&pdev->dev, sha_res); -- if (!sha_dd->io_base) { -+ if (IS_ERR(sha_dd->io_base)) { - dev_err(dev, "can't ioremap\n"); -- err = -ENOMEM; -+ err = PTR_ERR(sha_dd->io_base); - goto res_err; - } ++ } -diff --git a/drivers/crypto/atmel-tdes.c b/drivers/crypto/atmel-tdes.c -index 2c7a628d0375..bf467d7be35c 100644 ---- a/drivers/crypto/atmel-tdes.c -+++ b/drivers/crypto/atmel-tdes.c -@@ -1417,9 +1417,9 @@ static int atmel_tdes_probe(struct platform_device *pdev) - } + phy->gpio_ena = desc_to_gpio(gpiod_ena); - tdes_dd->io_base = devm_ioremap_resource(&pdev->dev, tdes_res); -- if (!tdes_dd->io_base) { -+ if (IS_ERR(tdes_dd->io_base)) { - dev_err(dev, "can't ioremap\n"); -- err = -ENOMEM; -+ err = PTR_ERR(tdes_dd->io_base); - goto res_err; - } +diff --git a/drivers/platform/x86/dell-rbtn.c b/drivers/platform/x86/dell-rbtn.c +index cd410e392550..d33e9ad3218f 100644 +--- a/drivers/platform/x86/dell-rbtn.c ++++ b/drivers/platform/x86/dell-rbtn.c +@@ -28,6 +28,7 @@ struct rbtn_data { + enum rbtn_type type; + struct rfkill *rfkill; + struct input_dev *input_dev; ++ bool suspended; + }; -diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c -index f7e0d8d4c3da..8f50a02ff68d 100644 ---- a/drivers/crypto/caam/jr.c -+++ b/drivers/crypto/caam/jr.c -@@ -248,7 +248,7 @@ static void caam_jr_dequeue(unsigned long devarg) - struct device *caam_jr_alloc(void) - { - struct caam_drv_private_jr *jrpriv, *min_jrpriv = NULL; -- struct device *dev = NULL; -+ struct device *dev = ERR_PTR(-ENODEV); - int min_tfm_cnt = INT_MAX; - int tfm_cnt; -diff --git a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c -index d89f20c04266..60fc0fa26fd3 100644 ---- a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c -+++ b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c -@@ -220,6 +220,42 @@ static int ccp_aes_cmac_digest(struct ahash_request *req) - return ccp_aes_cmac_finup(req); - } +@@ -220,9 +221,55 @@ static const struct acpi_device_id rbtn_ids[] = { + { "", 0 }, + }; -+static int ccp_aes_cmac_export(struct ahash_request *req, void *out) ++#ifdef CONFIG_PM_SLEEP ++static void ACPI_SYSTEM_XFACE rbtn_clear_suspended_flag(void *context) +{ -+ struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req); -+ struct ccp_aes_cmac_exp_ctx state; -+ -+ /* Don't let anything leak to 'out' */ -+ memset(&state, 0, sizeof(state)); -+ -+ state.null_msg = rctx->null_msg; -+ memcpy(state.iv, rctx->iv, sizeof(state.iv)); -+ state.buf_count = rctx->buf_count; -+ memcpy(state.buf, rctx->buf, sizeof(state.buf)); -+ -+ /* 'out' may not be aligned so memcpy from local variable */ -+ memcpy(out, &state, sizeof(state)); ++ struct rbtn_data *rbtn_data = context; + -+ return 0; ++ rbtn_data->suspended = false; +} + -+static int ccp_aes_cmac_import(struct ahash_request *req, const void *in) ++static int rbtn_suspend(struct device *dev) +{ -+ struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req); -+ struct ccp_aes_cmac_exp_ctx state; -+ -+ /* 'in' may not be aligned so memcpy to local variable */ -+ memcpy(&state, in, sizeof(state)); ++ struct acpi_device *device = to_acpi_device(dev); ++ struct rbtn_data *rbtn_data = acpi_driver_data(device); + -+ memset(rctx, 0, sizeof(*rctx)); -+ rctx->null_msg = state.null_msg; -+ memcpy(rctx->iv, state.iv, sizeof(rctx->iv)); -+ rctx->buf_count = state.buf_count; -+ memcpy(rctx->buf, state.buf, sizeof(rctx->buf)); ++ rbtn_data->suspended = true; + + return 0; +} + - static int ccp_aes_cmac_setkey(struct crypto_ahash *tfm, const u8 *key, - unsigned int key_len) - { -@@ -352,10 +388,13 @@ int ccp_register_aes_cmac_algs(struct list_head *head) - alg->final = ccp_aes_cmac_final; - alg->finup = ccp_aes_cmac_finup; - alg->digest = ccp_aes_cmac_digest; -+ alg->export = ccp_aes_cmac_export; -+ alg->import = ccp_aes_cmac_import; - alg->setkey = ccp_aes_cmac_setkey; - - halg = &alg->halg; - halg->digestsize = AES_BLOCK_SIZE; -+ halg->statesize = sizeof(struct ccp_aes_cmac_exp_ctx); - - base = &halg->base; - snprintf(base->cra_name, CRYPTO_MAX_ALG_NAME, "cmac(aes)"); -diff --git a/drivers/crypto/ccp/ccp-crypto-sha.c b/drivers/crypto/ccp/ccp-crypto-sha.c -index d14b3f28e010..ab9945f2cb7a 100644 ---- a/drivers/crypto/ccp/ccp-crypto-sha.c -+++ b/drivers/crypto/ccp/ccp-crypto-sha.c -@@ -207,6 +207,46 @@ static int ccp_sha_digest(struct ahash_request *req) - return ccp_sha_finup(req); - } - -+static int ccp_sha_export(struct ahash_request *req, void *out) ++static int rbtn_resume(struct device *dev) +{ -+ struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req); -+ struct ccp_sha_exp_ctx state; -+ -+ /* Don't let anything leak to 'out' */ -+ memset(&state, 0, sizeof(state)); -+ -+ state.type = rctx->type; -+ state.msg_bits = rctx->msg_bits; -+ state.first = rctx->first; -+ memcpy(state.ctx, rctx->ctx, sizeof(state.ctx)); -+ state.buf_count = rctx->buf_count; -+ memcpy(state.buf, rctx->buf, sizeof(state.buf)); -+ -+ /* 'out' may not be aligned so memcpy from local variable */ -+ memcpy(out, &state, sizeof(state)); ++ struct acpi_device *device = to_acpi_device(dev); ++ struct rbtn_data *rbtn_data = acpi_driver_data(device); ++ acpi_status status; + -+ return 0; -+} -+ -+static int ccp_sha_import(struct ahash_request *req, const void *in) -+{ -+ struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req); -+ struct ccp_sha_exp_ctx state; -+ -+ /* 'in' may not be aligned so memcpy to local variable */ -+ memcpy(&state, in, sizeof(state)); -+ -+ memset(rctx, 0, sizeof(*rctx)); -+ rctx->type = state.type; -+ rctx->msg_bits = state.msg_bits; -+ rctx->first = state.first; -+ memcpy(rctx->ctx, state.ctx, sizeof(rctx->ctx)); -+ rctx->buf_count = state.buf_count; -+ memcpy(rctx->buf, state.buf, sizeof(rctx->buf)); ++ /* ++ * Upon resume, some BIOSes send an ACPI notification thet triggers ++ * an unwanted input event. In order to ignore it, we use a flag ++ * that we set at suspend and clear once we have received the extra ++ * ACPI notification. Since ACPI notifications are delivered ++ * asynchronously to drivers, we clear the flag from the workqueue ++ * used to deliver the notifications. This should be enough ++ * to have the flag cleared only after we received the extra ++ * notification, if any. ++ */ ++ status = acpi_os_execute(OSL_NOTIFY_HANDLER, ++ rbtn_clear_suspended_flag, rbtn_data); ++ if (ACPI_FAILURE(status)) ++ rbtn_clear_suspended_flag(rbtn_data); + + return 0; +} ++#endif + - static int ccp_sha_setkey(struct crypto_ahash *tfm, const u8 *key, - unsigned int key_len) - { -@@ -403,9 +443,12 @@ static int ccp_register_sha_alg(struct list_head *head, - alg->final = ccp_sha_final; - alg->finup = ccp_sha_finup; - alg->digest = ccp_sha_digest; -+ alg->export = ccp_sha_export; -+ alg->import = ccp_sha_import; - - halg = &alg->halg; - halg->digestsize = def->digest_size; -+ halg->statesize = sizeof(struct ccp_sha_exp_ctx); - - base = &halg->base; - snprintf(base->cra_name, CRYPTO_MAX_ALG_NAME, "%s", def->name); -diff --git a/drivers/crypto/ccp/ccp-crypto.h b/drivers/crypto/ccp/ccp-crypto.h -index 76a96f0f44c6..a326ec20bfa8 100644 ---- a/drivers/crypto/ccp/ccp-crypto.h -+++ b/drivers/crypto/ccp/ccp-crypto.h -@@ -129,6 +129,15 @@ struct ccp_aes_cmac_req_ctx { - struct ccp_cmd cmd; - }; - -+struct ccp_aes_cmac_exp_ctx { -+ unsigned int null_msg; -+ -+ u8 iv[AES_BLOCK_SIZE]; -+ -+ unsigned int buf_count; -+ u8 buf[AES_BLOCK_SIZE]; -+}; ++static SIMPLE_DEV_PM_OPS(rbtn_pm_ops, rbtn_suspend, rbtn_resume); + - /***** SHA related defines *****/ - #define MAX_SHA_CONTEXT_SIZE SHA256_DIGEST_SIZE - #define MAX_SHA_BLOCK_SIZE SHA256_BLOCK_SIZE -@@ -171,6 +180,19 @@ struct ccp_sha_req_ctx { - struct ccp_cmd cmd; - }; + static struct acpi_driver rbtn_driver = { + .name = "dell-rbtn", + .ids = rbtn_ids, ++ .drv.pm = &rbtn_pm_ops, + .ops = { + .add = rbtn_add, + .remove = rbtn_remove, +@@ -384,6 +431,15 @@ static void rbtn_notify(struct acpi_device *device, u32 event) + { + struct rbtn_data *rbtn_data = device->driver_data; -+struct ccp_sha_exp_ctx { -+ enum ccp_sha_type type; -+ -+ u64 msg_bits; -+ -+ unsigned int first; -+ -+ u8 ctx[MAX_SHA_CONTEXT_SIZE]; -+ -+ unsigned int buf_count; -+ u8 buf[MAX_SHA_BLOCK_SIZE]; -+}; ++ /* ++ * Some BIOSes send a notification at resume. ++ * Ignore it to prevent unwanted input events. ++ */ ++ if (rbtn_data->suspended) { ++ dev_dbg(&device->dev, "ACPI notification ignored\n"); ++ return; ++ } + - /***** Common Context Structure *****/ - struct ccp_ctx { - int (*complete)(struct crypto_async_request *req, int ret); -diff --git a/drivers/crypto/marvell/cesa.c b/drivers/crypto/marvell/cesa.c -index c0656e7f37b5..80239ae69527 100644 ---- a/drivers/crypto/marvell/cesa.c -+++ b/drivers/crypto/marvell/cesa.c -@@ -420,7 +420,7 @@ static int mv_cesa_probe(struct platform_device *pdev) - res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "regs"); - cesa->regs = devm_ioremap_resource(dev, res); - if (IS_ERR(cesa->regs)) -- return -ENOMEM; -+ return PTR_ERR(cesa->regs); + if (event != 0x80) { + dev_info(&device->dev, "Received unknown event (0x%x)\n", + event); +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 6a820668d442..b7cc6027cb7b 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -315,6 +315,7 @@ static void scsi_target_destroy(struct scsi_target *starget) + struct Scsi_Host *shost = dev_to_shost(dev->parent); + unsigned long flags; - ret = mv_cesa_dev_dma_init(cesa); - if (ret) -diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h -index 0e82ce3c383e..976b01e58afb 100644 ---- a/drivers/crypto/qat/qat_common/adf_common_drv.h -+++ b/drivers/crypto/qat/qat_common/adf_common_drv.h -@@ -236,6 +236,8 @@ void adf_enable_vf2pf_interrupts(struct adf_accel_dev *accel_dev, - uint32_t vf_mask); - void adf_enable_pf2vf_interrupts(struct adf_accel_dev *accel_dev); - void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev); -+int adf_init_pf_wq(void); -+void adf_exit_pf_wq(void); - #else - static inline int adf_sriov_configure(struct pci_dev *pdev, int numvfs) - { -@@ -253,5 +255,14 @@ static inline void adf_enable_pf2vf_interrupts(struct adf_accel_dev *accel_dev) - static inline void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev) ++ BUG_ON(starget->state == STARGET_DEL); + starget->state = STARGET_DEL; + transport_destroy_device(dev); + spin_lock_irqsave(shost->host_lock, flags); +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 00bc7218a7f8..9e5f893aa3ad 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -1272,18 +1272,18 @@ static void __scsi_remove_target(struct scsi_target *starget) + void scsi_remove_target(struct device *dev) { - } -+ -+static inline int adf_init_pf_wq(void) -+{ -+ return 0; -+} -+ -+static inline void adf_exit_pf_wq(void) -+{ -+} - #endif - #endif -diff --git a/drivers/crypto/qat/qat_common/adf_ctl_drv.c b/drivers/crypto/qat/qat_common/adf_ctl_drv.c -index 5c897e6e7994..3c3f948290ca 100644 ---- a/drivers/crypto/qat/qat_common/adf_ctl_drv.c -+++ b/drivers/crypto/qat/qat_common/adf_ctl_drv.c -@@ -462,12 +462,17 @@ static int __init adf_register_ctl_device_driver(void) - if (adf_init_aer()) - goto err_aer; - -+ if (adf_init_pf_wq()) -+ goto err_pf_wq; -+ - if (qat_crypto_register()) - goto err_crypto_register; - - return 0; + struct Scsi_Host *shost = dev_to_shost(dev->parent); +- struct scsi_target *starget, *last_target = NULL; ++ struct scsi_target *starget; + unsigned long flags; - err_crypto_register: -+ adf_exit_pf_wq(); -+err_pf_wq: - adf_exit_aer(); - err_aer: - adf_chr_drv_destroy(); -@@ -480,6 +485,7 @@ static void __exit adf_unregister_ctl_device_driver(void) - { - adf_chr_drv_destroy(); - adf_exit_aer(); -+ adf_exit_pf_wq(); - qat_crypto_unregister(); - adf_clean_vf_map(false); - mutex_destroy(&adf_ctl_lock); -diff --git a/drivers/crypto/qat/qat_common/adf_sriov.c b/drivers/crypto/qat/qat_common/adf_sriov.c -index 1117a8b58280..38a0415e767d 100644 ---- a/drivers/crypto/qat/qat_common/adf_sriov.c -+++ b/drivers/crypto/qat/qat_common/adf_sriov.c -@@ -119,11 +119,6 @@ static int adf_enable_sriov(struct adf_accel_dev *accel_dev) + restart: + spin_lock_irqsave(shost->host_lock, flags); + list_for_each_entry(starget, &shost->__targets, siblings) { + if (starget->state == STARGET_DEL || +- starget == last_target) ++ starget->state == STARGET_REMOVE) + continue; + if (starget->dev.parent == dev || &starget->dev == dev) { + kref_get(&starget->reap_ref); +- last_target = starget; ++ starget->state = STARGET_REMOVE; + spin_unlock_irqrestore(shost->host_lock, flags); + __scsi_remove_target(starget); + scsi_target_reap(starget); +diff --git a/drivers/staging/comedi/drivers/das1800.c b/drivers/staging/comedi/drivers/das1800.c +index 940781183fac..3be10963f98b 100644 +--- a/drivers/staging/comedi/drivers/das1800.c ++++ b/drivers/staging/comedi/drivers/das1800.c +@@ -567,14 +567,17 @@ static int das1800_cancel(struct comedi_device *dev, struct comedi_subdevice *s) + struct comedi_isadma_desc *desc; int i; - u32 reg; -- /* Workqueue for PF2VF responses */ -- pf2vf_resp_wq = create_workqueue("qat_pf2vf_resp_wq"); -- if (!pf2vf_resp_wq) -- return -ENOMEM; -- - for (i = 0, vf_info = accel_dev->pf.vf_info; i < totalvfs; - i++, vf_info++) { - /* This ptr will be populated when VFs will be created */ -@@ -216,11 +211,6 @@ void adf_disable_sriov(struct adf_accel_dev *accel_dev) - - kfree(accel_dev->pf.vf_info); - accel_dev->pf.vf_info = NULL; +- outb(0x0, dev->iobase + DAS1800_STATUS); /* disable conversions */ +- outb(0x0, dev->iobase + DAS1800_CONTROL_B); /* disable interrupts and dma */ +- outb(0x0, dev->iobase + DAS1800_CONTROL_A); /* disable and clear fifo and stop triggering */ - -- if (pf2vf_resp_wq) { -- destroy_workqueue(pf2vf_resp_wq); -- pf2vf_resp_wq = NULL; -- } - } - EXPORT_SYMBOL_GPL(adf_disable_sriov); - -@@ -304,3 +294,19 @@ int adf_sriov_configure(struct pci_dev *pdev, int numvfs) - return numvfs; - } - EXPORT_SYMBOL_GPL(adf_sriov_configure); -+ -+int __init adf_init_pf_wq(void) -+{ -+ /* Workqueue for PF2VF responses */ -+ pf2vf_resp_wq = create_workqueue("qat_pf2vf_resp_wq"); -+ -+ return !pf2vf_resp_wq ? -ENOMEM : 0; -+} +- for (i = 0; i < 2; i++) { +- desc = &dma->desc[i]; +- if (desc->chan) +- comedi_isadma_disable(desc->chan); ++ /* disable and stop conversions */ ++ outb(0x0, dev->iobase + DAS1800_STATUS); ++ outb(0x0, dev->iobase + DAS1800_CONTROL_B); ++ outb(0x0, dev->iobase + DAS1800_CONTROL_A); + -+void adf_exit_pf_wq(void) -+{ -+ if (pf2vf_resp_wq) { -+ destroy_workqueue(pf2vf_resp_wq); -+ pf2vf_resp_wq = NULL; -+ } -+} -diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c -index a19ee127edca..e72fea737a0d 100644 ---- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c -+++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c -@@ -35,6 +35,7 @@ static int sun4i_ss_opti_poll(struct ablkcipher_request *areq) - unsigned int todo; - struct sg_mapping_iter mi, mo; - unsigned int oi, oo; /* offset for in and out */ -+ unsigned long flags; - - if (areq->nbytes == 0) - return 0; -@@ -49,7 +50,7 @@ static int sun4i_ss_opti_poll(struct ablkcipher_request *areq) - return -EINVAL; ++ if (dma) { ++ for (i = 0; i < 2; i++) { ++ desc = &dma->desc[i]; ++ if (desc->chan) ++ comedi_isadma_disable(desc->chan); ++ } } -- spin_lock_bh(&ss->slock); -+ spin_lock_irqsave(&ss->slock, flags); - - for (i = 0; i < op->keylen; i += 4) - writel(*(op->key + i / 4), ss->base + SS_KEY0 + i); -@@ -117,7 +118,7 @@ release_ss: - sg_miter_stop(&mi); - sg_miter_stop(&mo); - writel(0, ss->base + SS_CTL); -- spin_unlock_bh(&ss->slock); -+ spin_unlock_irqrestore(&ss->slock, flags); - return err; - } - -@@ -149,6 +150,7 @@ static int sun4i_ss_cipher_poll(struct ablkcipher_request *areq) - unsigned int ob = 0; /* offset in buf */ - unsigned int obo = 0; /* offset in bufo*/ - unsigned int obl = 0; /* length of data in bufo */ -+ unsigned long flags; + return 0; +@@ -934,13 +937,14 @@ static void das1800_ai_setup_dma(struct comedi_device *dev, + { + struct das1800_private *devpriv = dev->private; + struct comedi_isadma *dma = devpriv->dma; +- struct comedi_isadma_desc *desc = &dma->desc[0]; ++ struct comedi_isadma_desc *desc; + unsigned int bytes; - if (areq->nbytes == 0) - return 0; -@@ -181,7 +183,7 @@ static int sun4i_ss_cipher_poll(struct ablkcipher_request *areq) - if (no_chunk == 1) - return sun4i_ss_opti_poll(areq); + if ((devpriv->irq_dma_bits & DMA_ENABLED) == 0) + return; -- spin_lock_bh(&ss->slock); -+ spin_lock_irqsave(&ss->slock, flags); + dma->cur_dma = 0; ++ desc = &dma->desc[0]; - for (i = 0; i < op->keylen; i += 4) - writel(*(op->key + i / 4), ss->base + SS_KEY0 + i); -@@ -308,7 +310,7 @@ release_ss: - sg_miter_stop(&mi); - sg_miter_stop(&mo); - writel(0, ss->base + SS_CTL); -- spin_unlock_bh(&ss->slock); -+ spin_unlock_irqrestore(&ss->slock, flags); + /* determine a dma transfer size to fill buffer in 0.3 sec */ + bytes = das1800_ai_transfer_size(dev, s, desc->maxsize, 300000000); +diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c +index 0dde34e3a7c5..545c60c826a1 100644 +--- a/drivers/thunderbolt/eeprom.c ++++ b/drivers/thunderbolt/eeprom.c +@@ -444,6 +444,7 @@ int tb_drom_read(struct tb_switch *sw) + return tb_drom_parse_entries(sw); + err: + kfree(sw->drom); ++ sw->drom = NULL; + return -EIO; - return err; - } -diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c -index a0d4a08313ae..b7ee8d30147d 100644 ---- a/drivers/crypto/talitos.c -+++ b/drivers/crypto/talitos.c -@@ -63,6 +63,14 @@ static void to_talitos_ptr(struct talitos_ptr *ptr, dma_addr_t dma_addr, - ptr->eptr = upper_32_bits(dma_addr); } +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index c3fe026d3168..9aff37186246 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -2045,7 +2045,9 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm) + } + } + spin_unlock(&gsm_mux_lock); +- WARN_ON(i == MAX_MUX); ++ /* open failed before registering => nothing to do */ ++ if (i == MAX_MUX) ++ return; -+static void copy_talitos_ptr(struct talitos_ptr *dst_ptr, -+ struct talitos_ptr *src_ptr, bool is_sec1) -+{ -+ dst_ptr->ptr = src_ptr->ptr; -+ if (!is_sec1) -+ dst_ptr->eptr = src_ptr->eptr; -+} -+ - static void to_talitos_ptr_len(struct talitos_ptr *ptr, unsigned int len, - bool is_sec1) - { -@@ -827,6 +835,16 @@ struct talitos_ahash_req_ctx { - struct scatterlist *psrc; - }; + /* In theory disconnecting DLCI 0 is sufficient but for some + modems this is apparently not the case. */ +diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c +index bbc4ce66c2c1..644ddb841d9f 100644 +--- a/drivers/tty/n_hdlc.c ++++ b/drivers/tty/n_hdlc.c +@@ -600,7 +600,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file, + add_wait_queue(&tty->read_wait, &wait); -+struct talitos_export_state { -+ u32 hw_context[TALITOS_MDEU_MAX_CONTEXT_SIZE / sizeof(u32)]; -+ u8 buf[HASH_MAX_BLOCK_SIZE]; -+ unsigned int swinit; -+ unsigned int first; -+ unsigned int last; -+ unsigned int to_hash_later; -+ unsigned int nbuf; -+}; -+ - static int aead_setkey(struct crypto_aead *authenc, - const u8 *key, unsigned int keylen) - { -@@ -1083,21 +1101,20 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, - sg_count = dma_map_sg(dev, areq->src, edesc->src_nents ?: 1, - (areq->src == areq->dst) ? DMA_BIDIRECTIONAL - : DMA_TO_DEVICE); -- - /* hmac data */ - desc->ptr[1].len = cpu_to_be16(areq->assoclen); - if (sg_count > 1 && - (ret = sg_to_link_tbl_offset(areq->src, sg_count, 0, - areq->assoclen, - &edesc->link_tbl[tbl_off])) > 1) { -- tbl_off += ret; -- - to_talitos_ptr(&desc->ptr[1], edesc->dma_link_tbl + tbl_off * - sizeof(struct talitos_ptr), 0); - desc->ptr[1].j_extent = DESC_PTR_LNKTBL_JUMP; - - dma_sync_single_for_device(dev, edesc->dma_link_tbl, - edesc->dma_len, DMA_BIDIRECTIONAL); -+ -+ tbl_off += ret; - } else { - to_talitos_ptr(&desc->ptr[1], sg_dma_address(areq->src), 0); - desc->ptr[1].j_extent = 0; -@@ -1126,11 +1143,13 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, - if (edesc->desc.hdr & DESC_HDR_MODE1_MDEU_CICV) - sg_link_tbl_len += authsize; - -- if (sg_count > 1 && -- (ret = sg_to_link_tbl_offset(areq->src, sg_count, areq->assoclen, -- sg_link_tbl_len, -- &edesc->link_tbl[tbl_off])) > 1) { -- tbl_off += ret; -+ if (sg_count == 1) { -+ to_talitos_ptr(&desc->ptr[4], sg_dma_address(areq->src) + -+ areq->assoclen, 0); -+ } else if ((ret = sg_to_link_tbl_offset(areq->src, sg_count, -+ areq->assoclen, sg_link_tbl_len, -+ &edesc->link_tbl[tbl_off])) > -+ 1) { - desc->ptr[4].j_extent |= DESC_PTR_LNKTBL_JUMP; - to_talitos_ptr(&desc->ptr[4], edesc->dma_link_tbl + - tbl_off * -@@ -1138,8 +1157,10 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, - dma_sync_single_for_device(dev, edesc->dma_link_tbl, - edesc->dma_len, - DMA_BIDIRECTIONAL); -- } else -- to_talitos_ptr(&desc->ptr[4], sg_dma_address(areq->src), 0); -+ tbl_off += ret; -+ } else { -+ copy_talitos_ptr(&desc->ptr[4], &edesc->link_tbl[tbl_off], 0); -+ } - - /* cipher out */ - desc->ptr[5].len = cpu_to_be16(cryptlen); -@@ -1151,11 +1172,13 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, - - edesc->icv_ool = false; - -- if (sg_count > 1 && -- (sg_count = sg_to_link_tbl_offset(areq->dst, sg_count, -+ if (sg_count == 1) { -+ to_talitos_ptr(&desc->ptr[5], sg_dma_address(areq->dst) + -+ areq->assoclen, 0); -+ } else if ((sg_count = -+ sg_to_link_tbl_offset(areq->dst, sg_count, - areq->assoclen, cryptlen, -- &edesc->link_tbl[tbl_off])) > -- 1) { -+ &edesc->link_tbl[tbl_off])) > 1) { - struct talitos_ptr *tbl_ptr = &edesc->link_tbl[tbl_off]; - - to_talitos_ptr(&desc->ptr[5], edesc->dma_link_tbl + -@@ -1178,8 +1201,9 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, - edesc->dma_len, DMA_BIDIRECTIONAL); - - edesc->icv_ool = true; -- } else -- to_talitos_ptr(&desc->ptr[5], sg_dma_address(areq->dst), 0); -+ } else { -+ copy_talitos_ptr(&desc->ptr[5], &edesc->link_tbl[tbl_off], 0); -+ } - - /* iv out */ - map_single_talitos_ptr(dev, &desc->ptr[6], ivsize, ctx->iv, -@@ -1967,6 +1991,46 @@ static int ahash_digest(struct ahash_request *areq) - return ahash_process_req(areq, areq->nbytes); - } - -+static int ahash_export(struct ahash_request *areq, void *out) -+{ -+ struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq); -+ struct talitos_export_state *export = out; -+ -+ memcpy(export->hw_context, req_ctx->hw_context, -+ req_ctx->hw_context_size); -+ memcpy(export->buf, req_ctx->buf, req_ctx->nbuf); -+ export->swinit = req_ctx->swinit; -+ export->first = req_ctx->first; -+ export->last = req_ctx->last; -+ export->to_hash_later = req_ctx->to_hash_later; -+ export->nbuf = req_ctx->nbuf; -+ -+ return 0; -+} -+ -+static int ahash_import(struct ahash_request *areq, const void *in) -+{ -+ struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq); -+ struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq); -+ const struct talitos_export_state *export = in; -+ -+ memset(req_ctx, 0, sizeof(*req_ctx)); -+ req_ctx->hw_context_size = -+ (crypto_ahash_digestsize(tfm) <= SHA256_DIGEST_SIZE) -+ ? TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256 -+ : TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512; -+ memcpy(req_ctx->hw_context, export->hw_context, -+ req_ctx->hw_context_size); -+ memcpy(req_ctx->buf, export->buf, export->nbuf); -+ req_ctx->swinit = export->swinit; -+ req_ctx->first = export->first; -+ req_ctx->last = export->last; -+ req_ctx->to_hash_later = export->to_hash_later; -+ req_ctx->nbuf = export->nbuf; -+ -+ return 0; -+} -+ - struct keyhash_result { - struct completion completion; - int err; -@@ -2444,6 +2508,7 @@ static struct talitos_alg_template driver_algs[] = { - { .type = CRYPTO_ALG_TYPE_AHASH, - .alg.hash = { - .halg.digestsize = MD5_DIGEST_SIZE, -+ .halg.statesize = sizeof(struct talitos_export_state), - .halg.base = { - .cra_name = "md5", - .cra_driver_name = "md5-talitos", -@@ -2459,6 +2524,7 @@ static struct talitos_alg_template driver_algs[] = { - { .type = CRYPTO_ALG_TYPE_AHASH, - .alg.hash = { - .halg.digestsize = SHA1_DIGEST_SIZE, -+ .halg.statesize = sizeof(struct talitos_export_state), - .halg.base = { - .cra_name = "sha1", - .cra_driver_name = "sha1-talitos", -@@ -2474,6 +2540,7 @@ static struct talitos_alg_template driver_algs[] = { - { .type = CRYPTO_ALG_TYPE_AHASH, - .alg.hash = { - .halg.digestsize = SHA224_DIGEST_SIZE, -+ .halg.statesize = sizeof(struct talitos_export_state), - .halg.base = { - .cra_name = "sha224", - .cra_driver_name = "sha224-talitos", -@@ -2489,6 +2556,7 @@ static struct talitos_alg_template driver_algs[] = { - { .type = CRYPTO_ALG_TYPE_AHASH, - .alg.hash = { - .halg.digestsize = SHA256_DIGEST_SIZE, -+ .halg.statesize = sizeof(struct talitos_export_state), - .halg.base = { - .cra_name = "sha256", - .cra_driver_name = "sha256-talitos", -@@ -2504,6 +2572,7 @@ static struct talitos_alg_template driver_algs[] = { - { .type = CRYPTO_ALG_TYPE_AHASH, - .alg.hash = { - .halg.digestsize = SHA384_DIGEST_SIZE, -+ .halg.statesize = sizeof(struct talitos_export_state), - .halg.base = { - .cra_name = "sha384", - .cra_driver_name = "sha384-talitos", -@@ -2519,6 +2588,7 @@ static struct talitos_alg_template driver_algs[] = { - { .type = CRYPTO_ALG_TYPE_AHASH, - .alg.hash = { - .halg.digestsize = SHA512_DIGEST_SIZE, -+ .halg.statesize = sizeof(struct talitos_export_state), - .halg.base = { - .cra_name = "sha512", - .cra_driver_name = "sha512-talitos", -@@ -2534,6 +2604,7 @@ static struct talitos_alg_template driver_algs[] = { - { .type = CRYPTO_ALG_TYPE_AHASH, - .alg.hash = { - .halg.digestsize = MD5_DIGEST_SIZE, -+ .halg.statesize = sizeof(struct talitos_export_state), - .halg.base = { - .cra_name = "hmac(md5)", - .cra_driver_name = "hmac-md5-talitos", -@@ -2549,6 +2620,7 @@ static struct talitos_alg_template driver_algs[] = { - { .type = CRYPTO_ALG_TYPE_AHASH, - .alg.hash = { - .halg.digestsize = SHA1_DIGEST_SIZE, -+ .halg.statesize = sizeof(struct talitos_export_state), - .halg.base = { - .cra_name = "hmac(sha1)", - .cra_driver_name = "hmac-sha1-talitos", -@@ -2564,6 +2636,7 @@ static struct talitos_alg_template driver_algs[] = { - { .type = CRYPTO_ALG_TYPE_AHASH, - .alg.hash = { - .halg.digestsize = SHA224_DIGEST_SIZE, -+ .halg.statesize = sizeof(struct talitos_export_state), - .halg.base = { - .cra_name = "hmac(sha224)", - .cra_driver_name = "hmac-sha224-talitos", -@@ -2579,6 +2652,7 @@ static struct talitos_alg_template driver_algs[] = { - { .type = CRYPTO_ALG_TYPE_AHASH, - .alg.hash = { - .halg.digestsize = SHA256_DIGEST_SIZE, -+ .halg.statesize = sizeof(struct talitos_export_state), - .halg.base = { - .cra_name = "hmac(sha256)", - .cra_driver_name = "hmac-sha256-talitos", -@@ -2594,6 +2668,7 @@ static struct talitos_alg_template driver_algs[] = { - { .type = CRYPTO_ALG_TYPE_AHASH, - .alg.hash = { - .halg.digestsize = SHA384_DIGEST_SIZE, -+ .halg.statesize = sizeof(struct talitos_export_state), - .halg.base = { - .cra_name = "hmac(sha384)", - .cra_driver_name = "hmac-sha384-talitos", -@@ -2609,6 +2684,7 @@ static struct talitos_alg_template driver_algs[] = { - { .type = CRYPTO_ALG_TYPE_AHASH, - .alg.hash = { - .halg.digestsize = SHA512_DIGEST_SIZE, -+ .halg.statesize = sizeof(struct talitos_export_state), - .halg.base = { - .cra_name = "hmac(sha512)", - .cra_driver_name = "hmac-sha512-talitos", -@@ -2629,21 +2705,11 @@ struct talitos_crypto_alg { - struct talitos_alg_template algt; - }; - --static int talitos_cra_init(struct crypto_tfm *tfm) -+static int talitos_init_common(struct talitos_ctx *ctx, -+ struct talitos_crypto_alg *talitos_alg) - { -- struct crypto_alg *alg = tfm->__crt_alg; -- struct talitos_crypto_alg *talitos_alg; -- struct talitos_ctx *ctx = crypto_tfm_ctx(tfm); - struct talitos_private *priv; - -- if ((alg->cra_flags & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_AHASH) -- talitos_alg = container_of(__crypto_ahash_alg(alg), -- struct talitos_crypto_alg, -- algt.alg.hash); -- else -- talitos_alg = container_of(alg, struct talitos_crypto_alg, -- algt.alg.crypto); -- - /* update context with ptr to dev */ - ctx->dev = talitos_alg->dev; - -@@ -2661,10 +2727,33 @@ static int talitos_cra_init(struct crypto_tfm *tfm) - return 0; - } - -+static int talitos_cra_init(struct crypto_tfm *tfm) -+{ -+ struct crypto_alg *alg = tfm->__crt_alg; -+ struct talitos_crypto_alg *talitos_alg; -+ struct talitos_ctx *ctx = crypto_tfm_ctx(tfm); -+ -+ if ((alg->cra_flags & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_AHASH) -+ talitos_alg = container_of(__crypto_ahash_alg(alg), -+ struct talitos_crypto_alg, -+ algt.alg.hash); -+ else -+ talitos_alg = container_of(alg, struct talitos_crypto_alg, -+ algt.alg.crypto); -+ -+ return talitos_init_common(ctx, talitos_alg); -+} -+ - static int talitos_cra_init_aead(struct crypto_aead *tfm) - { -- talitos_cra_init(crypto_aead_tfm(tfm)); -- return 0; -+ struct aead_alg *alg = crypto_aead_alg(tfm); -+ struct talitos_crypto_alg *talitos_alg; -+ struct talitos_ctx *ctx = crypto_aead_ctx(tfm); -+ -+ talitos_alg = container_of(alg, struct talitos_crypto_alg, -+ algt.alg.aead); -+ -+ return talitos_init_common(ctx, talitos_alg); - } - - static int talitos_cra_init_ahash(struct crypto_tfm *tfm) -@@ -2787,6 +2876,8 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev, - t_alg->algt.alg.hash.finup = ahash_finup; - t_alg->algt.alg.hash.digest = ahash_digest; - t_alg->algt.alg.hash.setkey = ahash_setkey; -+ t_alg->algt.alg.hash.import = ahash_import; -+ t_alg->algt.alg.hash.export = ahash_export; - - if (!(priv->features & TALITOS_FTR_HMAC_OK) && - !strncmp(alg->cra_name, "hmac", 4)) { -diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c -index 4c243c1ffc7f..790f7cadc1ed 100644 ---- a/drivers/crypto/ux500/cryp/cryp_core.c -+++ b/drivers/crypto/ux500/cryp/cryp_core.c -@@ -1440,9 +1440,9 @@ static int ux500_cryp_probe(struct platform_device *pdev) - - device_data->phybase = res->start; - device_data->base = devm_ioremap_resource(dev, res); -- if (!device_data->base) { -+ if (IS_ERR(device_data->base)) { - dev_err(dev, "[%s]: ioremap failed!", __func__); -- ret = -ENOMEM; -+ ret = PTR_ERR(device_data->base); - goto out; - } - -diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c -index d6fdc583ce5d..574e87c7f2b8 100644 ---- a/drivers/crypto/ux500/hash/hash_core.c -+++ b/drivers/crypto/ux500/hash/hash_core.c -@@ -1659,9 +1659,9 @@ static int ux500_hash_probe(struct platform_device *pdev) - - device_data->phybase = res->start; - device_data->base = devm_ioremap_resource(dev, res); -- if (!device_data->base) { -+ if (IS_ERR(device_data->base)) { - dev_err(dev, "%s: ioremap() failed!\n", __func__); -- ret = -ENOMEM; -+ ret = PTR_ERR(device_data->base); - goto out; - } - spin_lock_init(&device_data->ctx_lock); -diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c -index 5ad0ec1f0e29..97199b3c25a2 100644 ---- a/drivers/dma/dw/core.c -+++ b/drivers/dma/dw/core.c -@@ -130,26 +130,14 @@ static void dwc_desc_put(struct dw_dma_chan *dwc, struct dw_desc *desc) - static void dwc_initialize(struct dw_dma_chan *dwc) - { - struct dw_dma *dw = to_dw_dma(dwc->chan.device); -- struct dw_dma_slave *dws = dwc->chan.private; - u32 cfghi = DWC_CFGH_FIFO_MODE; - u32 cfglo = DWC_CFGL_CH_PRIOR(dwc->priority); - - if (dwc->initialized == true) - return; - -- if (dws) { -- /* -- * We need controller-specific data to set up slave -- * transfers. -- */ -- BUG_ON(!dws->dma_dev || dws->dma_dev != dw->dma.dev); -- -- cfghi |= DWC_CFGH_DST_PER(dws->dst_id); -- cfghi |= DWC_CFGH_SRC_PER(dws->src_id); -- } else { -- cfghi |= DWC_CFGH_DST_PER(dwc->dst_id); -- cfghi |= DWC_CFGH_SRC_PER(dwc->src_id); -- } -+ cfghi |= DWC_CFGH_DST_PER(dwc->dst_id); -+ cfghi |= DWC_CFGH_SRC_PER(dwc->src_id); - - channel_writel(dwc, CFG_LO, cfglo); - channel_writel(dwc, CFG_HI, cfghi); -@@ -941,7 +929,7 @@ bool dw_dma_filter(struct dma_chan *chan, void *param) - struct dw_dma_chan *dwc = to_dw_dma_chan(chan); - struct dw_dma_slave *dws = param; - -- if (!dws || dws->dma_dev != chan->device->dev) -+ if (dws->dma_dev != chan->device->dev) - return false; - - /* We have to copy data since dws can be temporary storage */ -@@ -1165,6 +1153,14 @@ static int dwc_alloc_chan_resources(struct dma_chan *chan) - * doesn't mean what you think it means), and status writeback. - */ - -+ /* -+ * We need controller-specific data to set up slave transfers. -+ */ -+ if (chan->private && !dw_dma_filter(chan, chan->private)) { -+ dev_warn(chan2dev(chan), "Wrong controller-specific data\n"); -+ return -EINVAL; -+ } -+ - /* Enable controller here if needed */ - if (!dw->in_use) - dw_dma_on(dw); -@@ -1226,6 +1222,14 @@ static void dwc_free_chan_resources(struct dma_chan *chan) - spin_lock_irqsave(&dwc->lock, flags); - list_splice_init(&dwc->free_list, &list); - dwc->descs_allocated = 0; -+ -+ /* Clear custom channel configuration */ -+ dwc->src_id = 0; -+ dwc->dst_id = 0; -+ -+ dwc->src_master = 0; -+ dwc->dst_master = 0; -+ - dwc->initialized = false; - - /* Disable interrupts */ -diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c -index e3d7fcb69b4c..2dac314a2d7a 100644 ---- a/drivers/dma/edma.c -+++ b/drivers/dma/edma.c -@@ -1563,32 +1563,6 @@ static irqreturn_t dma_ccerr_handler(int irq, void *data) - return IRQ_HANDLED; - } - --static void edma_tc_set_pm_state(struct edma_tc *tc, bool enable) --{ -- struct platform_device *tc_pdev; -- int ret; -- -- if (!IS_ENABLED(CONFIG_OF) || !tc) -- return; -- -- tc_pdev = of_find_device_by_node(tc->node); -- if (!tc_pdev) { -- pr_err("%s: TPTC device is not found\n", __func__); -- return; -- } -- if (!pm_runtime_enabled(&tc_pdev->dev)) -- pm_runtime_enable(&tc_pdev->dev); -- -- if (enable) -- ret = pm_runtime_get_sync(&tc_pdev->dev); -- else -- ret = pm_runtime_put_sync(&tc_pdev->dev); -- -- if (ret < 0) -- pr_err("%s: pm_runtime_%s_sync() failed for %s\n", __func__, -- enable ? "get" : "put", dev_name(&tc_pdev->dev)); --} -- - /* Alloc channel resources */ - static int edma_alloc_chan_resources(struct dma_chan *chan) - { -@@ -1625,8 +1599,6 @@ static int edma_alloc_chan_resources(struct dma_chan *chan) - EDMA_CHAN_SLOT(echan->ch_num), chan->chan_id, - echan->hw_triggered ? "HW" : "SW"); - -- edma_tc_set_pm_state(echan->tc, true); -- - return 0; - - err_slot: -@@ -1663,7 +1635,6 @@ static void edma_free_chan_resources(struct dma_chan *chan) - echan->alloced = false; - } - -- edma_tc_set_pm_state(echan->tc, false); - echan->tc = NULL; - echan->hw_triggered = false; - -@@ -2408,10 +2379,8 @@ static int edma_pm_suspend(struct device *dev) - int i; - - for (i = 0; i < ecc->num_channels; i++) { -- if (echan[i].alloced) { -+ if (echan[i].alloced) - edma_setup_interrupt(&echan[i], false); -- edma_tc_set_pm_state(echan[i].tc, false); -- } - } - - return 0; -@@ -2441,8 +2410,6 @@ static int edma_pm_resume(struct device *dev) - - /* Set up channel -> slot mapping for the entry slot */ - edma_set_chmap(&echan[i], echan[i].slot[0]); -- -- edma_tc_set_pm_state(echan[i].tc, true); - } - } - -@@ -2466,7 +2433,8 @@ static struct platform_driver edma_driver = { - - static int edma_tptc_probe(struct platform_device *pdev) - { -- return 0; -+ pm_runtime_enable(&pdev->dev); -+ return pm_runtime_get_sync(&pdev->dev); - } - - static struct platform_driver edma_tptc_driver = { -diff --git a/drivers/dma/hsu/hsu.c b/drivers/dma/hsu/hsu.c -index eef145edb936..025d375fc3d7 100644 ---- a/drivers/dma/hsu/hsu.c -+++ b/drivers/dma/hsu/hsu.c -@@ -135,7 +135,7 @@ static u32 hsu_dma_chan_get_sr(struct hsu_dma_chan *hsuc) - sr = hsu_chan_readl(hsuc, HSU_CH_SR); - spin_unlock_irqrestore(&hsuc->vchan.lock, flags); - -- return sr; -+ return sr & ~(HSU_CH_SR_DESCE_ANY | HSU_CH_SR_CDESC_ANY); - } - - irqreturn_t hsu_dma_irq(struct hsu_dma_chip *chip, unsigned short nr) -@@ -254,10 +254,13 @@ static void hsu_dma_issue_pending(struct dma_chan *chan) - static size_t hsu_dma_active_desc_size(struct hsu_dma_chan *hsuc) - { - struct hsu_dma_desc *desc = hsuc->desc; -- size_t bytes = desc->length; -+ size_t bytes = 0; - int i; - -- i = desc->active % HSU_DMA_CHAN_NR_DESC; -+ for (i = desc->active; i < desc->nents; i++) -+ bytes += desc->sg[i].len; -+ -+ i = HSU_DMA_CHAN_NR_DESC - 1; - do { - bytes += hsu_chan_readl(hsuc, HSU_CH_DxTSR(i)); - } while (--i >= 0); -diff --git a/drivers/dma/hsu/hsu.h b/drivers/dma/hsu/hsu.h -index 578a8ee8cd05..6b070c22b1df 100644 ---- a/drivers/dma/hsu/hsu.h -+++ b/drivers/dma/hsu/hsu.h -@@ -41,6 +41,9 @@ - #define HSU_CH_SR_DESCTO(x) BIT(8 + (x)) - #define HSU_CH_SR_DESCTO_ANY (BIT(11) | BIT(10) | BIT(9) | BIT(8)) - #define HSU_CH_SR_CHE BIT(15) -+#define HSU_CH_SR_DESCE(x) BIT(16 + (x)) -+#define HSU_CH_SR_DESCE_ANY (BIT(19) | BIT(18) | BIT(17) | BIT(16)) -+#define HSU_CH_SR_CDESC_ANY (BIT(31) | BIT(30)) - - /* Bits in HSU_CH_CR */ - #define HSU_CH_CR_CHA BIT(0) -diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c -index 9794b073d7d7..a5ed9407c51b 100644 ---- a/drivers/dma/omap-dma.c -+++ b/drivers/dma/omap-dma.c -@@ -48,6 +48,7 @@ struct omap_chan { - unsigned dma_sig; - bool cyclic; - bool paused; -+ bool running; - - int dma_ch; - struct omap_desc *desc; -@@ -294,6 +295,8 @@ static void omap_dma_start(struct omap_chan *c, struct omap_desc *d) - - /* Enable channel */ - omap_dma_chan_write(c, CCR, d->ccr | CCR_ENABLE); -+ -+ c->running = true; - } - - static void omap_dma_stop(struct omap_chan *c) -@@ -355,6 +358,8 @@ static void omap_dma_stop(struct omap_chan *c) - - omap_dma_chan_write(c, CLNK_CTRL, val); - } -+ -+ c->running = false; - } - - static void omap_dma_start_sg(struct omap_chan *c, struct omap_desc *d, -@@ -673,15 +678,20 @@ static enum dma_status omap_dma_tx_status(struct dma_chan *chan, - struct omap_chan *c = to_omap_dma_chan(chan); - struct virt_dma_desc *vd; - enum dma_status ret; -- uint32_t ccr; - unsigned long flags; - -- ccr = omap_dma_chan_read(c, CCR); -- /* The channel is no longer active, handle the completion right away */ -- if (!(ccr & CCR_ENABLE)) -- omap_dma_callback(c->dma_ch, 0, c); -- - ret = dma_cookie_status(chan, cookie, txstate); -+ -+ if (!c->paused && c->running) { -+ uint32_t ccr = omap_dma_chan_read(c, CCR); -+ /* -+ * The channel is no longer active, set the return value -+ * accordingly -+ */ -+ if (!(ccr & CCR_ENABLE)) -+ ret = DMA_COMPLETE; -+ } -+ - if (ret == DMA_COMPLETE || !txstate) - return ret; - -diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c -index debca824bed6..77c1c44009d8 100644 ---- a/drivers/dma/pxa_dma.c -+++ b/drivers/dma/pxa_dma.c -@@ -122,6 +122,7 @@ struct pxad_chan { - struct pxad_device { - struct dma_device slave; - int nr_chans; -+ int nr_requestors; - void __iomem *base; - struct pxad_phy *phys; - spinlock_t phy_lock; /* Phy association */ -@@ -473,7 +474,7 @@ static void pxad_free_phy(struct pxad_chan *chan) - return; - - /* clear the channel mapping in DRCMR */ -- if (chan->drcmr <= DRCMR_CHLNUM) { -+ if (chan->drcmr <= pdev->nr_requestors) { - reg = pxad_drcmr(chan->drcmr); - writel_relaxed(0, chan->phy->base + reg); - } -@@ -509,6 +510,7 @@ static bool is_running_chan_misaligned(struct pxad_chan *chan) - - static void phy_enable(struct pxad_phy *phy, bool misaligned) - { -+ struct pxad_device *pdev; - u32 reg, dalgn; - - if (!phy->vchan) -@@ -518,7 +520,8 @@ static void phy_enable(struct pxad_phy *phy, bool misaligned) - "%s(); phy=%p(%d) misaligned=%d\n", __func__, - phy, phy->idx, misaligned); - -- if (phy->vchan->drcmr <= DRCMR_CHLNUM) { -+ pdev = to_pxad_dev(phy->vchan->vc.chan.device); -+ if (phy->vchan->drcmr <= pdev->nr_requestors) { - reg = pxad_drcmr(phy->vchan->drcmr); - writel_relaxed(DRCMR_MAPVLD | phy->idx, phy->base + reg); - } -@@ -914,6 +917,7 @@ static void pxad_get_config(struct pxad_chan *chan, - { - u32 maxburst = 0, dev_addr = 0; - enum dma_slave_buswidth width = DMA_SLAVE_BUSWIDTH_UNDEFINED; -+ struct pxad_device *pdev = to_pxad_dev(chan->vc.chan.device); - - *dcmd = 0; - if (dir == DMA_DEV_TO_MEM) { -@@ -922,7 +926,7 @@ static void pxad_get_config(struct pxad_chan *chan, - dev_addr = chan->cfg.src_addr; - *dev_src = dev_addr; - *dcmd |= PXA_DCMD_INCTRGADDR; -- if (chan->drcmr <= DRCMR_CHLNUM) -+ if (chan->drcmr <= pdev->nr_requestors) - *dcmd |= PXA_DCMD_FLOWSRC; - } - if (dir == DMA_MEM_TO_DEV) { -@@ -931,7 +935,7 @@ static void pxad_get_config(struct pxad_chan *chan, - dev_addr = chan->cfg.dst_addr; - *dev_dst = dev_addr; - *dcmd |= PXA_DCMD_INCSRCADDR; -- if (chan->drcmr <= DRCMR_CHLNUM) -+ if (chan->drcmr <= pdev->nr_requestors) - *dcmd |= PXA_DCMD_FLOWTRG; - } - if (dir == DMA_MEM_TO_MEM) -@@ -1341,13 +1345,15 @@ static struct dma_chan *pxad_dma_xlate(struct of_phandle_args *dma_spec, - - static int pxad_init_dmadev(struct platform_device *op, - struct pxad_device *pdev, -- unsigned int nr_phy_chans) -+ unsigned int nr_phy_chans, -+ unsigned int nr_requestors) - { - int ret; - unsigned int i; - struct pxad_chan *c; - - pdev->nr_chans = nr_phy_chans; -+ pdev->nr_requestors = nr_requestors; - INIT_LIST_HEAD(&pdev->slave.channels); - pdev->slave.device_alloc_chan_resources = pxad_alloc_chan_resources; - pdev->slave.device_free_chan_resources = pxad_free_chan_resources; -@@ -1382,7 +1388,7 @@ static int pxad_probe(struct platform_device *op) - const struct of_device_id *of_id; - struct mmp_dma_platdata *pdata = dev_get_platdata(&op->dev); - struct resource *iores; -- int ret, dma_channels = 0; -+ int ret, dma_channels = 0, nb_requestors = 0; - const enum dma_slave_buswidth widths = - DMA_SLAVE_BUSWIDTH_1_BYTE | DMA_SLAVE_BUSWIDTH_2_BYTES | - DMA_SLAVE_BUSWIDTH_4_BYTES; -@@ -1399,13 +1405,23 @@ static int pxad_probe(struct platform_device *op) - return PTR_ERR(pdev->base); - - of_id = of_match_device(pxad_dt_ids, &op->dev); -- if (of_id) -+ if (of_id) { - of_property_read_u32(op->dev.of_node, "#dma-channels", - &dma_channels); -- else if (pdata && pdata->dma_channels) -+ ret = of_property_read_u32(op->dev.of_node, "#dma-requests", -+ &nb_requestors); -+ if (ret) { -+ dev_warn(pdev->slave.dev, -+ "#dma-requests set to default 32 as missing in OF: %d", -+ ret); -+ nb_requestors = 32; -+ }; -+ } else if (pdata && pdata->dma_channels) { - dma_channels = pdata->dma_channels; -- else -+ nb_requestors = pdata->nb_requestors; -+ } else { - dma_channels = 32; /* default 32 channel */ -+ } - - dma_cap_set(DMA_SLAVE, pdev->slave.cap_mask); - dma_cap_set(DMA_MEMCPY, pdev->slave.cap_mask); -@@ -1423,7 +1439,7 @@ static int pxad_probe(struct platform_device *op) - pdev->slave.descriptor_reuse = true; - - pdev->slave.dev = &op->dev; -- ret = pxad_init_dmadev(op, pdev, dma_channels); -+ ret = pxad_init_dmadev(op, pdev, dma_channels, nb_requestors); - if (ret) { - dev_err(pdev->slave.dev, "unable to register\n"); - return ret; -@@ -1442,7 +1458,8 @@ static int pxad_probe(struct platform_device *op) - - platform_set_drvdata(op, pdev); - pxad_init_debugfs(pdev); -- dev_info(pdev->slave.dev, "initialized %d channels\n", dma_channels); -+ dev_info(pdev->slave.dev, "initialized %d channels on %d requestors\n", -+ dma_channels, nb_requestors); - return 0; - } - -diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c -index 9eee13ef83a5..d87a47547ba5 100644 ---- a/drivers/edac/amd64_edac.c -+++ b/drivers/edac/amd64_edac.c -@@ -1452,7 +1452,7 @@ static u64 f1x_get_norm_dct_addr(struct amd64_pvt *pvt, u8 range, - u64 chan_off; - u64 dram_base = get_dram_base(pvt, range); - u64 hole_off = f10_dhar_offset(pvt); -- u64 dct_sel_base_off = (pvt->dct_sel_hi & 0xFFFFFC00) << 16; -+ u64 dct_sel_base_off = (u64)(pvt->dct_sel_hi & 0xFFFFFC00) << 16; - - if (hi_rng) { - /* -diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c -index 01087a38da22..792bdae2b91d 100644 ---- a/drivers/edac/i7core_edac.c -+++ b/drivers/edac/i7core_edac.c -@@ -1866,7 +1866,7 @@ static int i7core_mce_check_error(struct notifier_block *nb, unsigned long val, - - i7_dev = get_i7core_dev(mce->socketid); - if (!i7_dev) -- return NOTIFY_BAD; -+ return NOTIFY_DONE; - - mci = i7_dev->mci; - pvt = mci->pvt_info; -diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c -index f5c6b97c8958..8bf745d2da7e 100644 ---- a/drivers/edac/sb_edac.c -+++ b/drivers/edac/sb_edac.c -@@ -362,6 +362,7 @@ struct sbridge_pvt { - - /* Memory type detection */ - bool is_mirrored, is_lockstep, is_close_pg; -+ bool is_chan_hash; - - /* Fifo double buffers */ - struct mce mce_entry[MCE_LOG_LEN]; -@@ -1060,6 +1061,20 @@ static inline u8 sad_pkg_ha(u8 pkg) - return (pkg >> 2) & 0x1; - } - -+static int haswell_chan_hash(int idx, u64 addr) -+{ -+ int i; -+ -+ /* -+ * XOR even bits from 12:26 to bit0 of idx, -+ * odd bits from 13:27 to bit1 -+ */ -+ for (i = 12; i < 28; i += 2) -+ idx ^= (addr >> i) & 3; -+ -+ return idx; -+} -+ - /**************************************************************************** - Memory check routines - ****************************************************************************/ -@@ -1616,6 +1631,10 @@ static int get_dimm_config(struct mem_ctl_info *mci) - KNL_MAX_CHANNELS : NUM_CHANNELS; - u64 knl_mc_sizes[KNL_MAX_CHANNELS]; - -+ if (pvt->info.type == HASWELL || pvt->info.type == BROADWELL) { -+ pci_read_config_dword(pvt->pci_ha0, HASWELL_HASYSDEFEATURE2, ®); -+ pvt->is_chan_hash = GET_BITFIELD(reg, 21, 21); -+ } - if (pvt->info.type == HASWELL || pvt->info.type == BROADWELL || - pvt->info.type == KNIGHTS_LANDING) - pci_read_config_dword(pvt->pci_sad1, SAD_TARGET, ®); -@@ -1839,8 +1858,8 @@ static void get_memory_layout(const struct mem_ctl_info *mci) - edac_dbg(0, "TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n", - n_tads, gb, (mb*1000)/1024, - ((u64)tmp_mb) << 20L, -- (u32)TAD_SOCK(reg), -- (u32)TAD_CH(reg), -+ (u32)(1 << TAD_SOCK(reg)), -+ (u32)TAD_CH(reg) + 1, - (u32)TAD_TGT0(reg), - (u32)TAD_TGT1(reg), - (u32)TAD_TGT2(reg), -@@ -2118,12 +2137,15 @@ static int get_memory_error_data(struct mem_ctl_info *mci, - } - - ch_way = TAD_CH(reg) + 1; -- sck_way = TAD_SOCK(reg) + 1; -+ sck_way = TAD_SOCK(reg); - - if (ch_way == 3) - idx = addr >> 6; -- else -+ else { - idx = (addr >> (6 + sck_way + shiftup)) & 0x3; -+ if (pvt->is_chan_hash) -+ idx = haswell_chan_hash(idx, addr); -+ } - idx = idx % ch_way; - - /* -@@ -2157,7 +2179,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci, - switch(ch_way) { - case 2: - case 4: -- sck_xch = 1 << sck_way * (ch_way >> 1); -+ sck_xch = (1 << sck_way) * (ch_way >> 1); - break; - default: - sprintf(msg, "Invalid mirror set. Can't decode addr"); -@@ -2175,7 +2197,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci, - n_tads, - addr, - limit, -- (u32)TAD_SOCK(reg), -+ sck_way, - ch_way, - offset, - idx, -@@ -2190,18 +2212,12 @@ static int get_memory_error_data(struct mem_ctl_info *mci, - offset, addr); - return -EINVAL; - } -- addr -= offset; -- /* Store the low bits [0:6] of the addr */ -- ch_addr = addr & 0x7f; -- /* Remove socket wayness and remove 6 bits */ -- addr >>= 6; -- addr = div_u64(addr, sck_xch); --#if 0 -- /* Divide by channel way */ -- addr = addr / ch_way; --#endif -- /* Recover the last 6 bits */ -- ch_addr |= addr << 6; -+ -+ ch_addr = addr - offset; -+ ch_addr >>= (6 + shiftup); -+ ch_addr /= sck_xch; -+ ch_addr <<= (6 + shiftup); -+ ch_addr |= addr & ((1 << (6 + shiftup)) - 1); - - /* - * Step 3) Decode rank -@@ -3152,7 +3168,7 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val, - - mci = get_mci_for_node_id(mce->socketid); - if (!mci) -- return NOTIFY_BAD; -+ return NOTIFY_DONE; - pvt = mci->pvt_info; - - /* -diff --git a/drivers/extcon/extcon-max77843.c b/drivers/extcon/extcon-max77843.c -index 74dfb7f4f277..d8cac4661cfe 100644 ---- a/drivers/extcon/extcon-max77843.c -+++ b/drivers/extcon/extcon-max77843.c -@@ -803,7 +803,7 @@ static int max77843_muic_probe(struct platform_device *pdev) - /* Clear IRQ bits before request IRQs */ - ret = regmap_bulk_read(max77843->regmap_muic, - MAX77843_MUIC_REG_INT1, info->status, -- MAX77843_MUIC_IRQ_NUM); -+ MAX77843_MUIC_STATUS_NUM); - if (ret) { - dev_err(&pdev->dev, "Failed to Clear IRQ bits\n"); - goto err_muic_irq; -diff --git a/drivers/firmware/broadcom/bcm47xx_nvram.c b/drivers/firmware/broadcom/bcm47xx_nvram.c -index 0c2f0a61b0ea..0b631e5b5b84 100644 ---- a/drivers/firmware/broadcom/bcm47xx_nvram.c -+++ b/drivers/firmware/broadcom/bcm47xx_nvram.c -@@ -94,15 +94,14 @@ static int nvram_find_and_copy(void __iomem *iobase, u32 lim) - - found: - __ioread32_copy(nvram_buf, header, sizeof(*header) / 4); -- header = (struct nvram_header *)nvram_buf; -- nvram_len = header->len; -+ nvram_len = ((struct nvram_header *)(nvram_buf))->len; - if (nvram_len > size) { - pr_err("The nvram size according to the header seems to be bigger than the partition on flash\n"); - nvram_len = size; - } - if (nvram_len >= NVRAM_SPACE) { - pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n", -- header->len, NVRAM_SPACE - 1); -+ nvram_len, NVRAM_SPACE - 1); - nvram_len = NVRAM_SPACE - 1; - } - /* proceed reading data after header */ -diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c -index 9e15d571b53c..a76c35fc0b92 100644 ---- a/drivers/firmware/efi/arm-init.c -+++ b/drivers/firmware/efi/arm-init.c -@@ -203,7 +203,19 @@ void __init efi_init(void) - - reserve_regions(); - early_memunmap(memmap.map, params.mmap_size); -- memblock_mark_nomap(params.mmap & PAGE_MASK, -- PAGE_ALIGN(params.mmap_size + -- (params.mmap & ~PAGE_MASK))); -+ -+ if (IS_ENABLED(CONFIG_ARM)) { -+ /* -+ * ARM currently does not allow ioremap_cache() to be called on -+ * memory regions that are covered by struct page. So remove the -+ * UEFI memory map from the linear mapping. -+ */ -+ memblock_mark_nomap(params.mmap & PAGE_MASK, -+ PAGE_ALIGN(params.mmap_size + -+ (params.mmap & ~PAGE_MASK))); -+ } else { -+ memblock_reserve(params.mmap & PAGE_MASK, -+ PAGE_ALIGN(params.mmap_size + -+ (params.mmap & ~PAGE_MASK))); -+ } - } -diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c -index 2cd37dad67a6..c51f3b2fe3c0 100644 ---- a/drivers/firmware/efi/efi.c -+++ b/drivers/firmware/efi/efi.c -@@ -182,6 +182,7 @@ static int generic_ops_register(void) - { - generic_ops.get_variable = efi.get_variable; - generic_ops.set_variable = efi.set_variable; -+ generic_ops.set_variable_nonblocking = efi.set_variable_nonblocking; - generic_ops.get_next_variable = efi.get_next_variable; - generic_ops.query_variable_store = efi_query_variable_store; - -diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c -index 7f2ea21c730d..6f182fd91a6d 100644 ---- a/drivers/firmware/efi/vars.c -+++ b/drivers/firmware/efi/vars.c -@@ -202,29 +202,44 @@ static const struct variable_validate variable_validate[] = { - { NULL_GUID, "", NULL }, - }; - -+/* -+ * Check if @var_name matches the pattern given in @match_name. -+ * -+ * @var_name: an array of @len non-NUL characters. -+ * @match_name: a NUL-terminated pattern string, optionally ending in "*". A -+ * final "*" character matches any trailing characters @var_name, -+ * including the case when there are none left in @var_name. -+ * @match: on output, the number of non-wildcard characters in @match_name -+ * that @var_name matches, regardless of the return value. -+ * @return: whether @var_name fully matches @match_name. -+ */ - static bool - variable_matches(const char *var_name, size_t len, const char *match_name, - int *match) - { - for (*match = 0; ; (*match)++) { - char c = match_name[*match]; -- char u = var_name[*match]; - -- /* Wildcard in the matching name means we've matched */ -- if (c == '*') -+ switch (c) { -+ case '*': -+ /* Wildcard in @match_name means we've matched. */ - return true; - -- /* Case sensitive match */ -- if (!c && *match == len) -- return true; -+ case '\0': -+ /* @match_name has ended. Has @var_name too? */ -+ return (*match == len); - -- if (c != u) -+ default: -+ /* -+ * We've reached a non-wildcard char in @match_name. -+ * Continue only if there's an identical character in -+ * @var_name. -+ */ -+ if (*match < len && c == var_name[*match]) -+ continue; - return false; -- -- if (!c) -- return true; -+ } - } -- return true; - } - - bool -diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c -index 23196c5fc17c..90c1511d731f 100644 ---- a/drivers/gpio/gpio-pca953x.c -+++ b/drivers/gpio/gpio-pca953x.c -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -159,7 +160,7 @@ static int pca953x_write_regs(struct pca953x_chip *chip, int reg, u8 *val) - switch (chip->chip_type) { - case PCA953X_TYPE: - ret = i2c_smbus_write_word_data(chip->client, -- reg << 1, (u16) *val); -+ reg << 1, cpu_to_le16(get_unaligned((u16 *)val))); - break; - case PCA957X_TYPE: - ret = i2c_smbus_write_byte_data(chip->client, reg << 1, -@@ -367,9 +368,11 @@ static void pca953x_gpio_set_multiple(struct gpio_chip *gc, - memcpy(reg_val, chip->reg_output, NBANK(chip)); - mutex_lock(&chip->i2c_lock); - for(bank=0; bank> ((bank % 4) * 8); -+ unsigned bankmask = mask[bank / sizeof(*mask)] >> -+ ((bank % sizeof(*mask)) * 8); - if(bankmask) { -- unsigned bankval = bits[bank/4] >> ((bank % 4) * 8); -+ unsigned bankval = bits[bank / sizeof(*bits)] >> -+ ((bank % sizeof(*bits)) * 8); - reg_val[bank] = (reg_val[bank] & ~bankmask) | bankval; - } - } -diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c -index b2b7b78664b8..76ac906b4d78 100644 ---- a/drivers/gpio/gpio-pxa.c -+++ b/drivers/gpio/gpio-pxa.c -@@ -283,8 +283,8 @@ static int pxa_gpio_direction_output(struct gpio_chip *chip, - writel_relaxed(mask, base + (value ? GPSR_OFFSET : GPCR_OFFSET)); - - ret = pinctrl_gpio_direction_output(chip->base + offset); -- if (!ret) -- return 0; -+ if (ret) -+ return ret; - - spin_lock_irqsave(&gpio_lock, flags); - -diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c -index 540cbc88c7a2..cc4d9bd0839e 100644 ---- a/drivers/gpio/gpiolib-acpi.c -+++ b/drivers/gpio/gpiolib-acpi.c -@@ -977,7 +977,7 @@ bool acpi_can_fallback_to_crs(struct acpi_device *adev, const char *con_id) - lookup = kmalloc(sizeof(*lookup), GFP_KERNEL); - if (lookup) { - lookup->adev = adev; -- lookup->con_id = con_id; -+ lookup->con_id = kstrdup(con_id, GFP_KERNEL); - list_add_tail(&lookup->node, &acpi_crs_lookup_list); - } - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -index 5e7770f9a415..ff299752d5e6 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -@@ -1619,6 +1619,7 @@ struct amdgpu_uvd { - struct amdgpu_bo *vcpu_bo; - void *cpu_addr; - uint64_t gpu_addr; -+ unsigned fw_version; - atomic_t handles[AMDGPU_MAX_UVD_HANDLES]; - struct drm_file *filp[AMDGPU_MAX_UVD_HANDLES]; - struct delayed_work idle_work; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c -index 7a4b101e10c6..75cb5b9b88f8 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c -@@ -816,10 +816,13 @@ static int amdgpu_cgs_get_active_displays_info(void *cgs_device, - struct drm_device *ddev = adev->ddev; - struct drm_crtc *crtc; - uint32_t line_time_us, vblank_lines; -+ struct cgs_mode_info *mode_info; - - if (info == NULL) - return -EINVAL; - -+ mode_info = info->mode_info; -+ - if (adev->mode_info.num_crtc && adev->mode_info.mode_config_initialized) { - list_for_each_entry(crtc, - &ddev->mode_config.crtc_list, head) { -@@ -828,7 +831,7 @@ static int amdgpu_cgs_get_active_displays_info(void *cgs_device, - info->active_display_mask |= (1 << amdgpu_crtc->crtc_id); - info->display_count++; - } -- if (info->mode_info != NULL && -+ if (mode_info != NULL && - crtc->enabled && amdgpu_crtc->enabled && - amdgpu_crtc->hw_mode.clock) { - line_time_us = (amdgpu_crtc->hw_mode.crtc_htotal * 1000) / -@@ -836,10 +839,10 @@ static int amdgpu_cgs_get_active_displays_info(void *cgs_device, - vblank_lines = amdgpu_crtc->hw_mode.crtc_vblank_end - - amdgpu_crtc->hw_mode.crtc_vdisplay + - (amdgpu_crtc->v_border * 2); -- info->mode_info->vblank_time_us = vblank_lines * line_time_us; -- info->mode_info->refresh_rate = drm_mode_vrefresh(&amdgpu_crtc->hw_mode); -- info->mode_info->ref_clock = adev->clock.spll.reference_freq; -- info->mode_info++; -+ mode_info->vblank_time_us = vblank_lines * line_time_us; -+ mode_info->refresh_rate = drm_mode_vrefresh(&amdgpu_crtc->hw_mode); -+ mode_info->ref_clock = adev->clock.spll.reference_freq; -+ mode_info = NULL; - } - } - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -index e23843f4d877..4488e82f87b0 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -@@ -303,7 +303,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file - fw_info.feature = adev->vce.fb_version; - break; - case AMDGPU_INFO_FW_UVD: -- fw_info.ver = 0; -+ fw_info.ver = adev->uvd.fw_version; - fw_info.feature = 0; - break; - case AMDGPU_INFO_FW_GMC: -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h -index fdc1be8550da..3b2d75d96ea0 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h -@@ -53,7 +53,7 @@ struct amdgpu_hpd; - - #define AMDGPU_MAX_HPD_PINS 6 - #define AMDGPU_MAX_CRTCS 6 --#define AMDGPU_MAX_AFMT_BLOCKS 7 -+#define AMDGPU_MAX_AFMT_BLOCKS 9 - - enum amdgpu_rmx_type { - RMX_OFF, -@@ -309,8 +309,8 @@ struct amdgpu_mode_info { - struct atom_context *atom_context; - struct card_info *atom_card_info; - bool mode_config_initialized; -- struct amdgpu_crtc *crtcs[6]; -- struct amdgpu_afmt *afmt[7]; -+ struct amdgpu_crtc *crtcs[AMDGPU_MAX_CRTCS]; -+ struct amdgpu_afmt *afmt[AMDGPU_MAX_AFMT_BLOCKS]; - /* DVI-I properties */ - struct drm_property *coherent_mode_property; - /* DAC enable load detect */ -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -index b8fbbd7699e4..73628c7599e7 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -@@ -540,6 +540,7 @@ int amdgpu_bo_set_metadata (struct amdgpu_bo *bo, void *metadata, - if (!metadata_size) { - if (bo->metadata_size) { - kfree(bo->metadata); -+ bo->metadata = NULL; - bo->metadata_size = 0; - } - return 0; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c -index 53f987aeeacf..3b35ad83867c 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c -@@ -156,6 +156,9 @@ int amdgpu_uvd_sw_init(struct amdgpu_device *adev) - DRM_INFO("Found UVD firmware Version: %hu.%hu Family ID: %hu\n", - version_major, version_minor, family_id); - -+ adev->uvd.fw_version = ((version_major << 24) | (version_minor << 16) | -+ (family_id << 8)); -+ - bo_size = AMDGPU_GPU_PAGE_ALIGN(le32_to_cpu(hdr->ucode_size_bytes) + 8) - + AMDGPU_UVD_STACK_SIZE + AMDGPU_UVD_HEAP_SIZE; - r = amdgpu_bo_create(adev, bo_size, PAGE_SIZE, true, -@@ -273,6 +276,8 @@ int amdgpu_uvd_resume(struct amdgpu_device *adev) - memcpy(adev->uvd.cpu_addr, (adev->uvd.fw->data) + offset, - (adev->uvd.fw->size) - offset); - -+ cancel_delayed_work_sync(&adev->uvd.idle_work); -+ - size = amdgpu_bo_size(adev->uvd.vcpu_bo); - size -= le32_to_cpu(hdr->ucode_size_bytes); - ptr = adev->uvd.cpu_addr; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c -index a745eeeb5d82..bb0da76051a1 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c -@@ -220,6 +220,7 @@ int amdgpu_vce_suspend(struct amdgpu_device *adev) - if (i == AMDGPU_MAX_VCE_HANDLES) - return 0; - -+ cancel_delayed_work_sync(&adev->vce.idle_work); - /* TODO: suspending running encoding sessions isn't supported */ - return -EINVAL; - } -diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_dp.c b/drivers/gpu/drm/amd/amdgpu/atombios_dp.c -index bf731e9f643e..7f85c2c1d681 100644 ---- a/drivers/gpu/drm/amd/amdgpu/atombios_dp.c -+++ b/drivers/gpu/drm/amd/amdgpu/atombios_dp.c -@@ -276,8 +276,8 @@ static int amdgpu_atombios_dp_get_dp_link_config(struct drm_connector *connector - } - } - } else { -- for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) { -- for (i = 0; i < ARRAY_SIZE(link_rates) && link_rates[i] <= max_link_rate; i++) { -+ for (i = 0; i < ARRAY_SIZE(link_rates) && link_rates[i] <= max_link_rate; i++) { -+ for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) { - max_pix_clock = (lane_num * link_rates[i] * 8) / bpp; - if (max_pix_clock >= pix_clock) { - *dp_lanes = lane_num; -diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c -index 1e0bba29e167..1cd6de575305 100644 ---- a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c -+++ b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c -@@ -298,6 +298,10 @@ bool amdgpu_atombios_encoder_mode_fixup(struct drm_encoder *encoder, - && (mode->crtc_vsync_start < (mode->crtc_vdisplay + 2))) - adjusted_mode->crtc_vsync_start = adjusted_mode->crtc_vdisplay + 2; - -+ /* vertical FP must be at least 1 */ -+ if (mode->crtc_vsync_start == mode->crtc_vdisplay) -+ adjusted_mode->crtc_vsync_start++; -+ - /* get the native mode for scaling */ - if (amdgpu_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) - amdgpu_panel_mode_fixup(encoder, adjusted_mode); -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c -index 06602df707f8..9b1c43005c80 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c -@@ -3628,7 +3628,7 @@ static void gfx_v7_0_ring_emit_vm_flush(struct amdgpu_ring *ring, - unsigned vm_id, uint64_t pd_addr) - { - int usepfp = (ring->type == AMDGPU_RING_TYPE_GFX); -- uint32_t seq = ring->fence_drv.sync_seq; -+ uint32_t seq = ring->fence_drv.sync_seq[ring->idx]; - uint64_t addr = ring->fence_drv.gpu_addr; - - amdgpu_ring_write(ring, PACKET3(PACKET3_WAIT_REG_MEM, 5)); -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -index b8060795b27b..53964b14ff48 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -@@ -902,14 +902,6 @@ static int gmc_v7_0_early_init(void *handle) - gmc_v7_0_set_gart_funcs(adev); - gmc_v7_0_set_irq_funcs(adev); - -- if (adev->flags & AMD_IS_APU) { -- adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN; -- } else { -- u32 tmp = RREG32(mmMC_SEQ_MISC0); -- tmp &= MC_SEQ_MISC0__MT__MASK; -- adev->mc.vram_type = gmc_v7_0_convert_vram_type(tmp); -- } -- - return 0; - } - -@@ -930,6 +922,14 @@ static int gmc_v7_0_sw_init(void *handle) - if (r) - return r; - -+ if (adev->flags & AMD_IS_APU) { -+ adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN; -+ } else { -+ u32 tmp = RREG32(mmMC_SEQ_MISC0); -+ tmp &= MC_SEQ_MISC0__MT__MASK; -+ adev->mc.vram_type = gmc_v7_0_convert_vram_type(tmp); -+ } -+ - r = amdgpu_irq_add_id(adev, 146, &adev->mc.vm_fault); - if (r) - return r; -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -index 3efd45546241..e59251f4a85d 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -@@ -856,14 +856,6 @@ static int gmc_v8_0_early_init(void *handle) - gmc_v8_0_set_gart_funcs(adev); - gmc_v8_0_set_irq_funcs(adev); - -- if (adev->flags & AMD_IS_APU) { -- adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN; -- } else { -- u32 tmp = RREG32(mmMC_SEQ_MISC0); -- tmp &= MC_SEQ_MISC0__MT__MASK; -- adev->mc.vram_type = gmc_v8_0_convert_vram_type(tmp); -- } -- - return 0; - } - -@@ -874,6 +866,8 @@ static int gmc_v8_0_late_init(void *handle) - return amdgpu_irq_get(adev, &adev->mc.vm_fault, 0); - } - -+#define mmMC_SEQ_MISC0_FIJI 0xA71 -+ - static int gmc_v8_0_sw_init(void *handle) - { - int r; -@@ -884,6 +878,19 @@ static int gmc_v8_0_sw_init(void *handle) - if (r) - return r; - -+ if (adev->flags & AMD_IS_APU) { -+ adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN; -+ } else { -+ u32 tmp; -+ -+ if (adev->asic_type == CHIP_FIJI) -+ tmp = RREG32(mmMC_SEQ_MISC0_FIJI); -+ else -+ tmp = RREG32(mmMC_SEQ_MISC0); -+ tmp &= MC_SEQ_MISC0__MT__MASK; -+ adev->mc.vram_type = gmc_v8_0_convert_vram_type(tmp); -+ } -+ - r = amdgpu_irq_add_id(adev, 146, &adev->mc.vm_fault); - if (r) - return r; -diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c -index 2cf50180cc51..b1c7a9b3631b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c -+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c -@@ -32,8 +32,8 @@ - #include "oss/oss_2_4_d.h" - #include "oss/oss_2_4_sh_mask.h" - --#include "gmc/gmc_8_1_d.h" --#include "gmc/gmc_8_1_sh_mask.h" -+#include "gmc/gmc_7_1_d.h" -+#include "gmc/gmc_7_1_sh_mask.h" - - #include "gca/gfx_8_0_d.h" - #include "gca/gfx_8_0_enum.h" -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c b/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c -index c34c393e9aea..d5e19b5fbbfb 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c -@@ -513,7 +513,7 @@ static int dbgdev_wave_control_set_registers( - union SQ_CMD_BITS *in_reg_sq_cmd, - union GRBM_GFX_INDEX_BITS *in_reg_gfx_index) - { -- int status; -+ int status = 0; - union SQ_CMD_BITS reg_sq_cmd; - union GRBM_GFX_INDEX_BITS reg_gfx_index; - struct HsaDbgWaveMsgAMDGen2 *pMsg; -diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c -index cf01177ca3b5..2ea012e88991 100644 ---- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c -+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c -@@ -241,6 +241,11 @@ static int cz_initialize_dpm_defaults(struct pp_hwmgr *hwmgr) - phm_cap_set(hwmgr->platform_descriptor.platformCaps, - PHM_PlatformCaps_DynamicUVDState); - -+ phm_cap_set(hwmgr->platform_descriptor.platformCaps, -+ PHM_PlatformCaps_UVDDPM); -+ phm_cap_set(hwmgr->platform_descriptor.platformCaps, -+ PHM_PlatformCaps_VCEDPM); -+ - cz_hwmgr->cc6_settings.cpu_cc6_disable = false; - cz_hwmgr->cc6_settings.cpu_pstate_disable = false; - cz_hwmgr->cc6_settings.nb_pstate_switch_disable = false; -diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c -index 9535c5b60387..7e5a97204051 100644 ---- a/drivers/gpu/drm/drm_dp_helper.c -+++ b/drivers/gpu/drm/drm_dp_helper.c -@@ -178,7 +178,7 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, - { - struct drm_dp_aux_msg msg; - unsigned int retry; -- int err; -+ int err = 0; - - memset(&msg, 0, sizeof(msg)); - msg.address = offset; -@@ -186,6 +186,8 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, - msg.buffer = buffer; - msg.size = size; - -+ mutex_lock(&aux->hw_mutex); -+ - /* - * The specification doesn't give any recommendation on how often to - * retry native transactions. We used to retry 7 times like for -@@ -194,25 +196,24 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, - */ - for (retry = 0; retry < 32; retry++) { - -- mutex_lock(&aux->hw_mutex); - err = aux->transfer(aux, &msg); -- mutex_unlock(&aux->hw_mutex); - if (err < 0) { - if (err == -EBUSY) - continue; - -- return err; -+ goto unlock; - } - - - switch (msg.reply & DP_AUX_NATIVE_REPLY_MASK) { - case DP_AUX_NATIVE_REPLY_ACK: - if (err < size) -- return -EPROTO; -- return err; -+ err = -EPROTO; -+ goto unlock; - - case DP_AUX_NATIVE_REPLY_NACK: -- return -EIO; -+ err = -EIO; -+ goto unlock; - - case DP_AUX_NATIVE_REPLY_DEFER: - usleep_range(AUX_RETRY_INTERVAL, AUX_RETRY_INTERVAL + 100); -@@ -221,7 +222,11 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, - } - - DRM_DEBUG_KMS("too many retries, giving up\n"); -- return -EIO; -+ err = -EIO; -+ -+unlock: -+ mutex_unlock(&aux->hw_mutex); -+ return err; - } - - /** -@@ -543,9 +548,7 @@ static int drm_dp_i2c_do_msg(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg) - int max_retries = max(7, drm_dp_i2c_retry_count(msg, dp_aux_i2c_speed_khz)); - - for (retry = 0, defer_i2c = 0; retry < (max_retries + defer_i2c); retry++) { -- mutex_lock(&aux->hw_mutex); - ret = aux->transfer(aux, msg); -- mutex_unlock(&aux->hw_mutex); - if (ret < 0) { - if (ret == -EBUSY) - continue; -@@ -684,6 +687,8 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, - - memset(&msg, 0, sizeof(msg)); - -+ mutex_lock(&aux->hw_mutex); -+ - for (i = 0; i < num; i++) { - msg.address = msgs[i].addr; - drm_dp_i2c_msg_set_request(&msg, &msgs[i]); -@@ -738,6 +743,8 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, - msg.size = 0; - (void)drm_dp_i2c_do_msg(aux, &msg); - -+ mutex_unlock(&aux->hw_mutex); -+ - return err; - } - -diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c -index 27fbd79d0daf..71ea0521ea96 100644 ---- a/drivers/gpu/drm/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/drm_dp_mst_topology.c -@@ -1672,13 +1672,19 @@ static int drm_dp_payload_send_msg(struct drm_dp_mst_topology_mgr *mgr, - u8 sinks[DRM_DP_MAX_SDP_STREAMS]; - int i; - -+ port = drm_dp_get_validated_port_ref(mgr, port); -+ if (!port) -+ return -EINVAL; -+ - port_num = port->port_num; - mstb = drm_dp_get_validated_mstb_ref(mgr, port->parent); - if (!mstb) { - mstb = drm_dp_get_last_connected_port_and_mstb(mgr, port->parent, &port_num); - -- if (!mstb) -+ if (!mstb) { -+ drm_dp_put_port(port); - return -EINVAL; -+ } - } - - txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL); -@@ -1707,6 +1713,7 @@ static int drm_dp_payload_send_msg(struct drm_dp_mst_topology_mgr *mgr, - kfree(txmsg); - fail_put: - drm_dp_put_mst_branch_device(mstb); -+ drm_dp_put_port(port); - return ret; - } - -@@ -1789,6 +1796,11 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr) - req_payload.start_slot = cur_slots; - if (mgr->proposed_vcpis[i]) { - port = container_of(mgr->proposed_vcpis[i], struct drm_dp_mst_port, vcpi); -+ port = drm_dp_get_validated_port_ref(mgr, port); -+ if (!port) { -+ mutex_unlock(&mgr->payload_lock); -+ return -EINVAL; -+ } - req_payload.num_slots = mgr->proposed_vcpis[i]->num_slots; - req_payload.vcpi = mgr->proposed_vcpis[i]->vcpi; - } else { -@@ -1816,6 +1828,9 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr) - mgr->payloads[i].payload_state = req_payload.payload_state; - } - cur_slots += req_payload.num_slots; -+ -+ if (port) -+ drm_dp_put_port(port); - } - - for (i = 0; i < mgr->max_payloads; i++) { -@@ -2121,6 +2136,8 @@ int drm_dp_mst_topology_mgr_resume(struct drm_dp_mst_topology_mgr *mgr) - - if (mgr->mst_primary) { - int sret; -+ u8 guid[16]; -+ - sret = drm_dp_dpcd_read(mgr->aux, DP_DPCD_REV, mgr->dpcd, DP_RECEIVER_CAP_SIZE); - if (sret != DP_RECEIVER_CAP_SIZE) { - DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n"); -@@ -2135,6 +2152,16 @@ int drm_dp_mst_topology_mgr_resume(struct drm_dp_mst_topology_mgr *mgr) - ret = -1; - goto out_unlock; - } -+ -+ /* Some hubs forget their guids after they resume */ -+ sret = drm_dp_dpcd_read(mgr->aux, DP_GUID, guid, 16); -+ if (sret != 16) { -+ DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n"); -+ ret = -1; -+ goto out_unlock; -+ } -+ drm_dp_check_mstb_guid(mgr->mst_primary, guid); -+ - ret = 0; - } else - ret = -1; -diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c -index cf39ed3133d6..4d0bc2a8843c 100644 ---- a/drivers/gpu/drm/i915/i915_debugfs.c -+++ b/drivers/gpu/drm/i915/i915_debugfs.c -@@ -2860,20 +2860,6 @@ static void intel_dp_info(struct seq_file *m, - intel_panel_info(m, &intel_connector->panel); - } - --static void intel_dp_mst_info(struct seq_file *m, -- struct intel_connector *intel_connector) --{ -- struct intel_encoder *intel_encoder = intel_connector->encoder; -- struct intel_dp_mst_encoder *intel_mst = -- enc_to_mst(&intel_encoder->base); -- struct intel_digital_port *intel_dig_port = intel_mst->primary; -- struct intel_dp *intel_dp = &intel_dig_port->dp; -- bool has_audio = drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, -- intel_connector->port); -- -- seq_printf(m, "\taudio support: %s\n", yesno(has_audio)); --} -- - static void intel_hdmi_info(struct seq_file *m, - struct intel_connector *intel_connector) - { -@@ -2917,8 +2903,6 @@ static void intel_connector_info(struct seq_file *m, - intel_hdmi_info(m, intel_connector); - else if (intel_encoder->type == INTEL_OUTPUT_LVDS) - intel_lvds_info(m, intel_connector); -- else if (intel_encoder->type == INTEL_OUTPUT_DP_MST) -- intel_dp_mst_info(m, intel_connector); - } - - seq_printf(m, "\tmodes:\n"); -diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c -index f357058c74d9..2e832fa07e09 100644 ---- a/drivers/gpu/drm/i915/i915_drv.c -+++ b/drivers/gpu/drm/i915/i915_drv.c -@@ -797,7 +797,7 @@ static int i915_drm_resume(struct drm_device *dev) - static int i915_drm_resume_early(struct drm_device *dev) - { - struct drm_i915_private *dev_priv = dev->dev_private; -- int ret = 0; -+ int ret; - - /* - * We have a resume ordering issue with the snd-hda driver also -@@ -808,6 +808,36 @@ static int i915_drm_resume_early(struct drm_device *dev) - * FIXME: This should be solved with a special hdmi sink device or - * similar so that power domains can be employed. - */ -+ -+ /* -+ * Note that we need to set the power state explicitly, since we -+ * powered off the device during freeze and the PCI core won't power -+ * it back up for us during thaw. Powering off the device during -+ * freeze is not a hard requirement though, and during the -+ * suspend/resume phases the PCI core makes sure we get here with the -+ * device powered on. So in case we change our freeze logic and keep -+ * the device powered we can also remove the following set power state -+ * call. -+ */ -+ ret = pci_set_power_state(dev->pdev, PCI_D0); -+ if (ret) { -+ DRM_ERROR("failed to set PCI D0 power state (%d)\n", ret); -+ goto out; -+ } -+ -+ /* -+ * Note that pci_enable_device() first enables any parent bridge -+ * device and only then sets the power state for this device. The -+ * bridge enabling is a nop though, since bridge devices are resumed -+ * first. The order of enabling power and enabling the device is -+ * imposed by the PCI core as described above, so here we preserve the -+ * same order for the freeze/thaw phases. -+ * -+ * TODO: eventually we should remove pci_disable_device() / -+ * pci_enable_enable_device() from suspend/resume. Due to how they -+ * depend on the device enable refcount we can't anyway depend on them -+ * disabling/enabling the device. -+ */ - if (pci_enable_device(dev->pdev)) { - ret = -EIO; - goto out; -diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h -index 4897728713f6..5672b57e65d5 100644 ---- a/drivers/gpu/drm/i915/i915_reg.h -+++ b/drivers/gpu/drm/i915/i915_reg.h -@@ -2898,7 +2898,14 @@ enum skl_disp_power_wells { - #define GEN6_RP_STATE_CAP _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5998) - #define BXT_RP_STATE_CAP _MMIO(0x138170) - --#define INTERVAL_1_28_US(us) (((us) * 100) >> 7) -+/* -+ * Make these a multiple of magic 25 to avoid SNB (eg. Dell XPS -+ * 8300) freezing up around GPU hangs. Looks as if even -+ * scheduling/timer interrupts start misbehaving if the RPS -+ * EI/thresholds are "bad", leading to a very sluggish or even -+ * frozen machine. -+ */ -+#define INTERVAL_1_28_US(us) roundup(((us) * 100) >> 7, 25) - #define INTERVAL_1_33_US(us) (((us) * 3) >> 2) - #define INTERVAL_0_833_US(us) (((us) * 6) / 5) - #define GT_INTERVAL_FROM_US(dev_priv, us) (IS_GEN9(dev_priv) ? \ -@@ -7405,6 +7412,8 @@ enum skl_disp_power_wells { - #define TRANS_CLK_SEL_DISABLED (0x0<<29) - #define TRANS_CLK_SEL_PORT(x) (((x)+1)<<29) - -+#define CDCLK_FREQ _MMIO(0x46200) -+ - #define _TRANSA_MSA_MISC 0x60410 - #define _TRANSB_MSA_MISC 0x61410 - #define _TRANSC_MSA_MISC 0x62410 -diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c -index 30f921421b0c..7d281b40064a 100644 ---- a/drivers/gpu/drm/i915/intel_audio.c -+++ b/drivers/gpu/drm/i915/intel_audio.c -@@ -262,8 +262,7 @@ static void hsw_audio_codec_disable(struct intel_encoder *encoder) - tmp |= AUD_CONFIG_N_PROG_ENABLE; - tmp &= ~AUD_CONFIG_UPPER_N_MASK; - tmp &= ~AUD_CONFIG_LOWER_N_MASK; -- if (intel_pipe_has_type(intel_crtc, INTEL_OUTPUT_DISPLAYPORT) || -- intel_pipe_has_type(intel_crtc, INTEL_OUTPUT_DP_MST)) -+ if (intel_pipe_has_type(intel_crtc, INTEL_OUTPUT_DISPLAYPORT)) - tmp |= AUD_CONFIG_N_VALUE_INDEX; - I915_WRITE(HSW_AUD_CFG(pipe), tmp); - -@@ -476,8 +475,7 @@ static void ilk_audio_codec_enable(struct drm_connector *connector, - tmp &= ~AUD_CONFIG_N_VALUE_INDEX; - tmp &= ~AUD_CONFIG_N_PROG_ENABLE; - tmp &= ~AUD_CONFIG_PIXEL_CLOCK_HDMI_MASK; -- if (intel_pipe_has_type(intel_crtc, INTEL_OUTPUT_DISPLAYPORT) || -- intel_pipe_has_type(intel_crtc, INTEL_OUTPUT_DP_MST)) -+ if (intel_pipe_has_type(intel_crtc, INTEL_OUTPUT_DISPLAYPORT)) - tmp |= AUD_CONFIG_N_VALUE_INDEX; - else - tmp |= audio_config_hdmi_pixel_clock(adjusted_mode); -@@ -515,8 +513,7 @@ void intel_audio_codec_enable(struct intel_encoder *intel_encoder) - - /* ELD Conn_Type */ - connector->eld[5] &= ~(3 << 2); -- if (intel_pipe_has_type(crtc, INTEL_OUTPUT_DISPLAYPORT) || -- intel_pipe_has_type(crtc, INTEL_OUTPUT_DP_MST)) -+ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_DISPLAYPORT)) - connector->eld[5] |= (1 << 2); - - connector->eld[6] = drm_av_sync_delay(connector, adjusted_mode) / 2; -diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c -index a7b4a524fadd..dbacc2901d47 100644 ---- a/drivers/gpu/drm/i915/intel_crt.c -+++ b/drivers/gpu/drm/i915/intel_crt.c -@@ -255,8 +255,14 @@ static bool intel_crt_compute_config(struct intel_encoder *encoder, - pipe_config->has_pch_encoder = true; - - /* LPT FDI RX only supports 8bpc. */ -- if (HAS_PCH_LPT(dev)) -+ if (HAS_PCH_LPT(dev)) { -+ if (pipe_config->bw_constrained && pipe_config->pipe_bpp < 24) { -+ DRM_DEBUG_KMS("LPT only supports 24bpp\n"); -+ return false; -+ } -+ - pipe_config->pipe_bpp = 24; -+ } - - /* FDI must always be 2.7 GHz */ - if (HAS_DDI(dev)) { -diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c -index 647d85e77c2f..597cfb5ca847 100644 ---- a/drivers/gpu/drm/i915/intel_csr.c -+++ b/drivers/gpu/drm/i915/intel_csr.c -@@ -177,7 +177,8 @@ static const struct stepping_info kbl_stepping_info[] = { - static const struct stepping_info skl_stepping_info[] = { - {'A', '0'}, {'B', '0'}, {'C', '0'}, - {'D', '0'}, {'E', '0'}, {'F', '0'}, -- {'G', '0'}, {'H', '0'}, {'I', '0'} -+ {'G', '0'}, {'H', '0'}, {'I', '0'}, -+ {'J', '0'}, {'K', '0'} - }; - - static const struct stepping_info bxt_stepping_info[] = { -diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c -index 084d5586585d..40511493914c 100644 ---- a/drivers/gpu/drm/i915/intel_ddi.c -+++ b/drivers/gpu/drm/i915/intel_ddi.c -@@ -464,9 +464,17 @@ static void intel_prepare_ddi_buffers(struct drm_device *dev, enum port port, - } else if (IS_BROADWELL(dev)) { - ddi_translations_fdi = bdw_ddi_translations_fdi; - ddi_translations_dp = bdw_ddi_translations_dp; -- ddi_translations_edp = bdw_ddi_translations_edp; -+ -+ if (dev_priv->edp_low_vswing) { -+ ddi_translations_edp = bdw_ddi_translations_edp; -+ n_edp_entries = ARRAY_SIZE(bdw_ddi_translations_edp); -+ } else { -+ ddi_translations_edp = bdw_ddi_translations_dp; -+ n_edp_entries = ARRAY_SIZE(bdw_ddi_translations_dp); -+ } -+ - ddi_translations_hdmi = bdw_ddi_translations_hdmi; -- n_edp_entries = ARRAY_SIZE(bdw_ddi_translations_edp); -+ - n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp); - n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi); - hdmi_default_entry = 7; -@@ -3157,23 +3165,6 @@ void intel_ddi_fdi_disable(struct drm_crtc *crtc) - I915_WRITE(FDI_RX_CTL(PIPE_A), val); - } - --bool intel_ddi_is_audio_enabled(struct drm_i915_private *dev_priv, -- struct intel_crtc *intel_crtc) --{ -- u32 temp; -- -- if (intel_display_power_get_if_enabled(dev_priv, POWER_DOMAIN_AUDIO)) { -- temp = I915_READ(HSW_AUD_PIN_ELD_CP_VLD); -- -- intel_display_power_put(dev_priv, POWER_DOMAIN_AUDIO); -- -- if (temp & AUDIO_OUTPUT_ENABLE(intel_crtc->pipe)) -- return true; -- } -- -- return false; --} -- - void intel_ddi_get_config(struct intel_encoder *encoder, - struct intel_crtc_state *pipe_config) - { -@@ -3234,8 +3225,11 @@ void intel_ddi_get_config(struct intel_encoder *encoder, - break; - } - -- pipe_config->has_audio = -- intel_ddi_is_audio_enabled(dev_priv, intel_crtc); -+ if (intel_display_power_is_enabled(dev_priv, POWER_DOMAIN_AUDIO)) { -+ temp = I915_READ(HSW_AUD_PIN_ELD_CP_VLD); -+ if (temp & AUDIO_OUTPUT_ENABLE(intel_crtc->pipe)) -+ pipe_config->has_audio = true; -+ } - - if (encoder->type == INTEL_OUTPUT_EDP && dev_priv->vbt.edp_bpp && - pipe_config->pipe_bpp > dev_priv->vbt.edp_bpp) { -@@ -3260,12 +3254,6 @@ void intel_ddi_get_config(struct intel_encoder *encoder, - intel_ddi_clock_get(encoder, pipe_config); - } - --static void intel_ddi_destroy(struct drm_encoder *encoder) --{ -- /* HDMI has nothing special to destroy, so we can go with this. */ -- intel_dp_encoder_destroy(encoder); --} -- - static bool intel_ddi_compute_config(struct intel_encoder *encoder, - struct intel_crtc_state *pipe_config) - { -@@ -3284,7 +3272,8 @@ static bool intel_ddi_compute_config(struct intel_encoder *encoder, - } - - static const struct drm_encoder_funcs intel_ddi_funcs = { -- .destroy = intel_ddi_destroy, -+ .reset = intel_dp_encoder_reset, -+ .destroy = intel_dp_encoder_destroy, - }; - - static struct intel_connector * -@@ -3356,6 +3345,7 @@ void intel_ddi_init(struct drm_device *dev, enum port port) - intel_encoder->post_disable = intel_ddi_post_disable; - intel_encoder->get_hw_state = intel_ddi_get_hw_state; - intel_encoder->get_config = intel_ddi_get_config; -+ intel_encoder->suspend = intel_dp_encoder_suspend; - - intel_dig_port->port = port; - intel_dig_port->saved_port_bits = I915_READ(DDI_BUF_CTL(port)) & -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 46947fffd599..39b00b9daf2d 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -4455,7 +4455,7 @@ int skl_update_scaler_crtc(struct intel_crtc_state *state) - intel_crtc->base.base.id, intel_crtc->pipe, SKL_CRTC_INDEX); - - return skl_update_scaler(state, !state->base.active, SKL_CRTC_INDEX, -- &state->scaler_state.scaler_id, DRM_ROTATE_0, -+ &state->scaler_state.scaler_id, BIT(DRM_ROTATE_0), - state->pipe_src_w, state->pipe_src_h, - adjusted_mode->crtc_hdisplay, adjusted_mode->crtc_vdisplay); - } -@@ -9793,6 +9793,8 @@ static void broadwell_set_cdclk(struct drm_device *dev, int cdclk) - sandybridge_pcode_write(dev_priv, HSW_PCODE_DE_WRITE_FREQ_REQ, data); - mutex_unlock(&dev_priv->rps.hw_lock); - -+ I915_WRITE(CDCLK_FREQ, DIV_ROUND_CLOSEST(cdclk, 1000) - 1); -+ - intel_update_cdclk(dev); - - WARN(cdclk != dev_priv->cdclk_freq, -@@ -13429,6 +13431,9 @@ static int intel_atomic_prepare_commit(struct drm_device *dev, - } - - for_each_crtc_in_state(state, crtc, crtc_state, i) { -+ if (state->legacy_cursor_update) -+ continue; -+ - ret = intel_crtc_wait_for_pending_flips(crtc); - if (ret) - return ret; -diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c -index cdc2c15873dc..3cd4996c791c 100644 ---- a/drivers/gpu/drm/i915/intel_dp.c -+++ b/drivers/gpu/drm/i915/intel_dp.c -@@ -4905,7 +4905,7 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder) - kfree(intel_dig_port); - } - --static void intel_dp_encoder_suspend(struct intel_encoder *intel_encoder) -+void intel_dp_encoder_suspend(struct intel_encoder *intel_encoder) - { - struct intel_dp *intel_dp = enc_to_intel_dp(&intel_encoder->base); - -@@ -4947,7 +4947,7 @@ static void intel_edp_panel_vdd_sanitize(struct intel_dp *intel_dp) - edp_panel_vdd_schedule_off(intel_dp); - } - --static void intel_dp_encoder_reset(struct drm_encoder *encoder) -+void intel_dp_encoder_reset(struct drm_encoder *encoder) - { - struct intel_dp *intel_dp; - -diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c -index fa0dabf578dc..e8e6984b8053 100644 ---- a/drivers/gpu/drm/i915/intel_dp_mst.c -+++ b/drivers/gpu/drm/i915/intel_dp_mst.c -@@ -78,8 +78,6 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder, - return false; - } - -- if (drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, found->port)) -- pipe_config->has_audio = true; - mst_pbn = drm_dp_calc_pbn_mode(adjusted_mode->crtc_clock, bpp); - - pipe_config->pbn = mst_pbn; -@@ -104,11 +102,6 @@ static void intel_mst_disable_dp(struct intel_encoder *encoder) - struct intel_dp_mst_encoder *intel_mst = enc_to_mst(&encoder->base); - struct intel_digital_port *intel_dig_port = intel_mst->primary; - struct intel_dp *intel_dp = &intel_dig_port->dp; -- struct drm_device *dev = encoder->base.dev; -- struct drm_i915_private *dev_priv = dev->dev_private; -- struct drm_crtc *crtc = encoder->base.crtc; -- struct intel_crtc *intel_crtc = to_intel_crtc(crtc); -- - int ret; - - DRM_DEBUG_KMS("%d\n", intel_dp->active_mst_links); -@@ -119,10 +112,6 @@ static void intel_mst_disable_dp(struct intel_encoder *encoder) - if (ret) { - DRM_ERROR("failed to update payload %d\n", ret); - } -- if (intel_crtc->config->has_audio) { -- intel_audio_codec_disable(encoder); -- intel_display_power_put(dev_priv, POWER_DOMAIN_AUDIO); -- } - } - - static void intel_mst_post_disable_dp(struct intel_encoder *encoder) -@@ -184,7 +173,7 @@ static void intel_mst_pre_enable_dp(struct intel_encoder *encoder) - intel_mst->port = found->port; - - if (intel_dp->active_mst_links == 0) { -- intel_ddi_clk_select(encoder, intel_crtc->config); -+ intel_ddi_clk_select(&intel_dig_port->base, intel_crtc->config); - - intel_dp_set_link_params(intel_dp, intel_crtc->config); - -@@ -219,7 +208,6 @@ static void intel_mst_enable_dp(struct intel_encoder *encoder) - struct intel_dp *intel_dp = &intel_dig_port->dp; - struct drm_device *dev = intel_dig_port->base.base.dev; - struct drm_i915_private *dev_priv = dev->dev_private; -- struct intel_crtc *crtc = to_intel_crtc(encoder->base.crtc); - enum port port = intel_dig_port->port; - int ret; - -@@ -232,13 +220,6 @@ static void intel_mst_enable_dp(struct intel_encoder *encoder) - ret = drm_dp_check_act_status(&intel_dp->mst_mgr); - - ret = drm_dp_update_payload_part2(&intel_dp->mst_mgr); -- -- if (crtc->config->has_audio) { -- DRM_DEBUG_DRIVER("Enabling DP audio on pipe %c\n", -- pipe_name(crtc->pipe)); -- intel_display_power_get(dev_priv, POWER_DOMAIN_AUDIO); -- intel_audio_codec_enable(encoder); -- } - } - - static bool intel_dp_mst_enc_get_hw_state(struct intel_encoder *encoder, -@@ -264,9 +245,6 @@ static void intel_dp_mst_enc_get_config(struct intel_encoder *encoder, - - pipe_config->has_dp_encoder = true; - -- pipe_config->has_audio = -- intel_ddi_is_audio_enabled(dev_priv, crtc); -- - temp = I915_READ(TRANS_DDI_FUNC_CTL(cpu_transcoder)); - if (temp & TRANS_DDI_PHSYNC) - flags |= DRM_MODE_FLAG_PHSYNC; -@@ -499,6 +477,8 @@ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, - struct intel_connector *intel_connector = to_intel_connector(connector); - struct drm_device *dev = connector->dev; - -+ intel_connector->unregister(intel_connector); -+ - /* need to nuke the connector */ - drm_modeset_lock_all(dev); - if (connector->state->crtc) { -@@ -512,11 +492,7 @@ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, - - WARN(ret, "Disabling mst crtc failed with %i\n", ret); - } -- drm_modeset_unlock_all(dev); -- -- intel_connector->unregister(intel_connector); - -- drm_modeset_lock_all(dev); - intel_connector_remove_from_fbdev(intel_connector); - drm_connector_cleanup(connector); - drm_modeset_unlock_all(dev); -diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h -index df7f3cb66056..1ae61f488987 100644 ---- a/drivers/gpu/drm/i915/intel_drv.h -+++ b/drivers/gpu/drm/i915/intel_drv.h -@@ -1013,8 +1013,6 @@ void intel_ddi_set_pipe_settings(struct drm_crtc *crtc); - void intel_ddi_prepare_link_retrain(struct intel_dp *intel_dp); - bool intel_ddi_connector_get_hw_state(struct intel_connector *intel_connector); - void intel_ddi_fdi_disable(struct drm_crtc *crtc); --bool intel_ddi_is_audio_enabled(struct drm_i915_private *dev_priv, -- struct intel_crtc *intel_crtc); - void intel_ddi_get_config(struct intel_encoder *encoder, - struct intel_crtc_state *pipe_config); - struct intel_encoder * -@@ -1234,6 +1232,8 @@ void intel_dp_set_link_params(struct intel_dp *intel_dp, - void intel_dp_start_link_train(struct intel_dp *intel_dp); - void intel_dp_stop_link_train(struct intel_dp *intel_dp); - void intel_dp_sink_dpms(struct intel_dp *intel_dp, int mode); -+void intel_dp_encoder_reset(struct drm_encoder *encoder); -+void intel_dp_encoder_suspend(struct intel_encoder *intel_encoder); - void intel_dp_encoder_destroy(struct drm_encoder *encoder); - int intel_dp_sink_crc(struct intel_dp *intel_dp, u8 *crc); - bool intel_dp_compute_config(struct intel_encoder *encoder, -diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c -index 616108c4bc3e..43fdae8ff3c3 100644 ---- a/drivers/gpu/drm/i915/intel_hdmi.c -+++ b/drivers/gpu/drm/i915/intel_hdmi.c -@@ -1407,8 +1407,16 @@ intel_hdmi_detect(struct drm_connector *connector, bool force) - hdmi_to_dig_port(intel_hdmi)); - } - -- if (!live_status) -- DRM_DEBUG_KMS("Live status not up!"); -+ if (!live_status) { -+ DRM_DEBUG_KMS("HDMI live status down\n"); -+ /* -+ * Live status register is not reliable on all intel platforms. -+ * So consider live_status only for certain platforms, for -+ * others, read EDID to determine presence of sink. -+ */ -+ if (INTEL_INFO(dev_priv)->gen < 7 || IS_IVYBRIDGE(dev_priv)) -+ live_status = true; -+ } - - intel_hdmi_unset_edid(connector); - -diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c -index f1fa756c5d5d..cfd5f9fff2f4 100644 ---- a/drivers/gpu/drm/i915/intel_lrc.c -+++ b/drivers/gpu/drm/i915/intel_lrc.c -@@ -781,11 +781,11 @@ static int logical_ring_prepare(struct drm_i915_gem_request *req, int bytes) - if (unlikely(total_bytes > remain_usable)) { - /* - * The base request will fit but the reserved space -- * falls off the end. So only need to to wait for the -- * reserved size after flushing out the remainder. -+ * falls off the end. So don't need an immediate wrap -+ * and only need to effectively wait for the reserved -+ * size space from the start of ringbuffer. - */ - wait_bytes = remain_actual + ringbuf->reserved_size; -- need_wrap = true; - } else if (total_bytes > ringbuf->space) { - /* No wrapping required, just waiting. */ - wait_bytes = total_bytes; -diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c -index b28c29f20e75..0eae3994e5e3 100644 ---- a/drivers/gpu/drm/i915/intel_pm.c -+++ b/drivers/gpu/drm/i915/intel_pm.c -@@ -2281,6 +2281,7 @@ static int ilk_compute_pipe_wm(struct intel_crtc *intel_crtc, - return PTR_ERR(cstate); - - pipe_wm = &cstate->wm.optimal.ilk; -+ memset(pipe_wm, 0, sizeof(*pipe_wm)); - - for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) { - ps = drm_atomic_get_plane_state(state, -@@ -3606,23 +3607,43 @@ static void skl_update_wm(struct drm_crtc *crtc) - dev_priv->wm.skl_hw = *results; - } - -+static void ilk_compute_wm_config(struct drm_device *dev, -+ struct intel_wm_config *config) -+{ -+ struct intel_crtc *crtc; -+ -+ /* Compute the currently _active_ config */ -+ for_each_intel_crtc(dev, crtc) { -+ const struct intel_pipe_wm *wm = &crtc->wm.active.ilk; -+ -+ if (!wm->pipe_enabled) -+ continue; -+ -+ config->sprites_enabled |= wm->sprites_enabled; -+ config->sprites_scaled |= wm->sprites_scaled; -+ config->num_pipes_active++; -+ } -+} -+ - static void ilk_program_watermarks(struct drm_i915_private *dev_priv) - { - struct drm_device *dev = dev_priv->dev; - struct intel_pipe_wm lp_wm_1_2 = {}, lp_wm_5_6 = {}, *best_lp_wm; - struct ilk_wm_maximums max; -- struct intel_wm_config *config = &dev_priv->wm.config; -+ struct intel_wm_config config = {}; - struct ilk_wm_values results = {}; - enum intel_ddb_partitioning partitioning; - -- ilk_compute_wm_maximums(dev, 1, config, INTEL_DDB_PART_1_2, &max); -- ilk_wm_merge(dev, config, &max, &lp_wm_1_2); -+ ilk_compute_wm_config(dev, &config); -+ -+ ilk_compute_wm_maximums(dev, 1, &config, INTEL_DDB_PART_1_2, &max); -+ ilk_wm_merge(dev, &config, &max, &lp_wm_1_2); - - /* 5/6 split only in single pipe config on IVB+ */ - if (INTEL_INFO(dev)->gen >= 7 && -- config->num_pipes_active == 1 && config->sprites_enabled) { -- ilk_compute_wm_maximums(dev, 1, config, INTEL_DDB_PART_5_6, &max); -- ilk_wm_merge(dev, config, &max, &lp_wm_5_6); -+ config.num_pipes_active == 1 && config.sprites_enabled) { -+ ilk_compute_wm_maximums(dev, 1, &config, INTEL_DDB_PART_5_6, &max); -+ ilk_wm_merge(dev, &config, &max, &lp_wm_5_6); - - best_lp_wm = ilk_find_best_result(dev, &lp_wm_1_2, &lp_wm_5_6); - } else { -@@ -6544,6 +6565,12 @@ static void broadwell_init_clock_gating(struct drm_device *dev) - misccpctl = I915_READ(GEN7_MISCCPCTL); - I915_WRITE(GEN7_MISCCPCTL, misccpctl & ~GEN7_DOP_CLOCK_GATE_ENABLE); - I915_WRITE(GEN8_L3SQCREG1, BDW_WA_L3SQCREG1_DEFAULT); -+ /* -+ * Wait at least 100 clocks before re-enabling clock gating. See -+ * the definition of L3SQCREG1 in BSpec. -+ */ -+ POSTING_READ(GEN8_L3SQCREG1); -+ udelay(1); - I915_WRITE(GEN7_MISCCPCTL, misccpctl); - - /* -diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c -index 40c6aff57256..549afa7bc75f 100644 ---- a/drivers/gpu/drm/i915/intel_ringbuffer.c -+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c -@@ -951,7 +951,7 @@ static int gen9_init_workarounds(struct intel_engine_cs *ring) - - /* WaForceContextSaveRestoreNonCoherent:skl,bxt */ - tmp = HDC_FORCE_CONTEXT_SAVE_RESTORE_NON_COHERENT; -- if (IS_SKL_REVID(dev, SKL_REVID_F0, SKL_REVID_F0) || -+ if (IS_SKL_REVID(dev, SKL_REVID_F0, REVID_FOREVER) || - IS_BXT_REVID(dev, BXT_REVID_B0, REVID_FOREVER)) - tmp |= HDC_FORCE_CSR_NON_COHERENT_OVR_DISABLE; - WA_SET_BIT_MASKED(HDC_CHICKEN0, tmp); -@@ -1044,7 +1044,8 @@ static int skl_init_workarounds(struct intel_engine_cs *ring) - WA_SET_BIT_MASKED(HIZ_CHICKEN, - BDW_HIZ_POWER_COMPILER_CLOCK_GATING_DISABLE); - -- if (IS_SKL_REVID(dev, 0, SKL_REVID_F0)) { -+ /* This is tied to WaForceContextSaveRestoreNonCoherent */ -+ if (IS_SKL_REVID(dev, 0, REVID_FOREVER)) { - /* - *Use Force Non-Coherent whenever executing a 3D context. This - * is a workaround for a possible hang in the unlikely event -@@ -1901,6 +1902,17 @@ i915_dispatch_execbuffer(struct drm_i915_gem_request *req, - return 0; - } - -+static void cleanup_phys_status_page(struct intel_engine_cs *ring) -+{ -+ struct drm_i915_private *dev_priv = to_i915(ring->dev); -+ -+ if (!dev_priv->status_page_dmah) -+ return; -+ -+ drm_pci_free(ring->dev, dev_priv->status_page_dmah); -+ ring->status_page.page_addr = NULL; -+} -+ - static void cleanup_status_page(struct intel_engine_cs *ring) - { - struct drm_i915_gem_object *obj; -@@ -1917,9 +1929,9 @@ static void cleanup_status_page(struct intel_engine_cs *ring) - - static int init_status_page(struct intel_engine_cs *ring) - { -- struct drm_i915_gem_object *obj; -+ struct drm_i915_gem_object *obj = ring->status_page.obj; - -- if ((obj = ring->status_page.obj) == NULL) { -+ if (obj == NULL) { - unsigned flags; - int ret; - -@@ -2019,10 +2031,12 @@ int intel_pin_and_map_ringbuffer_obj(struct drm_device *dev, - { - struct drm_i915_private *dev_priv = to_i915(dev); - struct drm_i915_gem_object *obj = ringbuf->obj; -+ /* Ring wraparound at offset 0 sometimes hangs. No idea why. */ -+ unsigned flags = PIN_OFFSET_BIAS | 4096; - int ret; - - if (HAS_LLC(dev_priv) && !obj->stolen) { -- ret = i915_gem_obj_ggtt_pin(obj, PAGE_SIZE, 0); -+ ret = i915_gem_obj_ggtt_pin(obj, PAGE_SIZE, flags); - if (ret) - return ret; - -@@ -2038,7 +2052,8 @@ int intel_pin_and_map_ringbuffer_obj(struct drm_device *dev, - return -ENOMEM; - } - } else { -- ret = i915_gem_obj_ggtt_pin(obj, PAGE_SIZE, PIN_MAPPABLE); -+ ret = i915_gem_obj_ggtt_pin(obj, PAGE_SIZE, -+ flags | PIN_MAPPABLE); - if (ret) - return ret; - -@@ -2164,7 +2179,7 @@ static int intel_init_ring_buffer(struct drm_device *dev, - if (ret) - goto error; - } else { -- BUG_ON(ring->id != RCS); -+ WARN_ON(ring->id != RCS); - ret = init_phys_status_page(ring); - if (ret) - goto error; -@@ -2210,7 +2225,12 @@ void intel_cleanup_ring_buffer(struct intel_engine_cs *ring) - if (ring->cleanup) - ring->cleanup(ring); - -- cleanup_status_page(ring); -+ if (I915_NEED_GFX_HWS(ring->dev)) { -+ cleanup_status_page(ring); -+ } else { -+ WARN_ON(ring->id != RCS); -+ cleanup_phys_status_page(ring); -+ } - - i915_cmd_parser_fini_ring(ring); - i915_gem_batch_pool_fini(&ring->batch_pool); -@@ -2373,11 +2393,11 @@ static int __intel_ring_prepare(struct intel_engine_cs *ring, int bytes) - if (unlikely(total_bytes > remain_usable)) { - /* - * The base request will fit but the reserved space -- * falls off the end. So only need to to wait for the -- * reserved size after flushing out the remainder. -+ * falls off the end. So don't need an immediate wrap -+ * and only need to effectively wait for the reserved -+ * size space from the start of ringbuffer. - */ - wait_bytes = remain_actual + ringbuf->reserved_size; -- need_wrap = true; - } else if (total_bytes > ringbuf->space) { - /* No wrapping required, just waiting. */ - wait_bytes = total_bytes; -diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c -index 277e60ae0e47..08961f7d151c 100644 ---- a/drivers/gpu/drm/i915/intel_uncore.c -+++ b/drivers/gpu/drm/i915/intel_uncore.c -@@ -1155,7 +1155,11 @@ static void intel_uncore_fw_domains_init(struct drm_device *dev) - } else if (IS_HASWELL(dev) || IS_BROADWELL(dev)) { - dev_priv->uncore.funcs.force_wake_get = - fw_domains_get_with_thread_status; -- dev_priv->uncore.funcs.force_wake_put = fw_domains_put; -+ if (IS_HASWELL(dev)) -+ dev_priv->uncore.funcs.force_wake_put = -+ fw_domains_put_with_fifo; -+ else -+ dev_priv->uncore.funcs.force_wake_put = fw_domains_put; - fw_domain_init(dev_priv, FW_DOMAIN_ID_RENDER, - FORCEWAKE_MT, FORCEWAKE_ACK_HSW); - } else if (IS_IVYBRIDGE(dev)) { -diff --git a/drivers/gpu/drm/nouveau/nvkm/core/ramht.c b/drivers/gpu/drm/nouveau/nvkm/core/ramht.c -index 3216e157a8a0..89da47234016 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/core/ramht.c -+++ b/drivers/gpu/drm/nouveau/nvkm/core/ramht.c -@@ -131,7 +131,7 @@ nvkm_ramht_del(struct nvkm_ramht **pramht) - struct nvkm_ramht *ramht = *pramht; - if (ramht) { - nvkm_gpuobj_del(&ramht->gpuobj); -- kfree(*pramht); -+ vfree(*pramht); - *pramht = NULL; - } - } -@@ -143,8 +143,8 @@ nvkm_ramht_new(struct nvkm_device *device, u32 size, u32 align, - struct nvkm_ramht *ramht; - int ret, i; - -- if (!(ramht = *pramht = kzalloc(sizeof(*ramht) + (size >> 3) * -- sizeof(*ramht->data), GFP_KERNEL))) -+ if (!(ramht = *pramht = vzalloc(sizeof(*ramht) + -+ (size >> 3) * sizeof(*ramht->data)))) - return -ENOMEM; - - ramht->device = device; -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c -index 1f81069edc58..332b5fe687fe 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c -@@ -1807,6 +1807,8 @@ gf100_gr_init(struct gf100_gr *gr) - - gf100_gr_mmio(gr, gr->func->mmio); - -+ nvkm_mask(device, TPC_UNIT(0, 0, 0x05c), 0x00000001, 0x00000001); -+ - memcpy(tpcnr, gr->tpc_nr, sizeof(gr->tpc_nr)); - for (i = 0, gpc = -1; i < gr->tpc_total; i++) { - do { -diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c -index 86276519b2ef..47e52647c9e5 100644 ---- a/drivers/gpu/drm/qxl/qxl_display.c -+++ b/drivers/gpu/drm/qxl/qxl_display.c -@@ -375,10 +375,15 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc, - - qxl_bo_kunmap(user_bo); - -+ qcrtc->cur_x += qcrtc->hot_spot_x - hot_x; -+ qcrtc->cur_y += qcrtc->hot_spot_y - hot_y; -+ qcrtc->hot_spot_x = hot_x; -+ qcrtc->hot_spot_y = hot_y; -+ - cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release); - cmd->type = QXL_CURSOR_SET; -- cmd->u.set.position.x = qcrtc->cur_x; -- cmd->u.set.position.y = qcrtc->cur_y; -+ cmd->u.set.position.x = qcrtc->cur_x + qcrtc->hot_spot_x; -+ cmd->u.set.position.y = qcrtc->cur_y + qcrtc->hot_spot_y; - - cmd->u.set.shape = qxl_bo_physical_address(qdev, cursor_bo, 0); - -@@ -441,8 +446,8 @@ static int qxl_crtc_cursor_move(struct drm_crtc *crtc, - - cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release); - cmd->type = QXL_CURSOR_MOVE; -- cmd->u.position.x = qcrtc->cur_x; -- cmd->u.position.y = qcrtc->cur_y; -+ cmd->u.position.x = qcrtc->cur_x + qcrtc->hot_spot_x; -+ cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y; - qxl_release_unmap(qdev, release, &cmd->release_info); - - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); -diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h -index 6e6b9b1519b8..3f3897eb458c 100644 ---- a/drivers/gpu/drm/qxl/qxl_drv.h -+++ b/drivers/gpu/drm/qxl/qxl_drv.h -@@ -135,6 +135,8 @@ struct qxl_crtc { - int index; - int cur_x; - int cur_y; -+ int hot_spot_x; -+ int hot_spot_y; - }; - - struct qxl_output { -diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c -index 801dd60ac192..7f52142d37d5 100644 ---- a/drivers/gpu/drm/radeon/atombios_crtc.c -+++ b/drivers/gpu/drm/radeon/atombios_crtc.c -@@ -1740,6 +1740,7 @@ static u32 radeon_get_pll_use_mask(struct drm_crtc *crtc) - static int radeon_get_shared_dp_ppll(struct drm_crtc *crtc) - { - struct drm_device *dev = crtc->dev; -+ struct radeon_device *rdev = dev->dev_private; - struct drm_crtc *test_crtc; - struct radeon_crtc *test_radeon_crtc; - -@@ -1749,6 +1750,10 @@ static int radeon_get_shared_dp_ppll(struct drm_crtc *crtc) - test_radeon_crtc = to_radeon_crtc(test_crtc); - if (test_radeon_crtc->encoder && - ENCODER_MODE_IS_DP(atombios_get_encoder_mode(test_radeon_crtc->encoder))) { -+ /* PPLL2 is exclusive to UNIPHYA on DCE61 */ -+ if (ASIC_IS_DCE61(rdev) && !ASIC_IS_DCE8(rdev) && -+ test_radeon_crtc->pll_id == ATOM_PPLL2) -+ continue; - /* for DP use the same PLL for all */ - if (test_radeon_crtc->pll_id != ATOM_PPLL_INVALID) - return test_radeon_crtc->pll_id; -@@ -1770,6 +1775,7 @@ static int radeon_get_shared_nondp_ppll(struct drm_crtc *crtc) - { - struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc); - struct drm_device *dev = crtc->dev; -+ struct radeon_device *rdev = dev->dev_private; - struct drm_crtc *test_crtc; - struct radeon_crtc *test_radeon_crtc; - u32 adjusted_clock, test_adjusted_clock; -@@ -1785,6 +1791,10 @@ static int radeon_get_shared_nondp_ppll(struct drm_crtc *crtc) - test_radeon_crtc = to_radeon_crtc(test_crtc); - if (test_radeon_crtc->encoder && - !ENCODER_MODE_IS_DP(atombios_get_encoder_mode(test_radeon_crtc->encoder))) { -+ /* PPLL2 is exclusive to UNIPHYA on DCE61 */ -+ if (ASIC_IS_DCE61(rdev) && !ASIC_IS_DCE8(rdev) && -+ test_radeon_crtc->pll_id == ATOM_PPLL2) -+ continue; - /* check if we are already driving this connector with another crtc */ - if (test_radeon_crtc->connector == radeon_crtc->connector) { - /* if we are, return that pll */ -diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c -index 6af832545bc5..b5760851195c 100644 ---- a/drivers/gpu/drm/radeon/atombios_dp.c -+++ b/drivers/gpu/drm/radeon/atombios_dp.c -@@ -326,8 +326,8 @@ int radeon_dp_get_dp_link_config(struct drm_connector *connector, - } - } - } else { -- for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) { -- for (i = 0; i < ARRAY_SIZE(link_rates) && link_rates[i] <= max_link_rate; i++) { -+ for (i = 0; i < ARRAY_SIZE(link_rates) && link_rates[i] <= max_link_rate; i++) { -+ for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) { - max_pix_clock = (lane_num * link_rates[i] * 8) / bpp; - if (max_pix_clock >= pix_clock) { - *dp_lanes = lane_num; -diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c -index 01b20e14a247..9de6503b10d8 100644 ---- a/drivers/gpu/drm/radeon/atombios_encoders.c -+++ b/drivers/gpu/drm/radeon/atombios_encoders.c -@@ -310,6 +310,10 @@ static bool radeon_atom_mode_fixup(struct drm_encoder *encoder, - && (mode->crtc_vsync_start < (mode->crtc_vdisplay + 2))) - adjusted_mode->crtc_vsync_start = adjusted_mode->crtc_vdisplay + 2; - -+ /* vertical FP must be at least 1 */ -+ if (mode->crtc_vsync_start == mode->crtc_vdisplay) -+ adjusted_mode->crtc_vsync_start++; -+ - /* get the native mode for scaling */ - if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) { - radeon_panel_mode_fixup(encoder, adjusted_mode); -@@ -892,8 +896,6 @@ atombios_dig_encoder_setup2(struct drm_encoder *encoder, int action, int panel_m - else - args.v1.ucLaneNum = 4; - -- if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000)) -- args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ; - switch (radeon_encoder->encoder_id) { - case ENCODER_OBJECT_ID_INTERNAL_UNIPHY: - args.v1.ucConfig = ATOM_ENCODER_CONFIG_V2_TRANSMITTER1; -@@ -910,6 +912,10 @@ atombios_dig_encoder_setup2(struct drm_encoder *encoder, int action, int panel_m - args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKB; - else - args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKA; -+ -+ if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000)) -+ args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ; -+ - break; - case 2: - case 3: -diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c -index 2ad462896896..32491355a1d4 100644 ---- a/drivers/gpu/drm/radeon/evergreen.c -+++ b/drivers/gpu/drm/radeon/evergreen.c -@@ -2608,10 +2608,152 @@ static void evergreen_agp_enable(struct radeon_device *rdev) - WREG32(VM_CONTEXT1_CNTL, 0); - } - -+static const unsigned ni_dig_offsets[] = -+{ -+ NI_DIG0_REGISTER_OFFSET, -+ NI_DIG1_REGISTER_OFFSET, -+ NI_DIG2_REGISTER_OFFSET, -+ NI_DIG3_REGISTER_OFFSET, -+ NI_DIG4_REGISTER_OFFSET, -+ NI_DIG5_REGISTER_OFFSET -+}; -+ -+static const unsigned ni_tx_offsets[] = -+{ -+ NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1, -+ NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1, -+ NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1, -+ NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1, -+ NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1, -+ NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1 -+}; -+ -+static const unsigned evergreen_dp_offsets[] = -+{ -+ EVERGREEN_DP0_REGISTER_OFFSET, -+ EVERGREEN_DP1_REGISTER_OFFSET, -+ EVERGREEN_DP2_REGISTER_OFFSET, -+ EVERGREEN_DP3_REGISTER_OFFSET, -+ EVERGREEN_DP4_REGISTER_OFFSET, -+ EVERGREEN_DP5_REGISTER_OFFSET -+}; -+ -+ -+/* -+ * Assumption is that EVERGREEN_CRTC_MASTER_EN enable for requested crtc -+ * We go from crtc to connector and it is not relible since it -+ * should be an opposite direction .If crtc is enable then -+ * find the dig_fe which selects this crtc and insure that it enable. -+ * if such dig_fe is found then find dig_be which selects found dig_be and -+ * insure that it enable and in DP_SST mode. -+ * if UNIPHY_PLL_CONTROL1.enable then we should disconnect timing -+ * from dp symbols clocks . -+ */ -+static bool evergreen_is_dp_sst_stream_enabled(struct radeon_device *rdev, -+ unsigned crtc_id, unsigned *ret_dig_fe) -+{ -+ unsigned i; -+ unsigned dig_fe; -+ unsigned dig_be; -+ unsigned dig_en_be; -+ unsigned uniphy_pll; -+ unsigned digs_fe_selected; -+ unsigned dig_be_mode; -+ unsigned dig_fe_mask; -+ bool is_enabled = false; -+ bool found_crtc = false; -+ -+ /* loop through all running dig_fe to find selected crtc */ -+ for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) { -+ dig_fe = RREG32(NI_DIG_FE_CNTL + ni_dig_offsets[i]); -+ if (dig_fe & NI_DIG_FE_CNTL_SYMCLK_FE_ON && -+ crtc_id == NI_DIG_FE_CNTL_SOURCE_SELECT(dig_fe)) { -+ /* found running pipe */ -+ found_crtc = true; -+ dig_fe_mask = 1 << i; -+ dig_fe = i; -+ break; -+ } -+ } -+ -+ if (found_crtc) { -+ /* loop through all running dig_be to find selected dig_fe */ -+ for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) { -+ dig_be = RREG32(NI_DIG_BE_CNTL + ni_dig_offsets[i]); -+ /* if dig_fe_selected by dig_be? */ -+ digs_fe_selected = NI_DIG_BE_CNTL_FE_SOURCE_SELECT(dig_be); -+ dig_be_mode = NI_DIG_FE_CNTL_MODE(dig_be); -+ if (dig_fe_mask & digs_fe_selected && -+ /* if dig_be in sst mode? */ -+ dig_be_mode == NI_DIG_BE_DPSST) { -+ dig_en_be = RREG32(NI_DIG_BE_EN_CNTL + -+ ni_dig_offsets[i]); -+ uniphy_pll = RREG32(NI_DCIO_UNIPHY0_PLL_CONTROL1 + -+ ni_tx_offsets[i]); -+ /* dig_be enable and tx is running */ -+ if (dig_en_be & NI_DIG_BE_EN_CNTL_ENABLE && -+ dig_en_be & NI_DIG_BE_EN_CNTL_SYMBCLK_ON && -+ uniphy_pll & NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE) { -+ is_enabled = true; -+ *ret_dig_fe = dig_fe; -+ break; -+ } -+ } -+ } -+ } -+ -+ return is_enabled; -+} -+ -+/* -+ * Blank dig when in dp sst mode -+ * Dig ignores crtc timing -+ */ -+static void evergreen_blank_dp_output(struct radeon_device *rdev, -+ unsigned dig_fe) -+{ -+ unsigned stream_ctrl; -+ unsigned fifo_ctrl; -+ unsigned counter = 0; -+ -+ if (dig_fe >= ARRAY_SIZE(evergreen_dp_offsets)) { -+ DRM_ERROR("invalid dig_fe %d\n", dig_fe); -+ return; -+ } -+ -+ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL + -+ evergreen_dp_offsets[dig_fe]); -+ if (!(stream_ctrl & EVERGREEN_DP_VID_STREAM_CNTL_ENABLE)) { -+ DRM_ERROR("dig %d , should be enable\n", dig_fe); -+ return; -+ } -+ -+ stream_ctrl &=~EVERGREEN_DP_VID_STREAM_CNTL_ENABLE; -+ WREG32(EVERGREEN_DP_VID_STREAM_CNTL + -+ evergreen_dp_offsets[dig_fe], stream_ctrl); -+ -+ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL + -+ evergreen_dp_offsets[dig_fe]); -+ while (counter < 32 && stream_ctrl & EVERGREEN_DP_VID_STREAM_STATUS) { -+ msleep(1); -+ counter++; -+ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL + -+ evergreen_dp_offsets[dig_fe]); -+ } -+ if (counter >= 32 ) -+ DRM_ERROR("counter exceeds %d\n", counter); -+ -+ fifo_ctrl = RREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe]); -+ fifo_ctrl |= EVERGREEN_DP_STEER_FIFO_RESET; -+ WREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe], fifo_ctrl); -+ -+} -+ - void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *save) - { - u32 crtc_enabled, tmp, frame_count, blackout; - int i, j; -+ unsigned dig_fe; - - if (!ASIC_IS_NODCE(rdev)) { - save->vga_render_control = RREG32(VGA_RENDER_CONTROL); -@@ -2651,7 +2793,17 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav - break; - udelay(1); - } -- -+ /*we should disable dig if it drives dp sst*/ -+ /*but we are in radeon_device_init and the topology is unknown*/ -+ /*and it is available after radeon_modeset_init*/ -+ /*the following method radeon_atom_encoder_dpms_dig*/ -+ /*does the job if we initialize it properly*/ -+ /*for now we do it this manually*/ -+ /**/ -+ if (ASIC_IS_DCE5(rdev) && -+ evergreen_is_dp_sst_stream_enabled(rdev, i ,&dig_fe)) -+ evergreen_blank_dp_output(rdev, dig_fe); -+ /*we could remove 6 lines below*/ - /* XXX this is a hack to avoid strange behavior with EFI on certain systems */ - WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1); - tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]); -diff --git a/drivers/gpu/drm/radeon/evergreen_reg.h b/drivers/gpu/drm/radeon/evergreen_reg.h -index aa939dfed3a3..b436badf9efa 100644 ---- a/drivers/gpu/drm/radeon/evergreen_reg.h -+++ b/drivers/gpu/drm/radeon/evergreen_reg.h -@@ -250,8 +250,43 @@ - - /* HDMI blocks at 0x7030, 0x7c30, 0x10830, 0x11430, 0x12030, 0x12c30 */ - #define EVERGREEN_HDMI_BASE 0x7030 -+/*DIG block*/ -+#define NI_DIG0_REGISTER_OFFSET (0x7000 - 0x7000) -+#define NI_DIG1_REGISTER_OFFSET (0x7C00 - 0x7000) -+#define NI_DIG2_REGISTER_OFFSET (0x10800 - 0x7000) -+#define NI_DIG3_REGISTER_OFFSET (0x11400 - 0x7000) -+#define NI_DIG4_REGISTER_OFFSET (0x12000 - 0x7000) -+#define NI_DIG5_REGISTER_OFFSET (0x12C00 - 0x7000) -+ -+ -+#define NI_DIG_FE_CNTL 0x7000 -+# define NI_DIG_FE_CNTL_SOURCE_SELECT(x) ((x) & 0x3) -+# define NI_DIG_FE_CNTL_SYMCLK_FE_ON (1<<24) -+ -+ -+#define NI_DIG_BE_CNTL 0x7140 -+# define NI_DIG_BE_CNTL_FE_SOURCE_SELECT(x) (((x) >> 8 ) & 0x3F) -+# define NI_DIG_FE_CNTL_MODE(x) (((x) >> 16) & 0x7 ) -+ -+#define NI_DIG_BE_EN_CNTL 0x7144 -+# define NI_DIG_BE_EN_CNTL_ENABLE (1 << 0) -+# define NI_DIG_BE_EN_CNTL_SYMBCLK_ON (1 << 8) -+# define NI_DIG_BE_DPSST 0 - - /* Display Port block */ -+#define EVERGREEN_DP0_REGISTER_OFFSET (0x730C - 0x730C) -+#define EVERGREEN_DP1_REGISTER_OFFSET (0x7F0C - 0x730C) -+#define EVERGREEN_DP2_REGISTER_OFFSET (0x10B0C - 0x730C) -+#define EVERGREEN_DP3_REGISTER_OFFSET (0x1170C - 0x730C) -+#define EVERGREEN_DP4_REGISTER_OFFSET (0x1230C - 0x730C) -+#define EVERGREEN_DP5_REGISTER_OFFSET (0x12F0C - 0x730C) -+ -+ -+#define EVERGREEN_DP_VID_STREAM_CNTL 0x730C -+# define EVERGREEN_DP_VID_STREAM_CNTL_ENABLE (1 << 0) -+# define EVERGREEN_DP_VID_STREAM_STATUS (1 <<16) -+#define EVERGREEN_DP_STEER_FIFO 0x7310 -+# define EVERGREEN_DP_STEER_FIFO_RESET (1 << 0) - #define EVERGREEN_DP_SEC_CNTL 0x7280 - # define EVERGREEN_DP_SEC_STREAM_ENABLE (1 << 0) - # define EVERGREEN_DP_SEC_ASP_ENABLE (1 << 4) -@@ -266,4 +301,15 @@ - # define EVERGREEN_DP_SEC_N_BASE_MULTIPLE(x) (((x) & 0xf) << 24) - # define EVERGREEN_DP_SEC_SS_EN (1 << 28) - -+/*DCIO_UNIPHY block*/ -+#define NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1 (0x6600 -0x6600) -+#define NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1 (0x6640 -0x6600) -+#define NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1 (0x6680 - 0x6600) -+#define NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1 (0x66C0 - 0x6600) -+#define NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1 (0x6700 - 0x6600) -+#define NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1 (0x6740 - 0x6600) -+ -+#define NI_DCIO_UNIPHY0_PLL_CONTROL1 0x6618 -+# define NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE (1 << 0) -+ - #endif -diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c -index 340f3f549f29..9cfc1c3e1965 100644 ---- a/drivers/gpu/drm/radeon/radeon_connectors.c -+++ b/drivers/gpu/drm/radeon/radeon_connectors.c -@@ -1996,10 +1996,12 @@ radeon_add_atom_connector(struct drm_device *dev, - rdev->mode_info.dither_property, - RADEON_FMT_DITHER_DISABLE); - -- if (radeon_audio != 0) -+ if (radeon_audio != 0) { - drm_object_attach_property(&radeon_connector->base.base, - rdev->mode_info.audio_property, - RADEON_AUDIO_AUTO); -+ radeon_connector->audio = RADEON_AUDIO_AUTO; -+ } - if (ASIC_IS_DCE5(rdev)) - drm_object_attach_property(&radeon_connector->base.base, - rdev->mode_info.output_csc_property, -@@ -2124,6 +2126,7 @@ radeon_add_atom_connector(struct drm_device *dev, - drm_object_attach_property(&radeon_connector->base.base, - rdev->mode_info.audio_property, - RADEON_AUDIO_AUTO); -+ radeon_connector->audio = RADEON_AUDIO_AUTO; - } - if (connector_type == DRM_MODE_CONNECTOR_DVII) { - radeon_connector->dac_load_detect = true; -@@ -2179,6 +2182,7 @@ radeon_add_atom_connector(struct drm_device *dev, - drm_object_attach_property(&radeon_connector->base.base, - rdev->mode_info.audio_property, - RADEON_AUDIO_AUTO); -+ radeon_connector->audio = RADEON_AUDIO_AUTO; - } - if (ASIC_IS_DCE5(rdev)) - drm_object_attach_property(&radeon_connector->base.base, -@@ -2231,6 +2235,7 @@ radeon_add_atom_connector(struct drm_device *dev, - drm_object_attach_property(&radeon_connector->base.base, - rdev->mode_info.audio_property, - RADEON_AUDIO_AUTO); -+ radeon_connector->audio = RADEON_AUDIO_AUTO; - } - if (ASIC_IS_DCE5(rdev)) - drm_object_attach_property(&radeon_connector->base.base, -diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c -index 2d9196a447fd..bfcef4db8138 100644 ---- a/drivers/gpu/drm/radeon/radeon_display.c -+++ b/drivers/gpu/drm/radeon/radeon_display.c -@@ -1683,10 +1683,8 @@ int radeon_modeset_init(struct radeon_device *rdev) - /* setup afmt */ - radeon_afmt_init(rdev); - -- if (!list_empty(&rdev->ddev->mode_config.connector_list)) { -- radeon_fbdev_init(rdev); -- drm_kms_helper_poll_init(rdev->ddev); -- } -+ radeon_fbdev_init(rdev); -+ drm_kms_helper_poll_init(rdev->ddev); - - /* do pm late init */ - ret = radeon_pm_late_init(rdev); -diff --git a/drivers/gpu/drm/radeon/radeon_dp_auxch.c b/drivers/gpu/drm/radeon/radeon_dp_auxch.c -index 3b0c229d7dcd..db64e0062689 100644 ---- a/drivers/gpu/drm/radeon/radeon_dp_auxch.c -+++ b/drivers/gpu/drm/radeon/radeon_dp_auxch.c -@@ -105,7 +105,7 @@ radeon_dp_aux_transfer_native(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg - - tmp &= AUX_HPD_SEL(0x7); - tmp |= AUX_HPD_SEL(chan->rec.hpd); -- tmp |= AUX_EN | AUX_LS_READ_EN; -+ tmp |= AUX_EN | AUX_LS_READ_EN | AUX_HPD_DISCON(0x1); - - WREG32(AUX_CONTROL + aux_offset[instance], tmp); - -diff --git a/drivers/gpu/drm/radeon/radeon_dp_mst.c b/drivers/gpu/drm/radeon/radeon_dp_mst.c -index df7a1719c841..9d210bbcab50 100644 ---- a/drivers/gpu/drm/radeon/radeon_dp_mst.c -+++ b/drivers/gpu/drm/radeon/radeon_dp_mst.c -@@ -525,17 +525,9 @@ static bool radeon_mst_mode_fixup(struct drm_encoder *encoder, - drm_mode_set_crtcinfo(adjusted_mode, 0); - { - struct radeon_connector_atom_dig *dig_connector; -- int ret; -- - dig_connector = mst_enc->connector->con_priv; -- ret = radeon_dp_get_dp_link_config(&mst_enc->connector->base, -- dig_connector->dpcd, adjusted_mode->clock, -- &dig_connector->dp_lane_count, -- &dig_connector->dp_clock); -- if (ret) { -- dig_connector->dp_lane_count = 0; -- dig_connector->dp_clock = 0; -- } -+ dig_connector->dp_lane_count = drm_dp_max_lane_count(dig_connector->dpcd); -+ dig_connector->dp_clock = drm_dp_max_link_rate(dig_connector->dpcd); - DRM_DEBUG_KMS("dig clock %p %d %d\n", dig_connector, - dig_connector->dp_lane_count, dig_connector->dp_clock); - } -diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c -index d2e628eea53d..d179596334a7 100644 ---- a/drivers/gpu/drm/radeon/radeon_fb.c -+++ b/drivers/gpu/drm/radeon/radeon_fb.c -@@ -292,7 +292,8 @@ out_unref: - - void radeon_fb_output_poll_changed(struct radeon_device *rdev) - { -- drm_fb_helper_hotplug_event(&rdev->mode_info.rfbdev->helper); -+ if (rdev->mode_info.rfbdev) -+ drm_fb_helper_hotplug_event(&rdev->mode_info.rfbdev->helper); - } - - static int radeon_fbdev_destroy(struct drm_device *dev, struct radeon_fbdev *rfbdev) -@@ -325,6 +326,10 @@ int radeon_fbdev_init(struct radeon_device *rdev) - int bpp_sel = 32; - int ret; - -+ /* don't enable fbdev if no connectors */ -+ if (list_empty(&rdev->ddev->mode_config.connector_list)) -+ return 0; -+ - /* select 8 bpp console on RN50 or 16MB cards */ - if (ASIC_IS_RN50(rdev) || rdev->mc.real_vram_size <= (32*1024*1024)) - bpp_sel = 8; -@@ -377,11 +382,15 @@ void radeon_fbdev_fini(struct radeon_device *rdev) - - void radeon_fbdev_set_suspend(struct radeon_device *rdev, int state) - { -- fb_set_suspend(rdev->mode_info.rfbdev->helper.fbdev, state); -+ if (rdev->mode_info.rfbdev) -+ fb_set_suspend(rdev->mode_info.rfbdev->helper.fbdev, state); - } - - bool radeon_fbdev_robj_is_fb(struct radeon_device *rdev, struct radeon_bo *robj) - { -+ if (!rdev->mode_info.rfbdev) -+ return false; -+ - if (robj == gem_to_radeon_bo(rdev->mode_info.rfbdev->rfb.obj)) - return true; - return false; -@@ -389,12 +398,14 @@ bool radeon_fbdev_robj_is_fb(struct radeon_device *rdev, struct radeon_bo *robj) - - void radeon_fb_add_connector(struct radeon_device *rdev, struct drm_connector *connector) - { -- drm_fb_helper_add_one_connector(&rdev->mode_info.rfbdev->helper, connector); -+ if (rdev->mode_info.rfbdev) -+ drm_fb_helper_add_one_connector(&rdev->mode_info.rfbdev->helper, connector); - } - - void radeon_fb_remove_connector(struct radeon_device *rdev, struct drm_connector *connector) - { -- drm_fb_helper_remove_one_connector(&rdev->mode_info.rfbdev->helper, connector); -+ if (rdev->mode_info.rfbdev) -+ drm_fb_helper_remove_one_connector(&rdev->mode_info.rfbdev->helper, connector); - } - - void radeon_fbdev_restore_mode(struct radeon_device *rdev) -diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c -index e06ac546a90f..f342aad79cc6 100644 ---- a/drivers/gpu/drm/radeon/radeon_ttm.c -+++ b/drivers/gpu/drm/radeon/radeon_ttm.c -@@ -235,6 +235,8 @@ static int radeon_verify_access(struct ttm_buffer_object *bo, struct file *filp) - { - struct radeon_bo *rbo = container_of(bo, struct radeon_bo, tbo); - -+ if (radeon_ttm_tt_has_userptr(bo->ttm)) -+ return -EPERM; - return drm_vma_node_verify_access(&rbo->gem_base.vma_node, filp); - } - -diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c -index a82b891ae1fe..caa73de584a5 100644 ---- a/drivers/gpu/drm/radeon/si_dpm.c -+++ b/drivers/gpu/drm/radeon/si_dpm.c -@@ -2926,9 +2926,12 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = { - /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ - { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 }, - { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 }, -+ { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0x2015, 0, 120000 }, - { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 }, - { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 }, - { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 }, -+ { PCI_VENDOR_ID_ATI, 0x6811, 0x148c, 0x2015, 0, 120000 }, -+ { PCI_VENDOR_ID_ATI, 0x6810, 0x1682, 0x9275, 0, 120000 }, - { 0, 0, 0, 0 }, - }; - -@@ -3008,6 +3011,10 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, - } - ++p; - } -+ /* limit mclk on all R7 370 parts for stability */ -+ if (rdev->pdev->device == 0x6811 && -+ rdev->pdev->revision == 0x81) -+ max_mclk = 120000; - - if (rps->vce_active) { - rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk; -diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c -index 4cbf26555093..e3daafa1be13 100644 ---- a/drivers/gpu/drm/ttm/ttm_bo.c -+++ b/drivers/gpu/drm/ttm/ttm_bo.c -@@ -230,22 +230,13 @@ EXPORT_SYMBOL(ttm_bo_del_sub_from_lru); - - void ttm_bo_move_to_lru_tail(struct ttm_buffer_object *bo) - { -- struct ttm_bo_device *bdev = bo->bdev; -- struct ttm_mem_type_manager *man; -+ int put_count = 0; - - lockdep_assert_held(&bo->resv->lock.base); - -- if (bo->mem.placement & TTM_PL_FLAG_NO_EVICT) { -- list_del_init(&bo->swap); -- list_del_init(&bo->lru); -- -- } else { -- if (bo->ttm && !(bo->ttm->page_flags & TTM_PAGE_FLAG_SG)) -- list_move_tail(&bo->swap, &bo->glob->swap_lru); -- -- man = &bdev->man[bo->mem.mem_type]; -- list_move_tail(&bo->lru, &man->lru); -- } -+ put_count = ttm_bo_del_from_lru(bo); -+ ttm_bo_list_ref_sub(bo, put_count, true); -+ ttm_bo_add_to_lru(bo); - } - EXPORT_SYMBOL(ttm_bo_move_to_lru_tail); - -diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c -index 200419d4d43c..18a2acbccb7d 100644 ---- a/drivers/gpu/drm/udl/udl_fb.c -+++ b/drivers/gpu/drm/udl/udl_fb.c -@@ -538,7 +538,7 @@ static int udlfb_create(struct drm_fb_helper *helper, - out_destroy_fbi: - drm_fb_helper_release_fbi(helper); - out_gfree: -- drm_gem_object_unreference(&ufbdev->ufb.obj->base); -+ drm_gem_object_unreference_unlocked(&ufbdev->ufb.obj->base); - out: - return ret; - } -diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c -index 2a0a784ab6ee..d7528e0d8442 100644 ---- a/drivers/gpu/drm/udl/udl_gem.c -+++ b/drivers/gpu/drm/udl/udl_gem.c -@@ -52,7 +52,7 @@ udl_gem_create(struct drm_file *file, - return ret; - } - -- drm_gem_object_unreference(&obj->base); -+ drm_gem_object_unreference_unlocked(&obj->base); - *handle_p = handle; - return 0; - } -diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c -index 22278bcfc60e..ac8eafea6361 100644 ---- a/drivers/gpu/drm/vc4/vc4_bo.c -+++ b/drivers/gpu/drm/vc4/vc4_bo.c -@@ -499,11 +499,12 @@ vc4_create_shader_bo_ioctl(struct drm_device *dev, void *data, - if (IS_ERR(bo)) - return PTR_ERR(bo); - -- ret = copy_from_user(bo->base.vaddr, -+ if (copy_from_user(bo->base.vaddr, - (void __user *)(uintptr_t)args->data, -- args->size); -- if (ret != 0) -+ args->size)) { -+ ret = -EFAULT; - goto fail; -+ } - /* Clear the rest of the memory from allocating from the BO - * cache. - */ -diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c -index e00db3f510dd..abb98c77bad2 100644 ---- a/drivers/gpu/ipu-v3/ipu-common.c -+++ b/drivers/gpu/ipu-v3/ipu-common.c -@@ -1068,7 +1068,6 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base) - goto err_register; - } - -- pdev->dev.of_node = of_node; - pdev->dev.parent = dev; - - ret = platform_device_add_data(pdev, ®->pdata, -@@ -1079,6 +1078,12 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base) - platform_device_put(pdev); - goto err_register; - } -+ -+ /* -+ * Set of_node only after calling platform_device_add. Otherwise -+ * the platform:imx-ipuv3-crtc modalias won't be used. -+ */ -+ pdev->dev.of_node = of_node; - } - - return 0; -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 7e89288b1537..99446ffd71fb 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -1891,6 +1891,7 @@ static const struct hid_device_id hid_have_special_driver[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_ELITE_KBD) }, - { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500) }, - { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_EXTREME_3D) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DUAL_ACTION) }, - { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WHEEL) }, - { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD_CORD) }, - { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD) }, -@@ -2615,9 +2616,10 @@ int hid_add_device(struct hid_device *hdev) - /* - * Scan generic devices for group information - */ -- if (hid_ignore_special_drivers || -- (!hdev->group && -- !hid_match_id(hdev, hid_have_special_driver))) { -+ if (hid_ignore_special_drivers) { -+ hdev->group = HID_GROUP_GENERIC; -+ } else if (!hdev->group && -+ !hid_match_id(hdev, hid_have_special_driver)) { - ret = hid_scan_report(hdev); - if (ret) - hid_warn(hdev, "bad device descriptor (%d)\n", ret); -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index b6ff6e78ac54..14c14c82795c 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -255,6 +255,7 @@ - #define USB_DEVICE_ID_CORSAIR_K90 0x1b02 - - #define USB_VENDOR_ID_CREATIVELABS 0x041e -+#define USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51 0x322c - #define USB_DEVICE_ID_PRODIKEYS_PCMIDI 0x2801 - - #define USB_VENDOR_ID_CVTOUCH 0x1ff7 -diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index 296d4991560e..a20fc604ffd8 100644 ---- a/drivers/hid/hid-multitouch.c -+++ b/drivers/hid/hid-multitouch.c -@@ -396,6 +396,11 @@ static void mt_feature_mapping(struct hid_device *hdev, - td->is_buttonpad = true; - - break; -+ case 0xff0000c5: -+ /* Retrieve the Win8 blob once to enable some devices */ -+ if (usage->usage_index == 0) -+ mt_get_feature(hdev, field->report); -+ break; - } - } - -diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c -index b9216938a718..bb897497f008 100644 ---- a/drivers/hid/i2c-hid/i2c-hid.c -+++ b/drivers/hid/i2c-hid/i2c-hid.c -@@ -283,17 +283,21 @@ static int i2c_hid_set_or_send_report(struct i2c_client *client, u8 reportType, - u16 dataRegister = le16_to_cpu(ihid->hdesc.wDataRegister); - u16 outputRegister = le16_to_cpu(ihid->hdesc.wOutputRegister); - u16 maxOutputLength = le16_to_cpu(ihid->hdesc.wMaxOutputLength); -+ u16 size; -+ int args_len; -+ int index = 0; -+ -+ i2c_hid_dbg(ihid, "%s\n", __func__); -+ -+ if (data_len > ihid->bufsize) -+ return -EINVAL; - -- /* hid_hw_* already checked that data_len < HID_MAX_BUFFER_SIZE */ -- u16 size = 2 /* size */ + -+ size = 2 /* size */ + - (reportID ? 1 : 0) /* reportID */ + - data_len /* buf */; -- int args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ + -+ args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ + - 2 /* dataRegister */ + - size /* args */; -- int index = 0; -- -- i2c_hid_dbg(ihid, "%s\n", __func__); - - if (!use_data && maxOutputLength == 0) - return -ENOSYS; -diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c -index ad71160b9ea4..ae83af649a60 100644 ---- a/drivers/hid/usbhid/hid-core.c -+++ b/drivers/hid/usbhid/hid-core.c -@@ -951,14 +951,6 @@ static int usbhid_output_report(struct hid_device *hid, __u8 *buf, size_t count) - return ret; - } - --static void usbhid_restart_queues(struct usbhid_device *usbhid) --{ -- if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) -- usbhid_restart_out_queue(usbhid); -- if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) -- usbhid_restart_ctrl_queue(usbhid); --} -- - static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid) - { - struct usbhid_device *usbhid = hid->driver_data; -@@ -1404,6 +1396,37 @@ static void hid_cease_io(struct usbhid_device *usbhid) - usb_kill_urb(usbhid->urbout); - } - -+static void hid_restart_io(struct hid_device *hid) -+{ -+ struct usbhid_device *usbhid = hid->driver_data; -+ int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl); -+ int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl); -+ -+ spin_lock_irq(&usbhid->lock); -+ clear_bit(HID_SUSPENDED, &usbhid->iofl); -+ usbhid_mark_busy(usbhid); -+ -+ if (clear_halt || reset_pending) -+ schedule_work(&usbhid->reset_work); -+ usbhid->retry_delay = 0; -+ spin_unlock_irq(&usbhid->lock); -+ -+ if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl)) -+ return; -+ -+ if (!clear_halt) { -+ if (hid_start_in(hid) < 0) -+ hid_io_error(hid); -+ } -+ -+ spin_lock_irq(&usbhid->lock); -+ if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) -+ usbhid_restart_out_queue(usbhid); -+ if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) -+ usbhid_restart_ctrl_queue(usbhid); -+ spin_unlock_irq(&usbhid->lock); -+} -+ - /* Treat USB reset pretty much the same as suspend/resume */ - static int hid_pre_reset(struct usb_interface *intf) - { -@@ -1453,14 +1476,14 @@ static int hid_post_reset(struct usb_interface *intf) - return 1; - } - -+ /* No need to do another reset or clear a halted endpoint */ - spin_lock_irq(&usbhid->lock); - clear_bit(HID_RESET_PENDING, &usbhid->iofl); -+ clear_bit(HID_CLEAR_HALT, &usbhid->iofl); - spin_unlock_irq(&usbhid->lock); - hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0); -- status = hid_start_in(hid); -- if (status < 0) -- hid_io_error(hid); -- usbhid_restart_queues(usbhid); -+ -+ hid_restart_io(hid); - - return 0; - } -@@ -1483,25 +1506,9 @@ void usbhid_put_power(struct hid_device *hid) - #ifdef CONFIG_PM - static int hid_resume_common(struct hid_device *hid, bool driver_suspended) - { -- struct usbhid_device *usbhid = hid->driver_data; -- int status; -- -- spin_lock_irq(&usbhid->lock); -- clear_bit(HID_SUSPENDED, &usbhid->iofl); -- usbhid_mark_busy(usbhid); -- -- if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) || -- test_bit(HID_RESET_PENDING, &usbhid->iofl)) -- schedule_work(&usbhid->reset_work); -- usbhid->retry_delay = 0; -- -- usbhid_restart_queues(usbhid); -- spin_unlock_irq(&usbhid->lock); -- -- status = hid_start_in(hid); -- if (status < 0) -- hid_io_error(hid); -+ int status = 0; - -+ hid_restart_io(hid); - if (driver_suspended && hid->driver && hid->driver->resume) - status = hid->driver->resume(hid); - return status; -@@ -1570,12 +1577,8 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message) - static int hid_resume(struct usb_interface *intf) - { - struct hid_device *hid = usb_get_intfdata (intf); -- struct usbhid_device *usbhid = hid->driver_data; - int status; - -- if (!test_bit(HID_STARTED, &usbhid->iofl)) -- return 0; -- - status = hid_resume_common(hid, true); - dev_dbg(&intf->dev, "resume status %d\n", status); - return 0; -@@ -1584,10 +1587,8 @@ static int hid_resume(struct usb_interface *intf) - static int hid_reset_resume(struct usb_interface *intf) - { - struct hid_device *hid = usb_get_intfdata(intf); -- struct usbhid_device *usbhid = hid->driver_data; - int status; - -- clear_bit(HID_SUSPENDED, &usbhid->iofl); - status = hid_post_reset(intf); - if (status >= 0 && hid->driver && hid->driver->reset_resume) { - int ret = hid->driver->reset_resume(hid); -diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c -index 7dd0953cd70f..dc8e6adf95a4 100644 ---- a/drivers/hid/usbhid/hid-quirks.c -+++ b/drivers/hid/usbhid/hid-quirks.c -@@ -70,6 +70,7 @@ static const struct hid_blacklist { - { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL }, -+ { USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT }, - { USB_VENDOR_ID_ELAN, HID_ANY_ID, HID_QUIRK_ALWAYS_POLL }, -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index 99ef77fcfb80..f71187aad0d0 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -2409,6 +2409,17 @@ void wacom_setup_device_quirks(struct wacom *wacom) - } - - /* -+ * Hack for the Bamboo One: -+ * the device presents a PAD/Touch interface as most Bamboos and even -+ * sends ghosts PAD data on it. However, later, we must disable this -+ * ghost interface, and we can not detect it unless we set it here -+ * to WACOM_DEVICETYPE_PAD or WACOM_DEVICETYPE_TOUCH. -+ */ -+ if (features->type == BAMBOO_PEN && -+ features->pktlen == WACOM_PKGLEN_BBTOUCH3) -+ features->device_type |= WACOM_DEVICETYPE_PAD; -+ -+ /* - * Raw Wacom-mode pen and touch events both come from interface - * 0, whose HID descriptor has an application usage of 0xFF0D - * (i.e., WACOM_VENDORDEFINED_PEN). We route pen packets back -@@ -3367,6 +3378,10 @@ static const struct wacom_features wacom_features_0x33E = - { "Wacom Intuos PT M 2", 21600, 13500, 2047, 63, - INTUOSHT2, WACOM_INTUOS_RES, WACOM_INTUOS_RES, .touch_max = 16, - .check_for_hid_type = true, .hid_type = HID_TYPE_USBNONE }; -+static const struct wacom_features wacom_features_0x343 = -+ { "Wacom DTK1651", 34616, 19559, 1023, 0, -+ DTUS, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4, -+ WACOM_DTU_OFFSET, WACOM_DTU_OFFSET }; - - static const struct wacom_features wacom_features_HID_ANY_ID = - { "Wacom HID", .type = HID_GENERIC }; -@@ -3532,6 +3547,7 @@ const struct hid_device_id wacom_ids[] = { - { USB_DEVICE_WACOM(0x33C) }, - { USB_DEVICE_WACOM(0x33D) }, - { USB_DEVICE_WACOM(0x33E) }, -+ { USB_DEVICE_WACOM(0x343) }, - { USB_DEVICE_WACOM(0x4001) }, - { USB_DEVICE_WACOM(0x4004) }, - { USB_DEVICE_WACOM(0x5000) }, -diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c -index b53702ce692f..e35560b955b1 100644 ---- a/drivers/hv/ring_buffer.c -+++ b/drivers/hv/ring_buffer.c -@@ -103,15 +103,29 @@ static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi) - * there is room for the producer to send the pending packet. - */ - --static bool hv_need_to_signal_on_read(u32 prev_write_sz, -- struct hv_ring_buffer_info *rbi) -+static bool hv_need_to_signal_on_read(struct hv_ring_buffer_info *rbi) - { - u32 cur_write_sz; - u32 r_size; -- u32 write_loc = rbi->ring_buffer->write_index; -+ u32 write_loc; - u32 read_loc = rbi->ring_buffer->read_index; -- u32 pending_sz = rbi->ring_buffer->pending_send_sz; -+ u32 pending_sz; - -+ /* -+ * Issue a full memory barrier before making the signaling decision. -+ * Here is the reason for having this barrier: -+ * If the reading of the pend_sz (in this function) -+ * were to be reordered and read before we commit the new read -+ * index (in the calling function) we could -+ * have a problem. If the host were to set the pending_sz after we -+ * have sampled pending_sz and go to sleep before we commit the -+ * read index, we could miss sending the interrupt. Issue a full -+ * memory barrier to address this. -+ */ -+ mb(); -+ -+ pending_sz = rbi->ring_buffer->pending_send_sz; -+ write_loc = rbi->ring_buffer->write_index; - /* If the other end is not blocked on write don't bother. */ - if (pending_sz == 0) - return false; -@@ -120,7 +134,7 @@ static bool hv_need_to_signal_on_read(u32 prev_write_sz, - cur_write_sz = write_loc >= read_loc ? r_size - (write_loc - read_loc) : - read_loc - write_loc; - -- if ((prev_write_sz < pending_sz) && (cur_write_sz >= pending_sz)) -+ if (cur_write_sz >= pending_sz) - return true; - - return false; -@@ -458,7 +472,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, - /* Update the read index */ - hv_set_next_read_location(inring_info, next_read_location); - -- *signal = hv_need_to_signal_on_read(bytes_avail_towrite, inring_info); -+ *signal = hv_need_to_signal_on_read(inring_info); - - out_unlock: - spin_unlock_irqrestore(&inring_info->ring_lock, flags); -diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c -index 36544c4f653c..303d0c9df907 100644 ---- a/drivers/hwmon/max1111.c -+++ b/drivers/hwmon/max1111.c -@@ -85,6 +85,9 @@ static struct max1111_data *the_max1111; - - int max1111_read_channel(int channel) - { -+ if (!the_max1111 || !the_max1111->spi) -+ return -ENODEV; -+ - return max1111_read(&the_max1111->spi->dev, channel); - } - EXPORT_SYMBOL(max1111_read_channel); -@@ -258,6 +261,9 @@ static int max1111_remove(struct spi_device *spi) - { - struct max1111_data *data = spi_get_drvdata(spi); - -+#ifdef CONFIG_SHARPSL_PM -+ the_max1111 = NULL; -+#endif - hwmon_device_unregister(data->hwmon_dev); - sysfs_remove_group(&spi->dev.kobj, &max1110_attr_group); - sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group); -diff --git a/drivers/hwtracing/stm/Kconfig b/drivers/hwtracing/stm/Kconfig -index 83e9f591a54b..e7a348807f0c 100644 ---- a/drivers/hwtracing/stm/Kconfig -+++ b/drivers/hwtracing/stm/Kconfig -@@ -1,6 +1,7 @@ - config STM - tristate "System Trace Module devices" - select CONFIGFS_FS -+ select SRCU - help - A System Trace Module (STM) is a device exporting data in System - Trace Protocol (STP) format as defined by MIPI STP standards. -diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c -index 714bdc837769..b167ab25310a 100644 ---- a/drivers/i2c/busses/i2c-cpm.c -+++ b/drivers/i2c/busses/i2c-cpm.c -@@ -116,8 +116,8 @@ struct cpm_i2c { - cbd_t __iomem *rbase; - u_char *txbuf[CPM_MAXBD]; - u_char *rxbuf[CPM_MAXBD]; -- u32 txdma[CPM_MAXBD]; -- u32 rxdma[CPM_MAXBD]; -+ dma_addr_t txdma[CPM_MAXBD]; -+ dma_addr_t rxdma[CPM_MAXBD]; - }; - - static irqreturn_t cpm_i2c_interrupt(int irq, void *dev_id) -diff --git a/drivers/i2c/busses/i2c-exynos5.c b/drivers/i2c/busses/i2c-exynos5.c -index b29c7500461a..f54ece8fce78 100644 ---- a/drivers/i2c/busses/i2c-exynos5.c -+++ b/drivers/i2c/busses/i2c-exynos5.c -@@ -671,7 +671,9 @@ static int exynos5_i2c_xfer(struct i2c_adapter *adap, - return -EIO; - } - -- clk_prepare_enable(i2c->clk); -+ ret = clk_enable(i2c->clk); -+ if (ret) -+ return ret; - - for (i = 0; i < num; i++, msgs++) { - stop = (i == num - 1); -@@ -695,7 +697,7 @@ static int exynos5_i2c_xfer(struct i2c_adapter *adap, - } - - out: -- clk_disable_unprepare(i2c->clk); -+ clk_disable(i2c->clk); - return ret; - } - -@@ -747,7 +749,9 @@ static int exynos5_i2c_probe(struct platform_device *pdev) - return -ENOENT; - } - -- clk_prepare_enable(i2c->clk); -+ ret = clk_prepare_enable(i2c->clk); -+ if (ret) -+ return ret; - - mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); - i2c->regs = devm_ioremap_resource(&pdev->dev, mem); -@@ -799,6 +803,10 @@ static int exynos5_i2c_probe(struct platform_device *pdev) - - platform_set_drvdata(pdev, i2c); - -+ clk_disable(i2c->clk); -+ -+ return 0; -+ - err_clk: - clk_disable_unprepare(i2c->clk); - return ret; -@@ -810,6 +818,8 @@ static int exynos5_i2c_remove(struct platform_device *pdev) - - i2c_del_adapter(&i2c->adap); - -+ clk_unprepare(i2c->clk); -+ - return 0; - } - -@@ -821,6 +831,8 @@ static int exynos5_i2c_suspend_noirq(struct device *dev) - - i2c->suspended = 1; - -+ clk_unprepare(i2c->clk); -+ - return 0; - } - -@@ -830,7 +842,9 @@ static int exynos5_i2c_resume_noirq(struct device *dev) - struct exynos5_i2c *i2c = platform_get_drvdata(pdev); - int ret = 0; - -- clk_prepare_enable(i2c->clk); -+ ret = clk_prepare_enable(i2c->clk); -+ if (ret) -+ return ret; - - ret = exynos5_hsi2c_clock_setup(i2c); - if (ret) { -@@ -839,7 +853,7 @@ static int exynos5_i2c_resume_noirq(struct device *dev) - } - - exynos5_i2c_init(i2c); -- clk_disable_unprepare(i2c->clk); -+ clk_disable(i2c->clk); - i2c->suspended = 0; - - return 0; -diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c -index cd4510a63375..146eed70bdf4 100644 ---- a/drivers/idle/intel_idle.c -+++ b/drivers/idle/intel_idle.c -@@ -65,7 +65,7 @@ - #include - #include - --#define INTEL_IDLE_VERSION "0.4" -+#define INTEL_IDLE_VERSION "0.4.1" - #define PREFIX "intel_idle: " - - static struct cpuidle_driver intel_idle_driver = { -@@ -994,36 +994,92 @@ static void intel_idle_cpuidle_devices_uninit(void) - } - - /* -- * intel_idle_state_table_update() -- * -- * Update the default state_table for this CPU-id -+ * ivt_idle_state_table_update(void) - * -- * Currently used to access tuned IVT multi-socket targets -+ * Tune IVT multi-socket targets - * Assumption: num_sockets == (max_package_num + 1) - */ --void intel_idle_state_table_update(void) -+static void ivt_idle_state_table_update(void) - { - /* IVT uses a different table for 1-2, 3-4, and > 4 sockets */ -- if (boot_cpu_data.x86_model == 0x3e) { /* IVT */ -- int cpu, package_num, num_sockets = 1; -- -- for_each_online_cpu(cpu) { -- package_num = topology_physical_package_id(cpu); -- if (package_num + 1 > num_sockets) { -- num_sockets = package_num + 1; -- -- if (num_sockets > 4) { -- cpuidle_state_table = ivt_cstates_8s; -- return; -- } -+ int cpu, package_num, num_sockets = 1; -+ -+ for_each_online_cpu(cpu) { -+ package_num = topology_physical_package_id(cpu); -+ if (package_num + 1 > num_sockets) { -+ num_sockets = package_num + 1; -+ -+ if (num_sockets > 4) { -+ cpuidle_state_table = ivt_cstates_8s; -+ return; - } - } -+ } -+ -+ if (num_sockets > 2) -+ cpuidle_state_table = ivt_cstates_4s; -+ -+ /* else, 1 and 2 socket systems use default ivt_cstates */ -+} -+/* -+ * sklh_idle_state_table_update(void) -+ * -+ * On SKL-H (model 0x5e) disable C8 and C9 if: -+ * C10 is enabled and SGX disabled -+ */ -+static void sklh_idle_state_table_update(void) -+{ -+ unsigned long long msr; -+ unsigned int eax, ebx, ecx, edx; -+ -+ -+ /* if PC10 disabled via cmdline intel_idle.max_cstate=7 or shallower */ -+ if (max_cstate <= 7) -+ return; -+ -+ /* if PC10 not present in CPUID.MWAIT.EDX */ -+ if ((mwait_substates & (0xF << 28)) == 0) -+ return; -+ -+ rdmsrl(MSR_NHM_SNB_PKG_CST_CFG_CTL, msr); -+ -+ /* PC10 is not enabled in PKG C-state limit */ -+ if ((msr & 0xF) != 8) -+ return; -+ -+ ecx = 0; -+ cpuid(7, &eax, &ebx, &ecx, &edx); -+ -+ /* if SGX is present */ -+ if (ebx & (1 << 2)) { - -- if (num_sockets > 2) -- cpuidle_state_table = ivt_cstates_4s; -- /* else, 1 and 2 socket systems use default ivt_cstates */ -+ rdmsrl(MSR_IA32_FEATURE_CONTROL, msr); -+ -+ /* if SGX is enabled */ -+ if (msr & (1 << 18)) -+ return; -+ } -+ -+ skl_cstates[5].disabled = 1; /* C8-SKL */ -+ skl_cstates[6].disabled = 1; /* C9-SKL */ -+} -+/* -+ * intel_idle_state_table_update() -+ * -+ * Update the default state_table for this CPU-id -+ */ -+ -+static void intel_idle_state_table_update(void) -+{ -+ switch (boot_cpu_data.x86_model) { -+ -+ case 0x3e: /* IVT */ -+ ivt_idle_state_table_update(); -+ break; -+ case 0x5e: /* SKL-H */ -+ sklh_idle_state_table_update(); -+ break; - } -- return; - } - - /* -@@ -1063,6 +1119,14 @@ static int __init intel_idle_cpuidle_driver_init(void) - if (num_substates == 0) - continue; - -+ /* if state marked as disabled, skip it */ -+ if (cpuidle_state_table[cstate].disabled != 0) { -+ pr_debug(PREFIX "state %s is disabled", -+ cpuidle_state_table[cstate].name); -+ continue; -+ } -+ -+ - if (((mwait_cstate + 1) > 2) && - !boot_cpu_has(X86_FEATURE_NONSTOP_TSC)) - mark_tsc_unstable("TSC halts in idle" -diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c -index c73331f7782b..2072a31e813b 100644 ---- a/drivers/iio/accel/bmc150-accel-core.c -+++ b/drivers/iio/accel/bmc150-accel-core.c -@@ -547,7 +547,7 @@ static int bmc150_accel_get_axis(struct bmc150_accel_data *data, - { - int ret; - int axis = chan->scan_index; -- unsigned int raw_val; -+ __le16 raw_val; - - mutex_lock(&data->mutex); - ret = bmc150_accel_set_power_state(data, true); -@@ -557,14 +557,14 @@ static int bmc150_accel_get_axis(struct bmc150_accel_data *data, - } - - ret = regmap_bulk_read(data->regmap, BMC150_ACCEL_AXIS_TO_REG(axis), -- &raw_val, 2); -+ &raw_val, sizeof(raw_val)); - if (ret < 0) { - dev_err(data->dev, "Error reading axis %d\n", axis); - bmc150_accel_set_power_state(data, false); - mutex_unlock(&data->mutex); - return ret; - } -- *val = sign_extend32(raw_val >> chan->scan_type.shift, -+ *val = sign_extend32(le16_to_cpu(raw_val) >> chan->scan_type.shift, - chan->scan_type.realbits - 1); - ret = bmc150_accel_set_power_state(data, false); - mutex_unlock(&data->mutex); -@@ -988,6 +988,7 @@ static const struct iio_event_spec bmc150_accel_event = { - .realbits = (bits), \ - .storagebits = 16, \ - .shift = 16 - (bits), \ -+ .endianness = IIO_LE, \ - }, \ - .event_spec = &bmc150_accel_event, \ - .num_event_specs = 1 \ -diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c -index bbce3b09ac45..4dac567e75b4 100644 ---- a/drivers/iio/gyro/bmg160_core.c -+++ b/drivers/iio/gyro/bmg160_core.c -@@ -452,7 +452,7 @@ static int bmg160_get_temp(struct bmg160_data *data, int *val) - static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val) - { - int ret; -- unsigned int raw_val; -+ __le16 raw_val; - - mutex_lock(&data->mutex); - ret = bmg160_set_power_state(data, true); -@@ -462,7 +462,7 @@ static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val) - } - - ret = regmap_bulk_read(data->regmap, BMG160_AXIS_TO_REG(axis), &raw_val, -- 2); -+ sizeof(raw_val)); - if (ret < 0) { - dev_err(data->dev, "Error reading axis %d\n", axis); - bmg160_set_power_state(data, false); -@@ -470,7 +470,7 @@ static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val) - return ret; - } - -- *val = sign_extend32(raw_val, 15); -+ *val = sign_extend32(le16_to_cpu(raw_val), 15); - ret = bmg160_set_power_state(data, false); - mutex_unlock(&data->mutex); - if (ret < 0) -@@ -733,6 +733,7 @@ static const struct iio_event_spec bmg160_event = { - .sign = 's', \ - .realbits = 16, \ - .storagebits = 16, \ -+ .endianness = IIO_LE, \ - }, \ - .event_spec = &bmg160_event, \ - .num_event_specs = 1 \ -@@ -780,7 +781,7 @@ static irqreturn_t bmg160_trigger_handler(int irq, void *p) - mutex_unlock(&data->mutex); - goto err; - } -- data->buffer[i++] = ret; -+ data->buffer[i++] = val; - } - mutex_unlock(&data->mutex); - -diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c -index 139ae916225f..5b6abc541e8c 100644 ---- a/drivers/iio/industrialio-buffer.c -+++ b/drivers/iio/industrialio-buffer.c -@@ -645,6 +645,7 @@ static int iio_verify_update(struct iio_dev *indio_dev, - unsigned int modes; - - memset(config, 0, sizeof(*config)); -+ config->watermark = ~0; - - /* - * If there is just one buffer and we are removing it there is nothing -diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c -index b13936dacc78..f2a7f72f7aa6 100644 ---- a/drivers/iio/magnetometer/ak8975.c -+++ b/drivers/iio/magnetometer/ak8975.c -@@ -462,6 +462,8 @@ static int ak8975_setup_irq(struct ak8975_data *data) - int rc; - int irq; - -+ init_waitqueue_head(&data->data_ready_queue); -+ clear_bit(0, &data->flags); - if (client->irq) - irq = client->irq; - else -@@ -477,8 +479,6 @@ static int ak8975_setup_irq(struct ak8975_data *data) - return rc; - } - -- init_waitqueue_head(&data->data_ready_queue); -- clear_bit(0, &data->flags); - data->eoc_irq = irq; - - return rc; -@@ -732,7 +732,7 @@ static int ak8975_probe(struct i2c_client *client, - int eoc_gpio; - int err; - const char *name = NULL; -- enum asahi_compass_chipset chipset; -+ enum asahi_compass_chipset chipset = AK_MAX_TYPE; - - /* Grab and set up the supplied GPIO. */ - if (client->dev.platform_data) -diff --git a/drivers/iio/magnetometer/st_magn.h b/drivers/iio/magnetometer/st_magn.h -index 06a4d9c35581..9daca4681922 100644 ---- a/drivers/iio/magnetometer/st_magn.h -+++ b/drivers/iio/magnetometer/st_magn.h -@@ -44,6 +44,7 @@ static inline int st_magn_allocate_ring(struct iio_dev *indio_dev) - static inline void st_magn_deallocate_ring(struct iio_dev *indio_dev) - { - } -+#define ST_MAGN_TRIGGER_SET_STATE NULL - #endif /* CONFIG_IIO_BUFFER */ - - #endif /* ST_MAGN_H */ -diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c -index 53343ffbff7a..1b109b2a235e 100644 ---- a/drivers/infiniband/core/cache.c -+++ b/drivers/infiniband/core/cache.c -@@ -691,7 +691,8 @@ void ib_cache_gid_set_default_gid(struct ib_device *ib_dev, u8 port, - NULL); - - /* Coudn't find default GID location */ -- WARN_ON(ix < 0); -+ if (WARN_ON(ix < 0)) -+ goto release; - - zattr_type.gid_type = gid_type; - -diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c -index 6b4e8a008bc0..564adf3116e8 100644 ---- a/drivers/infiniband/core/ucm.c -+++ b/drivers/infiniband/core/ucm.c -@@ -48,6 +48,7 @@ - - #include - -+#include - #include - #include - #include -@@ -1103,6 +1104,9 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf, - struct ib_ucm_cmd_hdr hdr; - ssize_t result; - -+ if (WARN_ON_ONCE(!ib_safe_file_access(filp))) -+ return -EACCES; -+ - if (len < sizeof(hdr)) - return -EINVAL; - -diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c -index 8b5a934e1133..886f61ea6cc7 100644 ---- a/drivers/infiniband/core/ucma.c -+++ b/drivers/infiniband/core/ucma.c -@@ -1574,6 +1574,9 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf, - struct rdma_ucm_cmd_hdr hdr; - ssize_t ret; - -+ if (WARN_ON_ONCE(!ib_safe_file_access(filp))) -+ return -EACCES; -+ - if (len < sizeof(hdr)) - return -EINVAL; - -diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c -index 39680aed99dd..d3fb8aa46c59 100644 ---- a/drivers/infiniband/core/uverbs_main.c -+++ b/drivers/infiniband/core/uverbs_main.c -@@ -48,6 +48,8 @@ - - #include - -+#include -+ - #include "uverbs.h" - - MODULE_AUTHOR("Roland Dreier"); -@@ -693,6 +695,9 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, - int srcu_key; - ssize_t ret; - -+ if (WARN_ON_ONCE(!ib_safe_file_access(filp))) -+ return -EACCES; -+ - if (count < sizeof hdr) - return -EINVAL; - -diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c -index cf21df4a8bf5..4e94cff5ba71 100644 ---- a/drivers/infiniband/hw/cxgb4/cq.c -+++ b/drivers/infiniband/hw/cxgb4/cq.c -@@ -162,7 +162,7 @@ static int create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq, - cq->bar2_va = c4iw_bar2_addrs(rdev, cq->cqid, T4_BAR2_QTYPE_INGRESS, - &cq->bar2_qid, - user ? &cq->bar2_pa : NULL); -- if (user && !cq->bar2_va) { -+ if (user && !cq->bar2_pa) { - pr_warn(MOD "%s: cqid %u not in BAR2 range.\n", - pci_name(rdev->lldi.pdev), cq->cqid); - ret = -EINVAL; -diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c -index e99345eb875a..8ff690bf09d9 100644 ---- a/drivers/infiniband/hw/cxgb4/qp.c -+++ b/drivers/infiniband/hw/cxgb4/qp.c -@@ -185,6 +185,10 @@ void __iomem *c4iw_bar2_addrs(struct c4iw_rdev *rdev, unsigned int qid, - - if (pbar2_pa) - *pbar2_pa = (rdev->bar2_pa + bar2_qoffset) & PAGE_MASK; -+ -+ if (is_t4(rdev->lldi.adapter_type)) -+ return NULL; -+ - return rdev->bar2_kva + bar2_qoffset; - } - -@@ -270,7 +274,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq, - /* - * User mode must have bar2 access. - */ -- if (user && (!wq->sq.bar2_va || !wq->rq.bar2_va)) { -+ if (user && (!wq->sq.bar2_pa || !wq->rq.bar2_pa)) { - pr_warn(MOD "%s: sqid %u or rqid %u not in BAR2 range.\n", - pci_name(rdev->lldi.pdev), wq->sq.qid, wq->rq.qid); - goto free_dma; -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index 03c418ccbc98..eaed31d04468 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -517,7 +517,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev, - sizeof(struct mlx5_wqe_ctrl_seg)) / - sizeof(struct mlx5_wqe_data_seg); - props->max_sge = min(max_rq_sg, max_sq_sg); -- props->max_sge_rd = props->max_sge; -+ props->max_sge_rd = MLX5_MAX_SGE_RD; - props->max_cq = 1 << MLX5_CAP_GEN(mdev, log_max_cq); - props->max_cqe = (1 << MLX5_CAP_GEN(mdev, log_max_cq_sz)) - 1; - props->max_mr = 1 << MLX5_CAP_GEN(mdev, log_max_mkey); -@@ -654,8 +654,8 @@ static int mlx5_query_hca_port(struct ib_device *ibdev, u8 port, - struct mlx5_ib_dev *dev = to_mdev(ibdev); - struct mlx5_core_dev *mdev = dev->mdev; - struct mlx5_hca_vport_context *rep; -- int max_mtu; -- int oper_mtu; -+ u16 max_mtu; -+ u16 oper_mtu; - int err; - u8 ib_link_width_oper; - u8 vl_hw_cap; -diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c -index e449e394963f..24f4a782e0f4 100644 ---- a/drivers/infiniband/hw/qib/qib_file_ops.c -+++ b/drivers/infiniband/hw/qib/qib_file_ops.c -@@ -45,6 +45,8 @@ - #include - #include - -+#include -+ - #include "qib.h" - #include "qib_common.h" - #include "qib_user_sdma.h" -@@ -2067,6 +2069,9 @@ static ssize_t qib_write(struct file *fp, const char __user *data, - ssize_t ret = 0; - void *dest; - -+ if (WARN_ON_ONCE(!ib_safe_file_access(fp))) -+ return -EACCES; -+ - if (count < sizeof(cmd.type)) { - ret = -EINVAL; - goto bail; -diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c -index f121e6129339..0e1a802c3618 100644 ---- a/drivers/infiniband/ulp/isert/ib_isert.c -+++ b/drivers/infiniband/ulp/isert/ib_isert.c -@@ -65,6 +65,7 @@ isert_rdma_accept(struct isert_conn *isert_conn); - struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np); - - static void isert_release_work(struct work_struct *work); -+static void isert_wait4flush(struct isert_conn *isert_conn); - - static inline bool - isert_prot_cmd(struct isert_conn *conn, struct se_cmd *cmd) -@@ -820,12 +821,31 @@ isert_put_conn(struct isert_conn *isert_conn) - kref_put(&isert_conn->kref, isert_release_kref); - } - -+static void -+isert_handle_unbound_conn(struct isert_conn *isert_conn) -+{ -+ struct isert_np *isert_np = isert_conn->cm_id->context; -+ -+ mutex_lock(&isert_np->mutex); -+ if (!list_empty(&isert_conn->node)) { -+ /* -+ * This means iscsi doesn't know this connection -+ * so schedule a cleanup ourselves -+ */ -+ list_del_init(&isert_conn->node); -+ isert_put_conn(isert_conn); -+ complete(&isert_conn->wait); -+ queue_work(isert_release_wq, &isert_conn->release_work); -+ } -+ mutex_unlock(&isert_np->mutex); -+} -+ - /** - * isert_conn_terminate() - Initiate connection termination - * @isert_conn: isert connection struct - * - * Notes: -- * In case the connection state is FULL_FEATURE, move state -+ * In case the connection state is BOUND, move state - * to TEMINATING and start teardown sequence (rdma_disconnect). - * In case the connection state is UP, complete flush as well. - * -@@ -837,23 +857,19 @@ isert_conn_terminate(struct isert_conn *isert_conn) - { - int err; - -- switch (isert_conn->state) { -- case ISER_CONN_TERMINATING: -- break; -- case ISER_CONN_UP: -- case ISER_CONN_FULL_FEATURE: /* FALLTHRU */ -- isert_info("Terminating conn %p state %d\n", -- isert_conn, isert_conn->state); -- isert_conn->state = ISER_CONN_TERMINATING; -- err = rdma_disconnect(isert_conn->cm_id); -- if (err) -- isert_warn("Failed rdma_disconnect isert_conn %p\n", -- isert_conn); -- break; -- default: -- isert_warn("conn %p teminating in state %d\n", -- isert_conn, isert_conn->state); -- } -+ if (isert_conn->state >= ISER_CONN_TERMINATING) -+ return; -+ -+ isert_info("Terminating conn %p state %d\n", -+ isert_conn, isert_conn->state); -+ isert_conn->state = ISER_CONN_TERMINATING; -+ err = rdma_disconnect(isert_conn->cm_id); -+ if (err) -+ isert_warn("Failed rdma_disconnect isert_conn %p\n", -+ isert_conn); -+ -+ isert_info("conn %p completing wait\n", isert_conn); -+ complete(&isert_conn->wait); - } - - static int -@@ -887,35 +903,27 @@ static int - isert_disconnected_handler(struct rdma_cm_id *cma_id, - enum rdma_cm_event_type event) - { -- struct isert_np *isert_np = cma_id->context; -- struct isert_conn *isert_conn; -- bool terminating = false; -- -- if (isert_np->cm_id == cma_id) -- return isert_np_cma_handler(cma_id->context, event); -- -- isert_conn = cma_id->qp->qp_context; -+ struct isert_conn *isert_conn = cma_id->qp->qp_context; - - mutex_lock(&isert_conn->mutex); -- terminating = (isert_conn->state == ISER_CONN_TERMINATING); -- isert_conn_terminate(isert_conn); -- mutex_unlock(&isert_conn->mutex); -- -- isert_info("conn %p completing wait\n", isert_conn); -- complete(&isert_conn->wait); -- -- if (terminating) -- goto out; -- -- mutex_lock(&isert_np->mutex); -- if (!list_empty(&isert_conn->node)) { -- list_del_init(&isert_conn->node); -- isert_put_conn(isert_conn); -- queue_work(isert_release_wq, &isert_conn->release_work); -+ switch (isert_conn->state) { -+ case ISER_CONN_TERMINATING: -+ break; -+ case ISER_CONN_UP: -+ isert_conn_terminate(isert_conn); -+ isert_wait4flush(isert_conn); -+ isert_handle_unbound_conn(isert_conn); -+ break; -+ case ISER_CONN_BOUND: -+ case ISER_CONN_FULL_FEATURE: /* FALLTHRU */ -+ iscsit_cause_connection_reinstatement(isert_conn->conn, 0); -+ break; -+ default: -+ isert_warn("conn %p teminating in state %d\n", -+ isert_conn, isert_conn->state); - } -- mutex_unlock(&isert_np->mutex); -+ mutex_unlock(&isert_conn->mutex); - --out: - return 0; - } - -@@ -934,12 +942,16 @@ isert_connect_error(struct rdma_cm_id *cma_id) - static int - isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) - { -+ struct isert_np *isert_np = cma_id->context; - int ret = 0; - - isert_info("%s (%d): status %d id %p np %p\n", - rdma_event_msg(event->event), event->event, - event->status, cma_id, cma_id->context); - -+ if (isert_np->cm_id == cma_id) -+ return isert_np_cma_handler(cma_id->context, event->event); -+ - switch (event->event) { - case RDMA_CM_EVENT_CONNECT_REQUEST: - ret = isert_connect_request(cma_id, event); -@@ -985,13 +997,10 @@ isert_post_recvm(struct isert_conn *isert_conn, u32 count) - rx_wr--; - rx_wr->next = NULL; /* mark end of work requests list */ - -- isert_conn->post_recv_buf_count += count; - ret = ib_post_recv(isert_conn->qp, isert_conn->rx_wr, - &rx_wr_failed); -- if (ret) { -+ if (ret) - isert_err("ib_post_recv() failed with ret: %d\n", ret); -- isert_conn->post_recv_buf_count -= count; -- } - - return ret; - } -@@ -1007,12 +1016,9 @@ isert_post_recv(struct isert_conn *isert_conn, struct iser_rx_desc *rx_desc) - rx_wr.num_sge = 1; - rx_wr.next = NULL; - -- isert_conn->post_recv_buf_count++; - ret = ib_post_recv(isert_conn->qp, &rx_wr, &rx_wr_failed); -- if (ret) { -+ if (ret) - isert_err("ib_post_recv() failed with ret: %d\n", ret); -- isert_conn->post_recv_buf_count--; -- } - - return ret; - } -@@ -1132,12 +1138,9 @@ isert_rdma_post_recvl(struct isert_conn *isert_conn) - rx_wr.sg_list = &sge; - rx_wr.num_sge = 1; - -- isert_conn->post_recv_buf_count++; - ret = ib_post_recv(isert_conn->qp, &rx_wr, &rx_wr_fail); -- if (ret) { -+ if (ret) - isert_err("ib_post_recv() failed: %d\n", ret); -- isert_conn->post_recv_buf_count--; -- } - - return ret; - } -@@ -1633,7 +1636,6 @@ isert_rcv_completion(struct iser_rx_desc *desc, - ib_dma_sync_single_for_device(ib_dev, rx_dma, rx_buflen, - DMA_FROM_DEVICE); - -- isert_conn->post_recv_buf_count--; - } - - static int -@@ -2048,7 +2050,8 @@ is_isert_tx_desc(struct isert_conn *isert_conn, void *wr_id) - void *start = isert_conn->rx_descs; - int len = ISERT_QP_MAX_RECV_DTOS * sizeof(*isert_conn->rx_descs); - -- if (wr_id >= start && wr_id < start + len) -+ if ((wr_id >= start && wr_id < start + len) || -+ (wr_id == isert_conn->login_req_buf)) - return false; - - return true; -@@ -2072,10 +2075,6 @@ isert_cq_comp_err(struct isert_conn *isert_conn, struct ib_wc *wc) - isert_unmap_tx_desc(desc, ib_dev); - else - isert_completion_put(desc, isert_cmd, ib_dev, true); -- } else { -- isert_conn->post_recv_buf_count--; -- if (!isert_conn->post_recv_buf_count) -- iscsit_cause_connection_reinstatement(isert_conn->conn, 0); - } - } - -@@ -3214,6 +3213,7 @@ accept_wait: - - conn->context = isert_conn; - isert_conn->conn = conn; -+ isert_conn->state = ISER_CONN_BOUND; - - isert_set_conn_info(np, conn, isert_conn); - -diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h -index 8d50453eef66..1aa019ab9d78 100644 ---- a/drivers/infiniband/ulp/isert/ib_isert.h -+++ b/drivers/infiniband/ulp/isert/ib_isert.h -@@ -84,6 +84,7 @@ enum iser_ib_op_code { - enum iser_conn_state { - ISER_CONN_INIT, - ISER_CONN_UP, -+ ISER_CONN_BOUND, - ISER_CONN_FULL_FEATURE, - ISER_CONN_TERMINATING, - ISER_CONN_DOWN, -@@ -179,7 +180,6 @@ struct isert_device; - - struct isert_conn { - enum iser_conn_state state; -- int post_recv_buf_count; - u32 responder_resources; - u32 initiator_depth; - bool pi_support; -diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c -index 03022f6420d7..a09841abae50 100644 ---- a/drivers/infiniband/ulp/srp/ib_srp.c -+++ b/drivers/infiniband/ulp/srp/ib_srp.c -@@ -1541,7 +1541,7 @@ static int srp_map_idb(struct srp_rdma_ch *ch, struct srp_request *req, - - if (dev->use_fast_reg) { - state.sg = idb_sg; -- sg_set_buf(idb_sg, req->indirect_desc, idb_len); -+ sg_init_one(idb_sg, req->indirect_desc, idb_len); - idb_sg->dma_address = req->indirect_dma_addr; /* hack! */ - #ifdef CONFIG_NEED_SG_DMA_LENGTH - idb_sg->dma_length = idb_sg->length; /* hack^2 */ -diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c -index 0c37fee363b1..4328679a67a7 100644 ---- a/drivers/infiniband/ulp/srpt/ib_srpt.c -+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c -@@ -1670,47 +1670,6 @@ send_sense: - return -1; - } - --/** -- * srpt_rx_mgmt_fn_tag() - Process a task management function by tag. -- * @ch: RDMA channel of the task management request. -- * @fn: Task management function to perform. -- * @req_tag: Tag of the SRP task management request. -- * @mgmt_ioctx: I/O context of the task management request. -- * -- * Returns zero if the target core will process the task management -- * request asynchronously. -- * -- * Note: It is assumed that the initiator serializes tag-based task management -- * requests. -- */ --static int srpt_rx_mgmt_fn_tag(struct srpt_send_ioctx *ioctx, u64 tag) --{ -- struct srpt_device *sdev; -- struct srpt_rdma_ch *ch; -- struct srpt_send_ioctx *target; -- int ret, i; -- -- ret = -EINVAL; -- ch = ioctx->ch; -- BUG_ON(!ch); -- BUG_ON(!ch->sport); -- sdev = ch->sport->sdev; -- BUG_ON(!sdev); -- spin_lock_irq(&sdev->spinlock); -- for (i = 0; i < ch->rq_size; ++i) { -- target = ch->ioctx_ring[i]; -- if (target->cmd.se_lun == ioctx->cmd.se_lun && -- target->cmd.tag == tag && -- srpt_get_cmd_state(target) != SRPT_STATE_DONE) { -- ret = 0; -- /* now let the target core abort &target->cmd; */ -- break; -- } -- } -- spin_unlock_irq(&sdev->spinlock); -- return ret; --} -- - static int srp_tmr_to_tcm(int fn) - { - switch (fn) { -@@ -1745,7 +1704,6 @@ static void srpt_handle_tsk_mgmt(struct srpt_rdma_ch *ch, - struct se_cmd *cmd; - struct se_session *sess = ch->sess; - uint64_t unpacked_lun; -- uint32_t tag = 0; - int tcm_tmr; - int rc; - -@@ -1761,25 +1719,10 @@ static void srpt_handle_tsk_mgmt(struct srpt_rdma_ch *ch, - srpt_set_cmd_state(send_ioctx, SRPT_STATE_MGMT); - send_ioctx->cmd.tag = srp_tsk->tag; - tcm_tmr = srp_tmr_to_tcm(srp_tsk->tsk_mgmt_func); -- if (tcm_tmr < 0) { -- send_ioctx->cmd.se_tmr_req->response = -- TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED; -- goto fail; -- } - unpacked_lun = srpt_unpack_lun((uint8_t *)&srp_tsk->lun, - sizeof(srp_tsk->lun)); -- -- if (srp_tsk->tsk_mgmt_func == SRP_TSK_ABORT_TASK) { -- rc = srpt_rx_mgmt_fn_tag(send_ioctx, srp_tsk->task_tag); -- if (rc < 0) { -- send_ioctx->cmd.se_tmr_req->response = -- TMR_TASK_DOES_NOT_EXIST; -- goto fail; -- } -- tag = srp_tsk->task_tag; -- } - rc = target_submit_tmr(&send_ioctx->cmd, sess, NULL, unpacked_lun, -- srp_tsk, tcm_tmr, GFP_KERNEL, tag, -+ srp_tsk, tcm_tmr, GFP_KERNEL, srp_tsk->task_tag, - TARGET_SCF_ACK_KREF); - if (rc != 0) { - send_ioctx->cmd.se_tmr_req->response = TMR_FUNCTION_REJECTED; -diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c -index cfd58e87da26..1c5914cae853 100644 ---- a/drivers/input/misc/ati_remote2.c -+++ b/drivers/input/misc/ati_remote2.c -@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d - - ar2->udev = udev; - -+ /* Sanity check, first interface must have an endpoint */ -+ if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) { -+ dev_err(&interface->dev, -+ "%s(): interface 0 must have an endpoint\n", __func__); -+ r = -ENODEV; -+ goto fail1; -+ } - ar2->intf[0] = interface; - ar2->ep[0] = &alt->endpoint[0].desc; - -+ /* Sanity check, the device must have two interfaces */ - ar2->intf[1] = usb_ifnum_to_if(udev, 1); -+ if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) { -+ dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n", -+ __func__, udev->actconfig->desc.bNumInterfaces); -+ r = -ENODEV; -+ goto fail1; -+ } -+ - r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2); - if (r) - goto fail1; -+ -+ /* Sanity check, second interface must have an endpoint */ - alt = ar2->intf[1]->cur_altsetting; -+ if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) { -+ dev_err(&interface->dev, -+ "%s(): interface 1 must have an endpoint\n", __func__); -+ r = -ENODEV; -+ goto fail2; -+ } - ar2->ep[1] = &alt->endpoint[0].desc; - - r = ati_remote2_urb_init(ar2); - if (r) -- goto fail2; -+ goto fail3; - - ar2->channel_mask = channel_mask; - ar2->mode_mask = mode_mask; - - r = ati_remote2_setup(ar2, ar2->channel_mask); - if (r) -- goto fail2; -+ goto fail3; - - usb_make_path(udev, ar2->phys, sizeof(ar2->phys)); - strlcat(ar2->phys, "/input0", sizeof(ar2->phys)); -@@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d - - r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group); - if (r) -- goto fail2; -+ goto fail3; - - r = ati_remote2_input_init(ar2); - if (r) -- goto fail3; -+ goto fail4; - - usb_set_intfdata(interface, ar2); - -@@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d - - return 0; - -- fail3: -+ fail4: - sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group); -- fail2: -+ fail3: - ati_remote2_urb_cleanup(ar2); -+ fail2: - usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]); - fail1: - kfree(ar2); -diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c -index ac1fa5f44580..9c0ea36913b4 100644 ---- a/drivers/input/misc/ims-pcu.c -+++ b/drivers/input/misc/ims-pcu.c -@@ -1663,6 +1663,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc - - pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev, - union_desc->bMasterInterface0); -+ if (!pcu->ctrl_intf) -+ return -EINVAL; - - alt = pcu->ctrl_intf->cur_altsetting; - pcu->ep_ctrl = &alt->endpoint[0].desc; -@@ -1670,6 +1672,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc - - pcu->data_intf = usb_ifnum_to_if(pcu->udev, - union_desc->bSlaveInterface0); -+ if (!pcu->data_intf) -+ return -EINVAL; - - alt = pcu->data_intf->cur_altsetting; - if (alt->desc.bNumEndpoints != 2) { -diff --git a/drivers/input/misc/max8997_haptic.c b/drivers/input/misc/max8997_haptic.c -index a806ba3818f7..8d6326d7e7be 100644 ---- a/drivers/input/misc/max8997_haptic.c -+++ b/drivers/input/misc/max8997_haptic.c -@@ -255,12 +255,14 @@ static int max8997_haptic_probe(struct platform_device *pdev) - struct max8997_dev *iodev = dev_get_drvdata(pdev->dev.parent); - const struct max8997_platform_data *pdata = - dev_get_platdata(iodev->dev); -- const struct max8997_haptic_platform_data *haptic_pdata = -- pdata->haptic_pdata; -+ const struct max8997_haptic_platform_data *haptic_pdata = NULL; - struct max8997_haptic *chip; - struct input_dev *input_dev; - int error; - -+ if (pdata) -+ haptic_pdata = pdata->haptic_pdata; -+ - if (!haptic_pdata) { - dev_err(&pdev->dev, "no haptic platform data\n"); - return -EINVAL; -diff --git a/drivers/input/misc/pmic8xxx-pwrkey.c b/drivers/input/misc/pmic8xxx-pwrkey.c -index 3f02e0e03d12..67aab86048ad 100644 ---- a/drivers/input/misc/pmic8xxx-pwrkey.c -+++ b/drivers/input/misc/pmic8xxx-pwrkey.c -@@ -353,7 +353,8 @@ static int pmic8xxx_pwrkey_probe(struct platform_device *pdev) - if (of_property_read_u32(pdev->dev.of_node, "debounce", &kpd_delay)) - kpd_delay = 15625; - -- if (kpd_delay > 62500 || kpd_delay == 0) { -+ /* Valid range of pwr key trigger delay is 1/64 sec to 2 seconds. */ -+ if (kpd_delay > USEC_PER_SEC * 2 || kpd_delay < USEC_PER_SEC / 64) { - dev_err(&pdev->dev, "invalid power key trigger delay\n"); - return -EINVAL; - } -@@ -385,8 +386,8 @@ static int pmic8xxx_pwrkey_probe(struct platform_device *pdev) - pwr->name = "pmic8xxx_pwrkey"; - pwr->phys = "pmic8xxx_pwrkey/input0"; - -- delay = (kpd_delay << 10) / USEC_PER_SEC; -- delay = 1 + ilog2(delay); -+ delay = (kpd_delay << 6) / USEC_PER_SEC; -+ delay = ilog2(delay); - - err = regmap_read(regmap, PON_CNTL_1, &pon_cntl); - if (err < 0) { -diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c -index 63b539d3daba..84909a12ff36 100644 ---- a/drivers/input/misc/powermate.c -+++ b/drivers/input/misc/powermate.c -@@ -307,6 +307,9 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i - int error = -ENOMEM; - - interface = intf->cur_altsetting; -+ if (interface->desc.bNumEndpoints < 1) -+ return -EINVAL; -+ - endpoint = &interface->endpoint[0].desc; - if (!usb_endpoint_is_int_in(endpoint)) - return -EIO; -diff --git a/drivers/input/misc/pwm-beeper.c b/drivers/input/misc/pwm-beeper.c -index f2261ab54701..18663d4edae5 100644 ---- a/drivers/input/misc/pwm-beeper.c -+++ b/drivers/input/misc/pwm-beeper.c -@@ -20,21 +20,40 @@ - #include - #include - #include -+#include - - struct pwm_beeper { - struct input_dev *input; - struct pwm_device *pwm; -+ struct work_struct work; - unsigned long period; - }; - - #define HZ_TO_NANOSECONDS(x) (1000000000UL/(x)) - -+static void __pwm_beeper_set(struct pwm_beeper *beeper) -+{ -+ unsigned long period = beeper->period; -+ -+ if (period) { -+ pwm_config(beeper->pwm, period / 2, period); -+ pwm_enable(beeper->pwm); -+ } else -+ pwm_disable(beeper->pwm); -+} -+ -+static void pwm_beeper_work(struct work_struct *work) -+{ -+ struct pwm_beeper *beeper = -+ container_of(work, struct pwm_beeper, work); -+ -+ __pwm_beeper_set(beeper); -+} -+ - static int pwm_beeper_event(struct input_dev *input, - unsigned int type, unsigned int code, int value) - { -- int ret = 0; - struct pwm_beeper *beeper = input_get_drvdata(input); -- unsigned long period; - - if (type != EV_SND || value < 0) - return -EINVAL; -@@ -49,22 +68,31 @@ static int pwm_beeper_event(struct input_dev *input, - return -EINVAL; - } - -- if (value == 0) { -- pwm_disable(beeper->pwm); -- } else { -- period = HZ_TO_NANOSECONDS(value); -- ret = pwm_config(beeper->pwm, period / 2, period); -- if (ret) -- return ret; -- ret = pwm_enable(beeper->pwm); -- if (ret) -- return ret; -- beeper->period = period; -- } -+ if (value == 0) -+ beeper->period = 0; -+ else -+ beeper->period = HZ_TO_NANOSECONDS(value); -+ -+ schedule_work(&beeper->work); - - return 0; - } - -+static void pwm_beeper_stop(struct pwm_beeper *beeper) -+{ -+ cancel_work_sync(&beeper->work); -+ -+ if (beeper->period) -+ pwm_disable(beeper->pwm); -+} -+ -+static void pwm_beeper_close(struct input_dev *input) -+{ -+ struct pwm_beeper *beeper = input_get_drvdata(input); -+ -+ pwm_beeper_stop(beeper); -+} -+ - static int pwm_beeper_probe(struct platform_device *pdev) - { - unsigned long pwm_id = (unsigned long)dev_get_platdata(&pdev->dev); -@@ -87,6 +115,8 @@ static int pwm_beeper_probe(struct platform_device *pdev) - goto err_free; - } - -+ INIT_WORK(&beeper->work, pwm_beeper_work); -+ - beeper->input = input_allocate_device(); - if (!beeper->input) { - dev_err(&pdev->dev, "Failed to allocate input device\n"); -@@ -106,6 +136,7 @@ static int pwm_beeper_probe(struct platform_device *pdev) - beeper->input->sndbit[0] = BIT(SND_TONE) | BIT(SND_BELL); - - beeper->input->event = pwm_beeper_event; -+ beeper->input->close = pwm_beeper_close; - - input_set_drvdata(beeper->input, beeper); - -@@ -135,7 +166,6 @@ static int pwm_beeper_remove(struct platform_device *pdev) - - input_unregister_device(beeper->input); - -- pwm_disable(beeper->pwm); - pwm_free(beeper->pwm); - - kfree(beeper); -@@ -147,8 +177,7 @@ static int __maybe_unused pwm_beeper_suspend(struct device *dev) - { - struct pwm_beeper *beeper = dev_get_drvdata(dev); - -- if (beeper->period) -- pwm_disable(beeper->pwm); -+ pwm_beeper_stop(beeper); - - return 0; - } -@@ -157,10 +186,8 @@ static int __maybe_unused pwm_beeper_resume(struct device *dev) - { - struct pwm_beeper *beeper = dev_get_drvdata(dev); - -- if (beeper->period) { -- pwm_config(beeper->pwm, beeper->period / 2, beeper->period); -- pwm_enable(beeper->pwm); -- } -+ if (beeper->period) -+ __pwm_beeper_set(beeper); - - return 0; - } -diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c -index 6025eb430c0a..a41d8328c064 100644 ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -862,8 +862,9 @@ static void synaptics_report_ext_buttons(struct psmouse *psmouse, - if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap)) - return; - -- /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */ -- if (SYN_ID_FULL(priv->identity) == 0x801 && -+ /* Bug in FW 8.1 & 8.2, buttons are reported only when ExtBit is 1 */ -+ if ((SYN_ID_FULL(priv->identity) == 0x801 || -+ SYN_ID_FULL(priv->identity) == 0x802) && - !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02)) - return; - -diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c -index 3a7f3a4a4396..7c18249d6c8e 100644 ---- a/drivers/input/tablet/gtco.c -+++ b/drivers/input/tablet/gtco.c -@@ -858,6 +858,14 @@ static int gtco_probe(struct usb_interface *usbinterface, - goto err_free_buf; - } - -+ /* Sanity check that a device has an endpoint */ -+ if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) { -+ dev_err(&usbinterface->dev, -+ "Invalid number of endpoints\n"); -+ error = -EINVAL; -+ goto err_free_urb; -+ } -+ - /* - * The endpoint is always altsetting 0, we know this since we know - * this device only has one interrupt endpoint -@@ -879,7 +887,7 @@ static int gtco_probe(struct usb_interface *usbinterface, - * HID report descriptor - */ - if (usb_get_extra_descriptor(usbinterface->cur_altsetting, -- HID_DEVICE_TYPE, &hid_desc) != 0){ -+ HID_DEVICE_TYPE, &hid_desc) != 0) { - dev_err(&usbinterface->dev, - "Can't retrieve exta USB descriptor to get hid report descriptor length\n"); - error = -EIO; -diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c -index 9bbadaaf6bc3..7b3845aa5983 100644 ---- a/drivers/input/touchscreen/zforce_ts.c -+++ b/drivers/input/touchscreen/zforce_ts.c -@@ -370,8 +370,8 @@ static int zforce_touch_event(struct zforce_ts *ts, u8 *payload) - point.coord_x = point.coord_y = 0; - } - -- point.state = payload[9 * i + 5] & 0x03; -- point.id = (payload[9 * i + 5] & 0xfc) >> 2; -+ point.state = payload[9 * i + 5] & 0x0f; -+ point.id = (payload[9 * i + 5] & 0xf0) >> 4; - - /* determine touch major, minor and orientation */ - point.area_major = max(payload[9 * i + 6], -diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c -index 374c129219ef..5efadad4615b 100644 ---- a/drivers/iommu/amd_iommu.c -+++ b/drivers/iommu/amd_iommu.c -@@ -92,6 +92,7 @@ struct iommu_dev_data { - struct list_head dev_data_list; /* For global dev_data_list */ - struct protection_domain *domain; /* Domain the device is bound to */ - u16 devid; /* PCI Device ID */ -+ u16 alias; /* Alias Device ID */ - bool iommu_v2; /* Device can make use of IOMMUv2 */ - bool passthrough; /* Device is identity mapped */ - struct { -@@ -166,6 +167,13 @@ static struct protection_domain *to_pdomain(struct iommu_domain *dom) - return container_of(dom, struct protection_domain, domain); - } - -+static inline u16 get_device_id(struct device *dev) -+{ -+ struct pci_dev *pdev = to_pci_dev(dev); -+ -+ return PCI_DEVID(pdev->bus->number, pdev->devfn); -+} -+ - static struct iommu_dev_data *alloc_dev_data(u16 devid) - { - struct iommu_dev_data *dev_data; -@@ -203,6 +211,68 @@ out_unlock: - return dev_data; - } - -+static int __last_alias(struct pci_dev *pdev, u16 alias, void *data) -+{ -+ *(u16 *)data = alias; -+ return 0; -+} -+ -+static u16 get_alias(struct device *dev) -+{ -+ struct pci_dev *pdev = to_pci_dev(dev); -+ u16 devid, ivrs_alias, pci_alias; -+ -+ devid = get_device_id(dev); -+ ivrs_alias = amd_iommu_alias_table[devid]; -+ pci_for_each_dma_alias(pdev, __last_alias, &pci_alias); -+ -+ if (ivrs_alias == pci_alias) -+ return ivrs_alias; -+ -+ /* -+ * DMA alias showdown -+ * -+ * The IVRS is fairly reliable in telling us about aliases, but it -+ * can't know about every screwy device. If we don't have an IVRS -+ * reported alias, use the PCI reported alias. In that case we may -+ * still need to initialize the rlookup and dev_table entries if the -+ * alias is to a non-existent device. -+ */ -+ if (ivrs_alias == devid) { -+ if (!amd_iommu_rlookup_table[pci_alias]) { -+ amd_iommu_rlookup_table[pci_alias] = -+ amd_iommu_rlookup_table[devid]; -+ memcpy(amd_iommu_dev_table[pci_alias].data, -+ amd_iommu_dev_table[devid].data, -+ sizeof(amd_iommu_dev_table[pci_alias].data)); -+ } -+ -+ return pci_alias; -+ } -+ -+ pr_info("AMD-Vi: Using IVRS reported alias %02x:%02x.%d " -+ "for device %s[%04x:%04x], kernel reported alias " -+ "%02x:%02x.%d\n", PCI_BUS_NUM(ivrs_alias), PCI_SLOT(ivrs_alias), -+ PCI_FUNC(ivrs_alias), dev_name(dev), pdev->vendor, pdev->device, -+ PCI_BUS_NUM(pci_alias), PCI_SLOT(pci_alias), -+ PCI_FUNC(pci_alias)); -+ -+ /* -+ * If we don't have a PCI DMA alias and the IVRS alias is on the same -+ * bus, then the IVRS table may know about a quirk that we don't. -+ */ -+ if (pci_alias == devid && -+ PCI_BUS_NUM(ivrs_alias) == pdev->bus->number) { -+ pdev->dev_flags |= PCI_DEV_FLAGS_DMA_ALIAS_DEVFN; -+ pdev->dma_alias_devfn = ivrs_alias & 0xff; -+ pr_info("AMD-Vi: Added PCI DMA alias %02x.%d for %s\n", -+ PCI_SLOT(ivrs_alias), PCI_FUNC(ivrs_alias), -+ dev_name(dev)); -+ } -+ -+ return ivrs_alias; -+} -+ - static struct iommu_dev_data *find_dev_data(u16 devid) - { - struct iommu_dev_data *dev_data; -@@ -215,13 +285,6 @@ static struct iommu_dev_data *find_dev_data(u16 devid) - return dev_data; - } - --static inline u16 get_device_id(struct device *dev) --{ -- struct pci_dev *pdev = to_pci_dev(dev); -- -- return PCI_DEVID(pdev->bus->number, pdev->devfn); --} -- - static struct iommu_dev_data *get_dev_data(struct device *dev) - { - return dev->archdata.iommu; -@@ -349,6 +412,8 @@ static int iommu_init_device(struct device *dev) - if (!dev_data) - return -ENOMEM; - -+ dev_data->alias = get_alias(dev); -+ - if (pci_iommuv2_capable(pdev)) { - struct amd_iommu *iommu; - -@@ -369,7 +434,7 @@ static void iommu_ignore_device(struct device *dev) - u16 devid, alias; - - devid = get_device_id(dev); -- alias = amd_iommu_alias_table[devid]; -+ alias = get_alias(dev); - - memset(&amd_iommu_dev_table[devid], 0, sizeof(struct dev_table_entry)); - memset(&amd_iommu_dev_table[alias], 0, sizeof(struct dev_table_entry)); -@@ -1061,7 +1126,7 @@ static int device_flush_dte(struct iommu_dev_data *dev_data) - int ret; - - iommu = amd_iommu_rlookup_table[dev_data->devid]; -- alias = amd_iommu_alias_table[dev_data->devid]; -+ alias = dev_data->alias; - - ret = iommu_flush_dte(iommu, dev_data->devid); - if (!ret && alias != dev_data->devid) -@@ -2039,7 +2104,7 @@ static void do_attach(struct iommu_dev_data *dev_data, - bool ats; - - iommu = amd_iommu_rlookup_table[dev_data->devid]; -- alias = amd_iommu_alias_table[dev_data->devid]; -+ alias = dev_data->alias; - ats = dev_data->ats.enabled; - - /* Update data structures */ -@@ -2073,7 +2138,7 @@ static void do_detach(struct iommu_dev_data *dev_data) - return; - - iommu = amd_iommu_rlookup_table[dev_data->devid]; -- alias = amd_iommu_alias_table[dev_data->devid]; -+ alias = dev_data->alias; - - /* decrease reference counters */ - dev_data->domain->dev_iommu[iommu->index] -= 1; -diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c -index 72d6182666cb..58f2fe687a24 100644 ---- a/drivers/iommu/dma-iommu.c -+++ b/drivers/iommu/dma-iommu.c -@@ -403,7 +403,7 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents, - unsigned int s_length = sg_dma_len(s); - unsigned int s_dma_len = s->length; - -- s->offset = s_offset; -+ s->offset += s_offset; - s->length = s_length; - sg_dma_address(s) = dma_addr + s_offset; - dma_addr += s_dma_len; -@@ -422,7 +422,7 @@ static void __invalidate_sg(struct scatterlist *sg, int nents) - - for_each_sg(sg, s, nents, i) { - if (sg_dma_address(s) != DMA_ERROR_CODE) -- s->offset = sg_dma_address(s); -+ s->offset += sg_dma_address(s); - if (sg_dma_len(s)) - s->length = sg_dma_len(s); - sg_dma_address(s) = DMA_ERROR_CODE; -diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c -index 0e3b0092ec92..515bb8b80952 100644 ---- a/drivers/iommu/iommu.c -+++ b/drivers/iommu/iommu.c -@@ -848,7 +848,8 @@ struct iommu_group *iommu_group_get_for_dev(struct device *dev) - if (!group->default_domain) { - group->default_domain = __iommu_domain_alloc(dev->bus, - IOMMU_DOMAIN_DMA); -- group->domain = group->default_domain; -+ if (!group->domain) -+ group->domain = group->default_domain; - } - - ret = iommu_group_add_device(group, dev); -diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c -index d7be6ddc34f6..2fc499a2207e 100644 ---- a/drivers/irqchip/irq-gic-v3.c -+++ b/drivers/irqchip/irq-gic-v3.c -@@ -361,6 +361,13 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs - if (static_key_true(&supports_deactivate)) - gic_write_dir(irqnr); - #ifdef CONFIG_SMP -+ /* -+ * Unlike GICv2, we don't need an smp_rmb() here. -+ * The control dependency from gic_read_iar to -+ * the ISB in gic_write_eoir is enough to ensure -+ * that any shared data read by handle_IPI will -+ * be read after the ACK. -+ */ - handle_IPI(irqnr, regs); - #else - WARN_ONCE(true, "Unexpected SGI received!\n"); -@@ -380,6 +387,15 @@ static void __init gic_dist_init(void) - writel_relaxed(0, base + GICD_CTLR); - gic_dist_wait_for_rwp(); - -+ /* -+ * Configure SPIs as non-secure Group-1. This will only matter -+ * if the GIC only has a single security state. This will not -+ * do the right thing if the kernel is running in secure mode, -+ * but that's not the intended use case anyway. -+ */ -+ for (i = 32; i < gic_data.irq_nr; i += 32) -+ writel_relaxed(~0, base + GICD_IGROUPR + i / 8); -+ - gic_dist_config(base, gic_data.irq_nr, gic_dist_wait_for_rwp); - - /* Enable distributor with ARE, Group1 */ -@@ -494,6 +510,9 @@ static void gic_cpu_init(void) - - rbase = gic_data_rdist_sgi_base(); - -+ /* Configure SGIs/PPIs as non-secure Group-1 */ -+ writel_relaxed(~0, rbase + GICR_IGROUPR0); -+ - gic_cpu_config(rbase, gic_redist_wait_for_rwp); - - /* Give LPIs a spin */ -diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c -index 8f9ebf714e2b..eef950046ac0 100644 ---- a/drivers/irqchip/irq-gic.c -+++ b/drivers/irqchip/irq-gic.c -@@ -344,6 +344,14 @@ static void __exception_irq_entry gic_handle_irq(struct pt_regs *regs) - if (static_key_true(&supports_deactivate)) - writel_relaxed(irqstat, cpu_base + GIC_CPU_DEACTIVATE); - #ifdef CONFIG_SMP -+ /* -+ * Ensure any shared data written by the CPU sending -+ * the IPI is read after we've read the ACK register -+ * on the GIC. -+ * -+ * Pairs with the write barrier in gic_raise_softirq -+ */ -+ smp_rmb(); - handle_IPI(irqnr, regs); - #endif - continue; -diff --git a/drivers/irqchip/irq-mxs.c b/drivers/irqchip/irq-mxs.c -index efe50845939d..17304705f2cf 100644 ---- a/drivers/irqchip/irq-mxs.c -+++ b/drivers/irqchip/irq-mxs.c -@@ -183,7 +183,7 @@ static void __iomem * __init icoll_init_iobase(struct device_node *np) - void __iomem *icoll_base; - - icoll_base = of_io_request_and_map(np, 0, np->name); -- if (!icoll_base) -+ if (IS_ERR(icoll_base)) - panic("%s: unable to map resource", np->full_name); - return icoll_base; - } -diff --git a/drivers/irqchip/irq-sunxi-nmi.c b/drivers/irqchip/irq-sunxi-nmi.c -index 0820f67cc9a7..668730c5cb66 100644 ---- a/drivers/irqchip/irq-sunxi-nmi.c -+++ b/drivers/irqchip/irq-sunxi-nmi.c -@@ -160,9 +160,9 @@ static int __init sunxi_sc_nmi_irq_init(struct device_node *node, - - gc = irq_get_domain_generic_chip(domain, 0); - gc->reg_base = of_io_request_and_map(node, 0, of_node_full_name(node)); -- if (!gc->reg_base) { -+ if (IS_ERR(gc->reg_base)) { - pr_err("unable to map resource\n"); -- ret = -ENOMEM; -+ ret = PTR_ERR(gc->reg_base); - goto fail_irqd_remove; - } - -diff --git a/drivers/lightnvm/rrpc.c b/drivers/lightnvm/rrpc.c -index 307db1ea22de..b7ddfb352792 100644 ---- a/drivers/lightnvm/rrpc.c -+++ b/drivers/lightnvm/rrpc.c -@@ -499,12 +499,21 @@ static void rrpc_gc_queue(struct work_struct *work) - struct rrpc *rrpc = gcb->rrpc; - struct rrpc_block *rblk = gcb->rblk; - struct nvm_lun *lun = rblk->parent->lun; -+ struct nvm_block *blk = rblk->parent; - struct rrpc_lun *rlun = &rrpc->luns[lun->id - rrpc->lun_offset]; - - spin_lock(&rlun->lock); - list_add_tail(&rblk->prio, &rlun->prio_list); - spin_unlock(&rlun->lock); - -+ spin_lock(&lun->lock); -+ lun->nr_open_blocks--; -+ lun->nr_closed_blocks++; -+ blk->state &= ~NVM_BLK_ST_OPEN; -+ blk->state |= NVM_BLK_ST_CLOSED; -+ list_move_tail(&rblk->list, &rlun->closed_list); -+ spin_unlock(&lun->lock); -+ - mempool_free(gcb, rrpc->gcb_pool); - pr_debug("nvm: block '%lu' is full, allow GC (sched)\n", - rblk->parent->id); -@@ -668,20 +677,8 @@ static void rrpc_end_io_write(struct rrpc *rrpc, struct rrpc_rq *rrqd, - lun = rblk->parent->lun; - - cmnt_size = atomic_inc_return(&rblk->data_cmnt_size); -- if (unlikely(cmnt_size == rrpc->dev->pgs_per_blk)) { -- struct nvm_block *blk = rblk->parent; -- struct rrpc_lun *rlun = rblk->rlun; -- -- spin_lock(&lun->lock); -- lun->nr_open_blocks--; -- lun->nr_closed_blocks++; -- blk->state &= ~NVM_BLK_ST_OPEN; -- blk->state |= NVM_BLK_ST_CLOSED; -- list_move_tail(&rblk->list, &rlun->closed_list); -- spin_unlock(&lun->lock); -- -+ if (unlikely(cmnt_size == rrpc->dev->pgs_per_blk)) - rrpc_run_gc(rrpc, rblk); -- } - } - } - -diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c -index 004926955263..b0155b05cddb 100644 ---- a/drivers/mcb/mcb-parse.c -+++ b/drivers/mcb/mcb-parse.c -@@ -57,7 +57,7 @@ static int chameleon_parse_gdd(struct mcb_bus *bus, - mdev->id = GDD_DEV(reg1); - mdev->rev = GDD_REV(reg1); - mdev->var = GDD_VAR(reg1); -- mdev->bar = GDD_BAR(reg1); -+ mdev->bar = GDD_BAR(reg2); - mdev->group = GDD_GRP(reg2); - mdev->inst = GDD_INS(reg2); - -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 8d0ead98eb6e..a296425a7270 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -1015,8 +1015,12 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) - */ - atomic_set(&dc->count, 1); - -- if (bch_cached_dev_writeback_start(dc)) -+ /* Block writeback thread, but spawn it */ -+ down_write(&dc->writeback_lock); -+ if (bch_cached_dev_writeback_start(dc)) { -+ up_write(&dc->writeback_lock); - return -ENOMEM; -+ } - - if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) { - bch_sectors_dirty_init(dc); -@@ -1028,6 +1032,9 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) - bch_cached_dev_run(dc); - bcache_device_link(&dc->disk, c, "bdev"); - -+ /* Allow the writeback thread to proceed */ -+ up_write(&dc->writeback_lock); -+ - pr_info("Caching %s as %s on set %pU", - bdevname(dc->bdev, buf), dc->disk.disk->disk_name, - dc->disk.c->sb.set_uuid); -@@ -1366,6 +1373,9 @@ static void cache_set_flush(struct closure *cl) - struct btree *b; - unsigned i; - -+ if (!c) -+ closure_return(cl); -+ - bch_cache_accounting_destroy(&c->accounting); - - kobject_put(&c->internal); -@@ -1828,11 +1838,12 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca) - return 0; - } - --static void register_cache(struct cache_sb *sb, struct page *sb_page, -+static int register_cache(struct cache_sb *sb, struct page *sb_page, - struct block_device *bdev, struct cache *ca) - { - char name[BDEVNAME_SIZE]; -- const char *err = "cannot allocate memory"; -+ const char *err = NULL; -+ int ret = 0; - - memcpy(&ca->sb, sb, sizeof(struct cache_sb)); - ca->bdev = bdev; -@@ -1847,27 +1858,35 @@ static void register_cache(struct cache_sb *sb, struct page *sb_page, - if (blk_queue_discard(bdev_get_queue(ca->bdev))) - ca->discard = CACHE_DISCARD(&ca->sb); - -- if (cache_alloc(sb, ca) != 0) -+ ret = cache_alloc(sb, ca); -+ if (ret != 0) - goto err; - -- err = "error creating kobject"; -- if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) -- goto err; -+ if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) { -+ err = "error calling kobject_add"; -+ ret = -ENOMEM; -+ goto out; -+ } - - mutex_lock(&bch_register_lock); - err = register_cache_set(ca); - mutex_unlock(&bch_register_lock); - -- if (err) -- goto err; -+ if (err) { -+ ret = -ENODEV; -+ goto out; -+ } - - pr_info("registered cache device %s", bdevname(bdev, name)); -+ - out: - kobject_put(&ca->kobj); -- return; -+ - err: -- pr_notice("error opening %s: %s", bdevname(bdev, name), err); -- goto out; -+ if (err) -+ pr_notice("error opening %s: %s", bdevname(bdev, name), err); -+ -+ return ret; - } - - /* Global interfaces/init */ -@@ -1965,7 +1984,8 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr, - if (!ca) - goto err_close; - -- register_cache(sb, sb_page, bdev, ca); -+ if (register_cache(sb, sb_page, bdev, ca) != 0) -+ goto err_close; - } - out: - if (sb_page) -diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c -index f6543f3a970f..3970cda10080 100644 ---- a/drivers/md/dm-cache-metadata.c -+++ b/drivers/md/dm-cache-metadata.c -@@ -867,18 +867,55 @@ static int blocks_are_unmapped_or_clean(struct dm_cache_metadata *cmd, - return 0; - } - --#define WRITE_LOCK(cmd) \ -- if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) \ -- return -EINVAL; \ -- down_write(&cmd->root_lock) -+static bool cmd_write_lock(struct dm_cache_metadata *cmd) -+{ -+ down_write(&cmd->root_lock); -+ if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { -+ up_write(&cmd->root_lock); -+ return false; -+ } -+ return true; -+} -+ -+#define WRITE_LOCK(cmd) \ -+ do { \ -+ if (!cmd_write_lock((cmd))) \ -+ return -EINVAL; \ -+ } while(0) - --#define WRITE_LOCK_VOID(cmd) \ -- if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) \ -- return; \ -- down_write(&cmd->root_lock) -+#define WRITE_LOCK_VOID(cmd) \ -+ do { \ -+ if (!cmd_write_lock((cmd))) \ -+ return; \ -+ } while(0) - - #define WRITE_UNLOCK(cmd) \ -- up_write(&cmd->root_lock) -+ up_write(&(cmd)->root_lock) -+ -+static bool cmd_read_lock(struct dm_cache_metadata *cmd) -+{ -+ down_read(&cmd->root_lock); -+ if (cmd->fail_io) { -+ up_read(&cmd->root_lock); -+ return false; -+ } -+ return true; -+} -+ -+#define READ_LOCK(cmd) \ -+ do { \ -+ if (!cmd_read_lock((cmd))) \ -+ return -EINVAL; \ -+ } while(0) -+ -+#define READ_LOCK_VOID(cmd) \ -+ do { \ -+ if (!cmd_read_lock((cmd))) \ -+ return; \ -+ } while(0) -+ -+#define READ_UNLOCK(cmd) \ -+ up_read(&(cmd)->root_lock) - - int dm_cache_resize(struct dm_cache_metadata *cmd, dm_cblock_t new_cache_size) - { -@@ -1015,22 +1052,20 @@ int dm_cache_load_discards(struct dm_cache_metadata *cmd, - { - int r; - -- down_read(&cmd->root_lock); -+ READ_LOCK(cmd); - r = __load_discards(cmd, fn, context); -- up_read(&cmd->root_lock); -+ READ_UNLOCK(cmd); - - return r; - } - --dm_cblock_t dm_cache_size(struct dm_cache_metadata *cmd) -+int dm_cache_size(struct dm_cache_metadata *cmd, dm_cblock_t *result) - { -- dm_cblock_t r; -- -- down_read(&cmd->root_lock); -- r = cmd->cache_blocks; -- up_read(&cmd->root_lock); -+ READ_LOCK(cmd); -+ *result = cmd->cache_blocks; -+ READ_UNLOCK(cmd); - -- return r; -+ return 0; - } - - static int __remove(struct dm_cache_metadata *cmd, dm_cblock_t cblock) -@@ -1188,9 +1223,9 @@ int dm_cache_load_mappings(struct dm_cache_metadata *cmd, - { - int r; - -- down_read(&cmd->root_lock); -+ READ_LOCK(cmd); - r = __load_mappings(cmd, policy, fn, context); -- up_read(&cmd->root_lock); -+ READ_UNLOCK(cmd); - - return r; - } -@@ -1215,18 +1250,18 @@ static int __dump_mappings(struct dm_cache_metadata *cmd) - - void dm_cache_dump(struct dm_cache_metadata *cmd) - { -- down_read(&cmd->root_lock); -+ READ_LOCK_VOID(cmd); - __dump_mappings(cmd); -- up_read(&cmd->root_lock); -+ READ_UNLOCK(cmd); - } - - int dm_cache_changed_this_transaction(struct dm_cache_metadata *cmd) - { - int r; - -- down_read(&cmd->root_lock); -+ READ_LOCK(cmd); - r = cmd->changed; -- up_read(&cmd->root_lock); -+ READ_UNLOCK(cmd); - - return r; - } -@@ -1276,9 +1311,9 @@ int dm_cache_set_dirty(struct dm_cache_metadata *cmd, - void dm_cache_metadata_get_stats(struct dm_cache_metadata *cmd, - struct dm_cache_statistics *stats) - { -- down_read(&cmd->root_lock); -+ READ_LOCK_VOID(cmd); - *stats = cmd->stats; -- up_read(&cmd->root_lock); -+ READ_UNLOCK(cmd); - } - - void dm_cache_metadata_set_stats(struct dm_cache_metadata *cmd, -@@ -1312,9 +1347,9 @@ int dm_cache_get_free_metadata_block_count(struct dm_cache_metadata *cmd, - { - int r = -EINVAL; - -- down_read(&cmd->root_lock); -+ READ_LOCK(cmd); - r = dm_sm_get_nr_free(cmd->metadata_sm, result); -- up_read(&cmd->root_lock); -+ READ_UNLOCK(cmd); - - return r; - } -@@ -1324,9 +1359,9 @@ int dm_cache_get_metadata_dev_size(struct dm_cache_metadata *cmd, - { - int r = -EINVAL; - -- down_read(&cmd->root_lock); -+ READ_LOCK(cmd); - r = dm_sm_get_nr_blocks(cmd->metadata_sm, result); -- up_read(&cmd->root_lock); -+ READ_UNLOCK(cmd); - - return r; - } -@@ -1417,7 +1452,13 @@ int dm_cache_write_hints(struct dm_cache_metadata *cmd, struct dm_cache_policy * - - int dm_cache_metadata_all_clean(struct dm_cache_metadata *cmd, bool *result) - { -- return blocks_are_unmapped_or_clean(cmd, 0, cmd->cache_blocks, result); -+ int r; -+ -+ READ_LOCK(cmd); -+ r = blocks_are_unmapped_or_clean(cmd, 0, cmd->cache_blocks, result); -+ READ_UNLOCK(cmd); -+ -+ return r; - } - - void dm_cache_metadata_set_read_only(struct dm_cache_metadata *cmd) -@@ -1440,10 +1481,7 @@ int dm_cache_metadata_set_needs_check(struct dm_cache_metadata *cmd) - struct dm_block *sblock; - struct cache_disk_superblock *disk_super; - -- /* -- * We ignore fail_io for this function. -- */ -- down_write(&cmd->root_lock); -+ WRITE_LOCK(cmd); - set_bit(NEEDS_CHECK, &cmd->flags); - - r = superblock_lock(cmd, &sblock); -@@ -1458,19 +1496,17 @@ int dm_cache_metadata_set_needs_check(struct dm_cache_metadata *cmd) - dm_bm_unlock(sblock); - - out: -- up_write(&cmd->root_lock); -+ WRITE_UNLOCK(cmd); - return r; - } - --bool dm_cache_metadata_needs_check(struct dm_cache_metadata *cmd) -+int dm_cache_metadata_needs_check(struct dm_cache_metadata *cmd, bool *result) - { -- bool needs_check; -+ READ_LOCK(cmd); -+ *result = !!test_bit(NEEDS_CHECK, &cmd->flags); -+ READ_UNLOCK(cmd); - -- down_read(&cmd->root_lock); -- needs_check = !!test_bit(NEEDS_CHECK, &cmd->flags); -- up_read(&cmd->root_lock); -- -- return needs_check; -+ return 0; - } - - int dm_cache_metadata_abort(struct dm_cache_metadata *cmd) -diff --git a/drivers/md/dm-cache-metadata.h b/drivers/md/dm-cache-metadata.h -index 2ffee21f318d..8528744195e5 100644 ---- a/drivers/md/dm-cache-metadata.h -+++ b/drivers/md/dm-cache-metadata.h -@@ -66,7 +66,7 @@ void dm_cache_metadata_close(struct dm_cache_metadata *cmd); - * origin blocks to map to. - */ - int dm_cache_resize(struct dm_cache_metadata *cmd, dm_cblock_t new_cache_size); --dm_cblock_t dm_cache_size(struct dm_cache_metadata *cmd); -+int dm_cache_size(struct dm_cache_metadata *cmd, dm_cblock_t *result); - - int dm_cache_discard_bitset_resize(struct dm_cache_metadata *cmd, - sector_t discard_block_size, -@@ -137,7 +137,7 @@ int dm_cache_write_hints(struct dm_cache_metadata *cmd, struct dm_cache_policy * - */ - int dm_cache_metadata_all_clean(struct dm_cache_metadata *cmd, bool *result); - --bool dm_cache_metadata_needs_check(struct dm_cache_metadata *cmd); -+int dm_cache_metadata_needs_check(struct dm_cache_metadata *cmd, bool *result); - int dm_cache_metadata_set_needs_check(struct dm_cache_metadata *cmd); - void dm_cache_metadata_set_read_only(struct dm_cache_metadata *cmd); - void dm_cache_metadata_set_read_write(struct dm_cache_metadata *cmd); -diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c -index 5780accffa30..bb9b92ebbf8e 100644 ---- a/drivers/md/dm-cache-target.c -+++ b/drivers/md/dm-cache-target.c -@@ -984,9 +984,14 @@ static void notify_mode_switch(struct cache *cache, enum cache_metadata_mode mod - - static void set_cache_mode(struct cache *cache, enum cache_metadata_mode new_mode) - { -- bool needs_check = dm_cache_metadata_needs_check(cache->cmd); -+ bool needs_check; - enum cache_metadata_mode old_mode = get_cache_mode(cache); - -+ if (dm_cache_metadata_needs_check(cache->cmd, &needs_check)) { -+ DMERR("unable to read needs_check flag, setting failure mode"); -+ new_mode = CM_FAIL; -+ } -+ - if (new_mode == CM_WRITE && needs_check) { - DMERR("%s: unable to switch cache to write mode until repaired.", - cache_device_name(cache)); -@@ -3510,6 +3515,7 @@ static void cache_status(struct dm_target *ti, status_type_t type, - char buf[BDEVNAME_SIZE]; - struct cache *cache = ti->private; - dm_cblock_t residency; -+ bool needs_check; - - switch (type) { - case STATUSTYPE_INFO: -@@ -3583,7 +3589,9 @@ static void cache_status(struct dm_target *ti, status_type_t type, - else - DMEMIT("rw "); - -- if (dm_cache_metadata_needs_check(cache->cmd)) -+ r = dm_cache_metadata_needs_check(cache->cmd, &needs_check); -+ -+ if (r || needs_check) - DMEMIT("needs_check "); - else - DMEMIT("- "); -diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c -index 3766386080a4..e4d1bafe78c1 100644 ---- a/drivers/md/dm-snap.c -+++ b/drivers/md/dm-snap.c -@@ -1105,6 +1105,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) - int i; - int r = -EINVAL; - char *origin_path, *cow_path; -+ dev_t origin_dev, cow_dev; - unsigned args_used, num_flush_bios = 1; - fmode_t origin_mode = FMODE_READ; - -@@ -1135,11 +1136,19 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) - ti->error = "Cannot get origin device"; - goto bad_origin; - } -+ origin_dev = s->origin->bdev->bd_dev; - - cow_path = argv[0]; - argv++; - argc--; - -+ cow_dev = dm_get_dev_t(cow_path); -+ if (cow_dev && cow_dev == origin_dev) { -+ ti->error = "COW device cannot be the same as origin device"; -+ r = -EINVAL; -+ goto bad_cow; -+ } -+ - r = dm_get_device(ti, cow_path, dm_table_get_mode(ti->table), &s->cow); - if (r) { - ti->error = "Cannot get COW device"; -diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c -index 061152a43730..cb5d0daf53bb 100644 ---- a/drivers/md/dm-table.c -+++ b/drivers/md/dm-table.c -@@ -365,6 +365,26 @@ static int upgrade_mode(struct dm_dev_internal *dd, fmode_t new_mode, - } - - /* -+ * Convert the path to a device -+ */ -+dev_t dm_get_dev_t(const char *path) -+{ -+ dev_t uninitialized_var(dev); -+ struct block_device *bdev; -+ -+ bdev = lookup_bdev(path); -+ if (IS_ERR(bdev)) -+ dev = name_to_dev_t(path); -+ else { -+ dev = bdev->bd_dev; -+ bdput(bdev); -+ } -+ -+ return dev; -+} -+EXPORT_SYMBOL_GPL(dm_get_dev_t); -+ -+/* - * Add a device to the list, or just increment the usage count if - * it's already present. - */ -@@ -372,23 +392,15 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode, - struct dm_dev **result) - { - int r; -- dev_t uninitialized_var(dev); -+ dev_t dev; - struct dm_dev_internal *dd; - struct dm_table *t = ti->table; -- struct block_device *bdev; - - BUG_ON(!t); - -- /* convert the path to a device */ -- bdev = lookup_bdev(path); -- if (IS_ERR(bdev)) { -- dev = name_to_dev_t(path); -- if (!dev) -- return -ENODEV; -- } else { -- dev = bdev->bd_dev; -- bdput(bdev); -- } -+ dev = dm_get_dev_t(path); -+ if (!dev) -+ return -ENODEV; - - dd = find_device(&t->devices, dev); - if (!dd) { -diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c -index f962d6453afd..185010d9cccc 100644 ---- a/drivers/md/dm-thin-metadata.c -+++ b/drivers/md/dm-thin-metadata.c -@@ -1981,5 +1981,8 @@ bool dm_pool_metadata_needs_check(struct dm_pool_metadata *pmd) - - void dm_pool_issue_prefetches(struct dm_pool_metadata *pmd) - { -- dm_tm_issue_prefetches(pmd->tm); -+ down_read(&pmd->root_lock); -+ if (!pmd->fail_io) -+ dm_tm_issue_prefetches(pmd->tm); -+ up_read(&pmd->root_lock); - } -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index dd834927bc66..c338aebb4ccd 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -1109,12 +1109,8 @@ static void rq_completed(struct mapped_device *md, int rw, bool run_queue) - * back into ->request_fn() could deadlock attempting to grab the - * queue lock again. - */ -- if (run_queue) { -- if (md->queue->mq_ops) -- blk_mq_run_hw_queues(md->queue, true); -- else -- blk_run_queue_async(md->queue); -- } -+ if (!md->queue->mq_ops && run_queue) -+ blk_run_queue_async(md->queue); - - /* - * dm_put() must be at the end of this function. See the comment above -@@ -1214,9 +1210,9 @@ static void dm_requeue_original_request(struct mapped_device *md, - { - int rw = rq_data_dir(rq); - -+ rq_end_stats(md, rq); - dm_unprep_request(rq); - -- rq_end_stats(md, rq); - if (!rq->q->mq_ops) - old_requeue_request(rq); - else { -@@ -1336,7 +1332,10 @@ static void dm_complete_request(struct request *rq, int error) - struct dm_rq_target_io *tio = tio_from_request(rq); - - tio->error = error; -- blk_complete_request(rq); -+ if (!rq->q->mq_ops) -+ blk_complete_request(rq); -+ else -+ blk_mq_complete_request(rq, error); - } - - /* -diff --git a/drivers/md/md.c b/drivers/md/md.c -index e55e6cf9ec17..7551278030d8 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -284,6 +284,8 @@ static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio) - * go away inside make_request - */ - sectors = bio_sectors(bio); -+ /* bio could be mergeable after passing to underlayer */ -+ bio->bi_rw &= ~REQ_NOMERGE; - mddev->pers->make_request(mddev, bio); - - cpu = part_stat_lock(); -diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c -index 0a72ab6e6c20..dd483bb2e111 100644 ---- a/drivers/md/multipath.c -+++ b/drivers/md/multipath.c -@@ -129,7 +129,9 @@ static void multipath_make_request(struct mddev *mddev, struct bio * bio) - } - multipath = conf->multipaths + mp_bh->path; - -- mp_bh->bio = *bio; -+ bio_init(&mp_bh->bio); -+ __bio_clone_fast(&mp_bh->bio, bio); -+ - mp_bh->bio.bi_iter.bi_sector += multipath->rdev->data_offset; - mp_bh->bio.bi_bdev = multipath->rdev->bdev; - mp_bh->bio.bi_rw |= REQ_FAILFAST_TRANSPORT; -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index 4e3843f7d245..bb5bce059eb4 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -2274,6 +2274,7 @@ static void handle_write_finished(struct r1conf *conf, struct r1bio *r1_bio) - if (fail) { - spin_lock_irq(&conf->device_lock); - list_add(&r1_bio->retry_list, &conf->bio_end_io_list); -+ conf->nr_queued++; - spin_unlock_irq(&conf->device_lock); - md_wakeup_thread(conf->mddev->thread); - } else { -@@ -2391,8 +2392,10 @@ static void raid1d(struct md_thread *thread) - LIST_HEAD(tmp); - spin_lock_irqsave(&conf->device_lock, flags); - if (!test_bit(MD_CHANGE_PENDING, &mddev->flags)) { -- list_add(&tmp, &conf->bio_end_io_list); -- list_del_init(&conf->bio_end_io_list); -+ while (!list_empty(&conf->bio_end_io_list)) { -+ list_move(conf->bio_end_io_list.prev, &tmp); -+ conf->nr_queued--; -+ } - } - spin_unlock_irqrestore(&conf->device_lock, flags); - while (!list_empty(&tmp)) { -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index 1c1447dd3417..e3fd725d5c4d 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -2664,6 +2664,7 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio) - if (fail) { - spin_lock_irq(&conf->device_lock); - list_add(&r10_bio->retry_list, &conf->bio_end_io_list); -+ conf->nr_queued++; - spin_unlock_irq(&conf->device_lock); - md_wakeup_thread(conf->mddev->thread); - } else { -@@ -2691,8 +2692,10 @@ static void raid10d(struct md_thread *thread) - LIST_HEAD(tmp); - spin_lock_irqsave(&conf->device_lock, flags); - if (!test_bit(MD_CHANGE_PENDING, &mddev->flags)) { -- list_add(&tmp, &conf->bio_end_io_list); -- list_del_init(&conf->bio_end_io_list); -+ while (!list_empty(&conf->bio_end_io_list)) { -+ list_move(conf->bio_end_io_list.prev, &tmp); -+ conf->nr_queued--; -+ } - } - spin_unlock_irqrestore(&conf->device_lock, flags); - while (!list_empty(&tmp)) { -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index b4f02c9959f2..32d52878f182 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -340,8 +340,7 @@ static void release_inactive_stripe_list(struct r5conf *conf, - int hash) - { - int size; -- unsigned long do_wakeup = 0; -- int i = 0; -+ bool do_wakeup = false; - unsigned long flags; - - if (hash == NR_STRIPE_HASH_LOCKS) { -@@ -362,19 +361,15 @@ static void release_inactive_stripe_list(struct r5conf *conf, - !list_empty(list)) - atomic_dec(&conf->empty_inactive_list_nr); - list_splice_tail_init(list, conf->inactive_list + hash); -- do_wakeup |= 1 << hash; -+ do_wakeup = true; - spin_unlock_irqrestore(conf->hash_locks + hash, flags); - } - size--; - hash--; - } - -- for (i = 0; i < NR_STRIPE_HASH_LOCKS; i++) { -- if (do_wakeup & (1 << i)) -- wake_up(&conf->wait_for_stripe[i]); -- } -- - if (do_wakeup) { -+ wake_up(&conf->wait_for_stripe); - if (atomic_read(&conf->active_stripes) == 0) - wake_up(&conf->wait_for_quiescent); - if (conf->retry_read_aligned) -@@ -687,15 +682,14 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector, - if (!sh) { - set_bit(R5_INACTIVE_BLOCKED, - &conf->cache_state); -- wait_event_exclusive_cmd( -- conf->wait_for_stripe[hash], -+ wait_event_lock_irq( -+ conf->wait_for_stripe, - !list_empty(conf->inactive_list + hash) && - (atomic_read(&conf->active_stripes) - < (conf->max_nr_stripes * 3 / 4) - || !test_bit(R5_INACTIVE_BLOCKED, - &conf->cache_state)), -- spin_unlock_irq(conf->hash_locks + hash), -- spin_lock_irq(conf->hash_locks + hash)); -+ *(conf->hash_locks + hash)); - clear_bit(R5_INACTIVE_BLOCKED, - &conf->cache_state); - } else { -@@ -720,9 +714,6 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector, - } - } while (sh == NULL); - -- if (!list_empty(conf->inactive_list + hash)) -- wake_up(&conf->wait_for_stripe[hash]); -- - spin_unlock_irq(conf->hash_locks + hash); - return sh; - } -@@ -2089,6 +2080,14 @@ static int resize_chunks(struct r5conf *conf, int new_disks, int new_sectors) - unsigned long cpu; - int err = 0; - -+ /* -+ * Never shrink. And mddev_suspend() could deadlock if this is called -+ * from raid5d. In that case, scribble_disks and scribble_sectors -+ * should equal to new_disks and new_sectors -+ */ -+ if (conf->scribble_disks >= new_disks && -+ conf->scribble_sectors >= new_sectors) -+ return 0; - mddev_suspend(conf->mddev); - get_online_cpus(); - for_each_present_cpu(cpu) { -@@ -2110,6 +2109,10 @@ static int resize_chunks(struct r5conf *conf, int new_disks, int new_sectors) - } - put_online_cpus(); - mddev_resume(conf->mddev); -+ if (!err) { -+ conf->scribble_disks = new_disks; -+ conf->scribble_sectors = new_sectors; -+ } - return err; - } - -@@ -2190,7 +2193,7 @@ static int resize_stripes(struct r5conf *conf, int newsize) - cnt = 0; - list_for_each_entry(nsh, &newstripes, lru) { - lock_device_hash_lock(conf, hash); -- wait_event_exclusive_cmd(conf->wait_for_stripe[hash], -+ wait_event_cmd(conf->wait_for_stripe, - !list_empty(conf->inactive_list + hash), - unlock_device_hash_lock(conf, hash), - lock_device_hash_lock(conf, hash)); -@@ -4236,7 +4239,6 @@ static void break_stripe_batch_list(struct stripe_head *head_sh, - WARN_ON_ONCE(sh->state & ((1 << STRIPE_ACTIVE) | - (1 << STRIPE_SYNCING) | - (1 << STRIPE_REPLACED) | -- (1 << STRIPE_PREREAD_ACTIVE) | - (1 << STRIPE_DELAYED) | - (1 << STRIPE_BIT_DELAY) | - (1 << STRIPE_FULL_WRITE) | -@@ -4251,6 +4253,7 @@ static void break_stripe_batch_list(struct stripe_head *head_sh, - (1 << STRIPE_REPLACED))); - - set_mask_bits(&sh->state, ~(STRIPE_EXPAND_SYNC_FLAGS | -+ (1 << STRIPE_PREREAD_ACTIVE) | - (1 << STRIPE_DEGRADED)), - head_sh->state & (1 << STRIPE_INSYNC)); - -@@ -6413,6 +6416,12 @@ static int raid5_alloc_percpu(struct r5conf *conf) - } - put_online_cpus(); - -+ if (!err) { -+ conf->scribble_disks = max(conf->raid_disks, -+ conf->previous_raid_disks); -+ conf->scribble_sectors = max(conf->chunk_sectors, -+ conf->prev_chunk_sectors); -+ } - return err; - } - -@@ -6503,9 +6512,7 @@ static struct r5conf *setup_conf(struct mddev *mddev) - seqcount_init(&conf->gen_lock); - mutex_init(&conf->cache_size_mutex); - init_waitqueue_head(&conf->wait_for_quiescent); -- for (i = 0; i < NR_STRIPE_HASH_LOCKS; i++) { -- init_waitqueue_head(&conf->wait_for_stripe[i]); -- } -+ init_waitqueue_head(&conf->wait_for_stripe); - init_waitqueue_head(&conf->wait_for_overlap); - INIT_LIST_HEAD(&conf->handle_list); - INIT_LIST_HEAD(&conf->hold_list); -@@ -7014,8 +7021,8 @@ static int raid5_run(struct mddev *mddev) - } - - if (discard_supported && -- mddev->queue->limits.max_discard_sectors >= stripe && -- mddev->queue->limits.discard_granularity >= stripe) -+ mddev->queue->limits.max_discard_sectors >= (stripe >> 9) && -+ mddev->queue->limits.discard_granularity >= stripe) - queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, - mddev->queue); - else -diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h -index a415e1cd39b8..517d4b68a1be 100644 ---- a/drivers/md/raid5.h -+++ b/drivers/md/raid5.h -@@ -510,6 +510,8 @@ struct r5conf { - * conversions - */ - } __percpu *percpu; -+ int scribble_disks; -+ int scribble_sectors; - #ifdef CONFIG_HOTPLUG_CPU - struct notifier_block cpu_notify; - #endif -@@ -522,7 +524,7 @@ struct r5conf { - atomic_t empty_inactive_list_nr; - struct llist_head released_stripes; - wait_queue_head_t wait_for_quiescent; -- wait_queue_head_t wait_for_stripe[NR_STRIPE_HASH_LOCKS]; -+ wait_queue_head_t wait_for_stripe; - wait_queue_head_t wait_for_overlap; - unsigned long cache_state; - #define R5_INACTIVE_BLOCKED 1 /* release of inactive stripes blocked, -diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c -index 471fd23b5c5c..08d2c6bf7341 100644 ---- a/drivers/media/i2c/adv7511.c -+++ b/drivers/media/i2c/adv7511.c -@@ -1161,12 +1161,23 @@ static void adv7511_dbg_dump_edid(int lvl, int debug, struct v4l2_subdev *sd, in - } - } - -+static void adv7511_notify_no_edid(struct v4l2_subdev *sd) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ struct adv7511_edid_detect ed; -+ -+ /* We failed to read the EDID, so send an event for this. */ -+ ed.present = false; -+ ed.segment = adv7511_rd(sd, 0xc4); -+ v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed); -+ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x0); -+} -+ - static void adv7511_edid_handler(struct work_struct *work) - { - struct delayed_work *dwork = to_delayed_work(work); - struct adv7511_state *state = container_of(dwork, struct adv7511_state, edid_handler); - struct v4l2_subdev *sd = &state->sd; -- struct adv7511_edid_detect ed; - - v4l2_dbg(1, debug, sd, "%s:\n", __func__); - -@@ -1191,9 +1202,7 @@ static void adv7511_edid_handler(struct work_struct *work) - } - - /* We failed to read the EDID, so send an event for this. */ -- ed.present = false; -- ed.segment = adv7511_rd(sd, 0xc4); -- v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed); -+ adv7511_notify_no_edid(sd); - v4l2_dbg(1, debug, sd, "%s: no edid found\n", __func__); - } - -@@ -1264,7 +1273,6 @@ static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd) - /* update read only ctrls */ - v4l2_ctrl_s_ctrl(state->hotplug_ctrl, adv7511_have_hotplug(sd) ? 0x1 : 0x0); - v4l2_ctrl_s_ctrl(state->rx_sense_ctrl, adv7511_have_rx_sense(sd) ? 0x1 : 0x0); -- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 0x1 : 0x0); - - if ((status & MASK_ADV7511_HPD_DETECT) && ((status & MASK_ADV7511_MSEN_DETECT) || state->edid.segments)) { - v4l2_dbg(1, debug, sd, "%s: hotplug and (rx-sense or edid)\n", __func__); -@@ -1294,6 +1302,7 @@ static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd) - } - adv7511_s_power(sd, false); - memset(&state->edid, 0, sizeof(struct adv7511_state_edid)); -+ adv7511_notify_no_edid(sd); - } - } - -@@ -1370,6 +1379,7 @@ static bool adv7511_check_edid_status(struct v4l2_subdev *sd) - } - /* one more segment read ok */ - state->edid.segments = segment + 1; -+ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x1); - if (((state->edid.data[0x7e] >> 1) + 1) > state->edid.segments) { - /* Request next EDID segment */ - v4l2_dbg(1, debug, sd, "%s: request segment %d\n", __func__, state->edid.segments); -@@ -1389,7 +1399,6 @@ static bool adv7511_check_edid_status(struct v4l2_subdev *sd) - ed.present = true; - ed.segment = 0; - state->edid_detect_counter++; -- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 0x1 : 0x0); - v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed); - return ed.present; - } -diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c -index 9400e996087b..bedbd51fb77c 100644 ---- a/drivers/media/pci/bt8xx/bttv-driver.c -+++ b/drivers/media/pci/bt8xx/bttv-driver.c -@@ -2334,6 +2334,19 @@ static int bttv_g_fmt_vid_overlay(struct file *file, void *priv, - return 0; - } - -+static void bttv_get_width_mask_vid_cap(const struct bttv_format *fmt, -+ unsigned int *width_mask, -+ unsigned int *width_bias) -+{ -+ if (fmt->flags & FORMAT_FLAGS_PLANAR) { -+ *width_mask = ~15; /* width must be a multiple of 16 pixels */ -+ *width_bias = 8; /* nearest */ -+ } else { -+ *width_mask = ~3; /* width must be a multiple of 4 pixels */ -+ *width_bias = 2; /* nearest */ -+ } -+} -+ - static int bttv_try_fmt_vid_cap(struct file *file, void *priv, - struct v4l2_format *f) - { -@@ -2343,6 +2356,7 @@ static int bttv_try_fmt_vid_cap(struct file *file, void *priv, - enum v4l2_field field; - __s32 width, height; - __s32 height2; -+ unsigned int width_mask, width_bias; - int rc; - - fmt = format_by_fourcc(f->fmt.pix.pixelformat); -@@ -2375,9 +2389,9 @@ static int bttv_try_fmt_vid_cap(struct file *file, void *priv, - width = f->fmt.pix.width; - height = f->fmt.pix.height; - -+ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias); - rc = limit_scaled_size_lock(fh, &width, &height, field, -- /* width_mask: 4 pixels */ ~3, -- /* width_bias: nearest */ 2, -+ width_mask, width_bias, - /* adjust_size */ 1, - /* adjust_crop */ 0); - if (0 != rc) -@@ -2410,6 +2424,7 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv, - struct bttv_fh *fh = priv; - struct bttv *btv = fh->btv; - __s32 width, height; -+ unsigned int width_mask, width_bias; - enum v4l2_field field; - - retval = bttv_switch_type(fh, f->type); -@@ -2424,9 +2439,10 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv, - height = f->fmt.pix.height; - field = f->fmt.pix.field; - -+ fmt = format_by_fourcc(f->fmt.pix.pixelformat); -+ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias); - retval = limit_scaled_size_lock(fh, &width, &height, f->fmt.pix.field, -- /* width_mask: 4 pixels */ ~3, -- /* width_bias: nearest */ 2, -+ width_mask, width_bias, - /* adjust_size */ 1, - /* adjust_crop */ 1); - if (0 != retval) -@@ -2434,8 +2450,6 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv, - - f->fmt.pix.field = field; - -- fmt = format_by_fourcc(f->fmt.pix.pixelformat); -- - /* update our state informations */ - fh->fmt = fmt; - fh->cap.field = f->fmt.pix.field; -diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c -index a63c1366a64e..1293563b7dce 100644 ---- a/drivers/media/pci/saa7134/saa7134-video.c -+++ b/drivers/media/pci/saa7134/saa7134-video.c -@@ -1219,10 +1219,13 @@ static int saa7134_g_fmt_vid_cap(struct file *file, void *priv, - f->fmt.pix.height = dev->height; - f->fmt.pix.field = dev->field; - f->fmt.pix.pixelformat = dev->fmt->fourcc; -- f->fmt.pix.bytesperline = -- (f->fmt.pix.width * dev->fmt->depth) >> 3; -+ if (dev->fmt->planar) -+ f->fmt.pix.bytesperline = f->fmt.pix.width; -+ else -+ f->fmt.pix.bytesperline = -+ (f->fmt.pix.width * dev->fmt->depth) / 8; - f->fmt.pix.sizeimage = -- f->fmt.pix.height * f->fmt.pix.bytesperline; -+ (f->fmt.pix.height * f->fmt.pix.width * dev->fmt->depth) / 8; - f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M; - return 0; - } -@@ -1298,10 +1301,13 @@ static int saa7134_try_fmt_vid_cap(struct file *file, void *priv, - if (f->fmt.pix.height > maxh) - f->fmt.pix.height = maxh; - f->fmt.pix.width &= ~0x03; -- f->fmt.pix.bytesperline = -- (f->fmt.pix.width * fmt->depth) >> 3; -+ if (fmt->planar) -+ f->fmt.pix.bytesperline = f->fmt.pix.width; -+ else -+ f->fmt.pix.bytesperline = -+ (f->fmt.pix.width * fmt->depth) / 8; - f->fmt.pix.sizeimage = -- f->fmt.pix.height * f->fmt.pix.bytesperline; -+ (f->fmt.pix.height * f->fmt.pix.width * fmt->depth) / 8; - f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M; - - return 0; -diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c -index 7d28899f89ce..6efe9d002961 100644 ---- a/drivers/media/platform/coda/coda-bit.c -+++ b/drivers/media/platform/coda/coda-bit.c -@@ -1342,7 +1342,7 @@ static void coda_finish_encode(struct coda_ctx *ctx) - - /* Calculate bytesused field */ - if (dst_buf->sequence == 0) { -- vb2_set_plane_payload(&dst_buf->vb2_buf, 0, -+ vb2_set_plane_payload(&dst_buf->vb2_buf, 0, wr_ptr - start_ptr + - ctx->vpu_header_size[0] + - ctx->vpu_header_size[1] + - ctx->vpu_header_size[2]); -diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c -index 2d782ce94a67..7ae89c684783 100644 ---- a/drivers/media/platform/coda/coda-common.c -+++ b/drivers/media/platform/coda/coda-common.c -@@ -2118,14 +2118,12 @@ static int coda_probe(struct platform_device *pdev) - - pdev_id = of_id ? of_id->data : platform_get_device_id(pdev); - -- if (of_id) { -+ if (of_id) - dev->devtype = of_id->data; -- } else if (pdev_id) { -+ else if (pdev_id) - dev->devtype = &coda_devdata[pdev_id->driver_data]; -- } else { -- ret = -EINVAL; -- goto err_v4l2_register; -- } -+ else -+ return -EINVAL; - - spin_lock_init(&dev->irqlock); - INIT_LIST_HEAD(&dev->instances); -diff --git a/drivers/media/platform/vsp1/vsp1_sru.c b/drivers/media/platform/vsp1/vsp1_sru.c -index 6310acab60e7..d41ae950d1a1 100644 ---- a/drivers/media/platform/vsp1/vsp1_sru.c -+++ b/drivers/media/platform/vsp1/vsp1_sru.c -@@ -154,6 +154,7 @@ static int sru_s_stream(struct v4l2_subdev *subdev, int enable) - mutex_lock(sru->ctrls.lock); - ctrl0 |= vsp1_sru_read(sru, VI6_SRU_CTRL0) - & (VI6_SRU_CTRL0_PARAM0_MASK | VI6_SRU_CTRL0_PARAM1_MASK); -+ vsp1_sru_write(sru, VI6_SRU_CTRL0, ctrl0); - mutex_unlock(sru->ctrls.lock); - - vsp1_sru_write(sru, VI6_SRU_CTRL1, VI6_SRU_CTRL1_PARAM5); -diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c -index 9e29e70a78d7..d8988801dde0 100644 ---- a/drivers/media/usb/au0828/au0828-core.c -+++ b/drivers/media/usb/au0828/au0828-core.c -@@ -192,7 +192,7 @@ static void au0828_usb_disconnect(struct usb_interface *interface) - Set the status so poll routines can check and avoid - access after disconnect. - */ -- dev->dev_state = DEV_DISCONNECTED; -+ set_bit(DEV_DISCONNECTED, &dev->dev_state); - - au0828_rc_unregister(dev); - /* Digital TV */ -diff --git a/drivers/media/usb/au0828/au0828-input.c b/drivers/media/usb/au0828/au0828-input.c -index b0f067971979..3d6687f0407d 100644 ---- a/drivers/media/usb/au0828/au0828-input.c -+++ b/drivers/media/usb/au0828/au0828-input.c -@@ -130,7 +130,7 @@ static int au0828_get_key_au8522(struct au0828_rc *ir) - bool first = true; - - /* do nothing if device is disconnected */ -- if (ir->dev->dev_state == DEV_DISCONNECTED) -+ if (test_bit(DEV_DISCONNECTED, &ir->dev->dev_state)) - return 0; - - /* Check IR int */ -@@ -260,7 +260,7 @@ static void au0828_rc_stop(struct rc_dev *rc) - cancel_delayed_work_sync(&ir->work); - - /* do nothing if device is disconnected */ -- if (ir->dev->dev_state != DEV_DISCONNECTED) { -+ if (!test_bit(DEV_DISCONNECTED, &ir->dev->dev_state)) { - /* Disable IR */ - au8522_rc_clear(ir, 0xe0, 1 << 4); - } -diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c -index a13625722848..8bc69af874a0 100644 ---- a/drivers/media/usb/au0828/au0828-video.c -+++ b/drivers/media/usb/au0828/au0828-video.c -@@ -104,14 +104,13 @@ static inline void print_err_status(struct au0828_dev *dev, - - static int check_dev(struct au0828_dev *dev) - { -- if (dev->dev_state & DEV_DISCONNECTED) { -+ if (test_bit(DEV_DISCONNECTED, &dev->dev_state)) { - pr_info("v4l2 ioctl: device not present\n"); - return -ENODEV; - } - -- if (dev->dev_state & DEV_MISCONFIGURED) { -- pr_info("v4l2 ioctl: device is misconfigured; " -- "close and open it again\n"); -+ if (test_bit(DEV_MISCONFIGURED, &dev->dev_state)) { -+ pr_info("v4l2 ioctl: device is misconfigured; close and open it again\n"); - return -EIO; - } - return 0; -@@ -519,8 +518,8 @@ static inline int au0828_isoc_copy(struct au0828_dev *dev, struct urb *urb) - if (!dev) - return 0; - -- if ((dev->dev_state & DEV_DISCONNECTED) || -- (dev->dev_state & DEV_MISCONFIGURED)) -+ if (test_bit(DEV_DISCONNECTED, &dev->dev_state) || -+ test_bit(DEV_MISCONFIGURED, &dev->dev_state)) - return 0; - - if (urb->status < 0) { -@@ -822,10 +821,10 @@ static int au0828_stream_interrupt(struct au0828_dev *dev) - int ret = 0; - - dev->stream_state = STREAM_INTERRUPT; -- if (dev->dev_state == DEV_DISCONNECTED) -+ if (test_bit(DEV_DISCONNECTED, &dev->dev_state)) - return -ENODEV; - else if (ret) { -- dev->dev_state = DEV_MISCONFIGURED; -+ set_bit(DEV_MISCONFIGURED, &dev->dev_state); - dprintk(1, "%s device is misconfigured!\n", __func__); - return ret; - } -@@ -1014,7 +1013,7 @@ static int au0828_v4l2_open(struct file *filp) - int ret; - - dprintk(1, -- "%s called std_set %d dev_state %d stream users %d users %d\n", -+ "%s called std_set %d dev_state %ld stream users %d users %d\n", - __func__, dev->std_set_in_tuner_core, dev->dev_state, - dev->streaming_users, dev->users); - -@@ -1033,7 +1032,7 @@ static int au0828_v4l2_open(struct file *filp) - au0828_analog_stream_enable(dev); - au0828_analog_stream_reset(dev); - dev->stream_state = STREAM_OFF; -- dev->dev_state |= DEV_INITIALIZED; -+ set_bit(DEV_INITIALIZED, &dev->dev_state); - } - dev->users++; - mutex_unlock(&dev->lock); -@@ -1047,7 +1046,7 @@ static int au0828_v4l2_close(struct file *filp) - struct video_device *vdev = video_devdata(filp); - - dprintk(1, -- "%s called std_set %d dev_state %d stream users %d users %d\n", -+ "%s called std_set %d dev_state %ld stream users %d users %d\n", - __func__, dev->std_set_in_tuner_core, dev->dev_state, - dev->streaming_users, dev->users); - -@@ -1063,7 +1062,7 @@ static int au0828_v4l2_close(struct file *filp) - del_timer_sync(&dev->vbi_timeout); - } - -- if (dev->dev_state == DEV_DISCONNECTED) -+ if (test_bit(DEV_DISCONNECTED, &dev->dev_state)) - goto end; - - if (dev->users == 1) { -@@ -1092,7 +1091,7 @@ static void au0828_init_tuner(struct au0828_dev *dev) - .type = V4L2_TUNER_ANALOG_TV, - }; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - if (dev->std_set_in_tuner_core) -@@ -1164,7 +1163,7 @@ static int vidioc_querycap(struct file *file, void *priv, - struct video_device *vdev = video_devdata(file); - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - strlcpy(cap->driver, "au0828", sizeof(cap->driver)); -@@ -1207,7 +1206,7 @@ static int vidioc_g_fmt_vid_cap(struct file *file, void *priv, - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - f->fmt.pix.width = dev->width; -@@ -1226,7 +1225,7 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv, - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - return au0828_set_format(dev, VIDIOC_TRY_FMT, f); -@@ -1238,7 +1237,7 @@ static int vidioc_s_fmt_vid_cap(struct file *file, void *priv, - struct au0828_dev *dev = video_drvdata(file); - int rc; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - rc = check_dev(dev); -@@ -1260,7 +1259,7 @@ static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id norm) - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - if (norm == dev->std) -@@ -1292,7 +1291,7 @@ static int vidioc_g_std(struct file *file, void *priv, v4l2_std_id *norm) - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - *norm = dev->std; -@@ -1315,7 +1314,7 @@ static int vidioc_enum_input(struct file *file, void *priv, - [AU0828_VMUX_DEBUG] = "tv debug" - }; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - tmp = input->index; -@@ -1345,7 +1344,7 @@ static int vidioc_g_input(struct file *file, void *priv, unsigned int *i) - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - *i = dev->ctrl_input; -@@ -1356,7 +1355,7 @@ static void au0828_s_input(struct au0828_dev *dev, int index) - { - int i; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - switch (AUVI_INPUT(index).type) { -@@ -1441,7 +1440,7 @@ static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a) - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - a->index = dev->ctrl_ainput; -@@ -1461,7 +1460,7 @@ static int vidioc_s_audio(struct file *file, void *priv, const struct v4l2_audio - if (a->index != dev->ctrl_ainput) - return -EINVAL; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - return 0; - } -@@ -1473,7 +1472,7 @@ static int vidioc_g_tuner(struct file *file, void *priv, struct v4l2_tuner *t) - if (t->index != 0) - return -EINVAL; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - strcpy(t->name, "Auvitek tuner"); -@@ -1493,7 +1492,7 @@ static int vidioc_s_tuner(struct file *file, void *priv, - if (t->index != 0) - return -EINVAL; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - au0828_init_tuner(dev); -@@ -1515,7 +1514,7 @@ static int vidioc_g_frequency(struct file *file, void *priv, - - if (freq->tuner != 0) - return -EINVAL; -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - freq->frequency = dev->ctrl_freq; - return 0; -@@ -1530,7 +1529,7 @@ static int vidioc_s_frequency(struct file *file, void *priv, - if (freq->tuner != 0) - return -EINVAL; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - au0828_init_tuner(dev); -@@ -1556,7 +1555,7 @@ static int vidioc_g_fmt_vbi_cap(struct file *file, void *priv, - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - format->fmt.vbi.samples_per_line = dev->vbi_width; -@@ -1582,7 +1581,7 @@ static int vidioc_cropcap(struct file *file, void *priv, - if (cc->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) - return -EINVAL; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - cc->bounds.left = 0; -@@ -1604,7 +1603,7 @@ static int vidioc_g_register(struct file *file, void *priv, - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - reg->val = au0828_read(dev, reg->reg); -@@ -1617,7 +1616,7 @@ static int vidioc_s_register(struct file *file, void *priv, - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - return au0828_writereg(dev, reg->reg, reg->val); -diff --git a/drivers/media/usb/au0828/au0828.h b/drivers/media/usb/au0828/au0828.h -index 8276072bc55a..b28a05d76618 100644 ---- a/drivers/media/usb/au0828/au0828.h -+++ b/drivers/media/usb/au0828/au0828.h -@@ -21,6 +21,7 @@ - - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt - -+#include - #include - #include - #include -@@ -122,9 +123,9 @@ enum au0828_stream_state { - - /* device state */ - enum au0828_dev_state { -- DEV_INITIALIZED = 0x01, -- DEV_DISCONNECTED = 0x02, -- DEV_MISCONFIGURED = 0x04 -+ DEV_INITIALIZED = 0, -+ DEV_DISCONNECTED = 1, -+ DEV_MISCONFIGURED = 2 - }; - - struct au0828_dev; -@@ -248,7 +249,7 @@ struct au0828_dev { - int input_type; - int std_set_in_tuner_core; - unsigned int ctrl_input; -- enum au0828_dev_state dev_state; -+ long unsigned int dev_state; /* defined at enum au0828_dev_state */; - enum au0828_stream_state stream_state; - wait_queue_head_t open; - -diff --git a/drivers/media/usb/pwc/pwc-if.c b/drivers/media/usb/pwc/pwc-if.c -index 086cf1c7bd7d..18aed5dd325e 100644 ---- a/drivers/media/usb/pwc/pwc-if.c -+++ b/drivers/media/usb/pwc/pwc-if.c -@@ -91,6 +91,7 @@ static const struct usb_device_id pwc_device_table [] = { - { USB_DEVICE(0x0471, 0x0312) }, - { USB_DEVICE(0x0471, 0x0313) }, /* the 'new' 720K */ - { USB_DEVICE(0x0471, 0x0329) }, /* Philips SPC 900NC PC Camera */ -+ { USB_DEVICE(0x0471, 0x032C) }, /* Philips SPC 880NC PC Camera */ - { USB_DEVICE(0x069A, 0x0001) }, /* Askey */ - { USB_DEVICE(0x046D, 0x08B0) }, /* Logitech QuickCam Pro 3000 */ - { USB_DEVICE(0x046D, 0x08B1) }, /* Logitech QuickCam Notebook Pro */ -@@ -810,6 +811,11 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id - name = "Philips SPC 900NC webcam"; - type_id = 740; - break; -+ case 0x032C: -+ PWC_INFO("Philips SPC 880NC USB webcam detected.\n"); -+ name = "Philips SPC 880NC webcam"; -+ type_id = 740; -+ break; - default: - return -ENODEV; - break; -diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c -index de9ff3bb8edd..6996ab8db108 100644 ---- a/drivers/media/usb/usbvision/usbvision-video.c -+++ b/drivers/media/usb/usbvision/usbvision-video.c -@@ -1461,13 +1461,6 @@ static int usbvision_probe(struct usb_interface *intf, - printk(KERN_INFO "%s: %s found\n", __func__, - usbvision_device_data[model].model_string); - -- /* -- * this is a security check. -- * an exploit using an incorrect bInterfaceNumber is known -- */ -- if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum]) -- return -ENODEV; -- - if (usbvision_device_data[model].interface >= 0) - interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; - else if (ifnum < dev->actconfig->desc.bNumInterfaces) -diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c -index 8fd84a67478a..019644ff627d 100644 ---- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c -+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c -@@ -415,7 +415,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user - get_user(kp->index, &up->index) || - get_user(kp->type, &up->type) || - get_user(kp->flags, &up->flags) || -- get_user(kp->memory, &up->memory)) -+ get_user(kp->memory, &up->memory) || -+ get_user(kp->length, &up->length)) - return -EFAULT; - - if (V4L2_TYPE_IS_OUTPUT(kp->type)) -@@ -427,9 +428,6 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user - return -EFAULT; - - if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { -- if (get_user(kp->length, &up->length)) -- return -EFAULT; -- - num_planes = kp->length; - if (num_planes == 0) { - kp->m.planes = NULL; -@@ -462,16 +460,14 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user - } else { - switch (kp->memory) { - case V4L2_MEMORY_MMAP: -- if (get_user(kp->length, &up->length) || -- get_user(kp->m.offset, &up->m.offset)) -+ if (get_user(kp->m.offset, &up->m.offset)) - return -EFAULT; - break; - case V4L2_MEMORY_USERPTR: - { - compat_long_t tmp; - -- if (get_user(kp->length, &up->length) || -- get_user(tmp, &up->m.userptr)) -+ if (get_user(tmp, &up->m.userptr)) - return -EFAULT; - - kp->m.userptr = (unsigned long)compat_ptr(tmp); -@@ -513,7 +509,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user - copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) || - put_user(kp->sequence, &up->sequence) || - put_user(kp->reserved2, &up->reserved2) || -- put_user(kp->reserved, &up->reserved)) -+ put_user(kp->reserved, &up->reserved) || -+ put_user(kp->length, &up->length)) - return -EFAULT; - - if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { -@@ -536,13 +533,11 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user - } else { - switch (kp->memory) { - case V4L2_MEMORY_MMAP: -- if (put_user(kp->length, &up->length) || -- put_user(kp->m.offset, &up->m.offset)) -+ if (put_user(kp->m.offset, &up->m.offset)) - return -EFAULT; - break; - case V4L2_MEMORY_USERPTR: -- if (put_user(kp->length, &up->length) || -- put_user(kp->m.userptr, &up->m.userptr)) -+ if (put_user(kp->m.userptr, &up->m.userptr)) - return -EFAULT; - break; - case V4L2_MEMORY_OVERLAY: -diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c -index ff8953ae52d1..d7d7c52a3060 100644 ---- a/drivers/media/v4l2-core/videobuf2-core.c -+++ b/drivers/media/v4l2-core/videobuf2-core.c -@@ -1643,7 +1643,7 @@ static int __vb2_wait_for_done_vb(struct vb2_queue *q, int nonblocking) - * Will sleep if required for nonblocking == false. - */ - static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb, -- int nonblocking) -+ void *pb, int nonblocking) - { - unsigned long flags; - int ret; -@@ -1664,10 +1664,10 @@ static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb, - /* - * Only remove the buffer from done_list if v4l2_buffer can handle all - * the planes. -- * Verifying planes is NOT necessary since it already has been checked -- * before the buffer is queued/prepared. So it can never fail. - */ -- list_del(&(*vb)->done_entry); -+ ret = call_bufop(q, verify_planes_array, *vb, pb); -+ if (!ret) -+ list_del(&(*vb)->done_entry); - spin_unlock_irqrestore(&q->done_lock, flags); - - return ret; -@@ -1746,7 +1746,7 @@ int vb2_core_dqbuf(struct vb2_queue *q, unsigned int *pindex, void *pb, - struct vb2_buffer *vb = NULL; - int ret; - -- ret = __vb2_get_done_vb(q, &vb, nonblocking); -+ ret = __vb2_get_done_vb(q, &vb, pb, nonblocking); - if (ret < 0) - return ret; - -@@ -2293,6 +2293,16 @@ unsigned int vb2_core_poll(struct vb2_queue *q, struct file *file, - return POLLERR; - - /* -+ * If this quirk is set and QBUF hasn't been called yet then -+ * return POLLERR as well. This only affects capture queues, output -+ * queues will always initialize waiting_for_buffers to false. -+ * This quirk is set by V4L2 for backwards compatibility reasons. -+ */ -+ if (q->quirk_poll_must_check_waiting_for_buffers && -+ q->waiting_for_buffers && (req_events & (POLLIN | POLLRDNORM))) -+ return POLLERR; -+ -+ /* - * For output streams you can call write() as long as there are fewer - * buffers queued than there are buffers available. - */ -diff --git a/drivers/media/v4l2-core/videobuf2-memops.c b/drivers/media/v4l2-core/videobuf2-memops.c -index dbec5923fcf0..3c3b517f1d1c 100644 ---- a/drivers/media/v4l2-core/videobuf2-memops.c -+++ b/drivers/media/v4l2-core/videobuf2-memops.c -@@ -49,7 +49,7 @@ struct frame_vector *vb2_create_framevec(unsigned long start, - vec = frame_vector_create(nr); - if (!vec) - return ERR_PTR(-ENOMEM); -- ret = get_vaddr_frames(start, nr, write, 1, vec); -+ ret = get_vaddr_frames(start & PAGE_MASK, nr, write, true, vec); - if (ret < 0) - goto out_destroy; - /* We accept only complete set of PFNs */ -diff --git a/drivers/media/v4l2-core/videobuf2-v4l2.c b/drivers/media/v4l2-core/videobuf2-v4l2.c -index 91f552124050..0b1b8c7b6ce5 100644 ---- a/drivers/media/v4l2-core/videobuf2-v4l2.c -+++ b/drivers/media/v4l2-core/videobuf2-v4l2.c -@@ -765,6 +765,12 @@ int vb2_queue_init(struct vb2_queue *q) - q->is_output = V4L2_TYPE_IS_OUTPUT(q->type); - q->copy_timestamp = (q->timestamp_flags & V4L2_BUF_FLAG_TIMESTAMP_MASK) - == V4L2_BUF_FLAG_TIMESTAMP_COPY; -+ /* -+ * For compatibility with vb1: if QBUF hasn't been called yet, then -+ * return POLLERR as well. This only affects capture queues, output -+ * queues will always initialize waiting_for_buffers to false. -+ */ -+ q->quirk_poll_must_check_waiting_for_buffers = true; - - return vb2_core_queue_init(q); - } -@@ -818,14 +824,6 @@ unsigned int vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait) - poll_wait(file, &fh->wait, wait); - } - -- /* -- * For compatibility with vb1: if QBUF hasn't been called yet, then -- * return POLLERR as well. This only affects capture queues, output -- * queues will always initialize waiting_for_buffers to false. -- */ -- if (q->waiting_for_buffers && (req_events & (POLLIN | POLLRDNORM))) -- return POLLERR; -- - return res | vb2_core_poll(q, file, wait); - } - EXPORT_SYMBOL_GPL(vb2_poll); -diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c -index 1743788f1595..1bbbe877ba7e 100644 ---- a/drivers/mfd/intel-lpss.c -+++ b/drivers/mfd/intel-lpss.c -@@ -453,6 +453,7 @@ int intel_lpss_probe(struct device *dev, - err_remove_ltr: - intel_lpss_debugfs_remove(lpss); - intel_lpss_ltr_hide(lpss); -+ intel_lpss_unregister_clock(lpss); - - err_clk_register: - ida_simple_remove(&intel_lpss_devid_ida, lpss->devid); -diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c -index b7b3e8ee64f2..c30290f33430 100644 ---- a/drivers/mfd/omap-usb-tll.c -+++ b/drivers/mfd/omap-usb-tll.c -@@ -269,6 +269,8 @@ static int usbtll_omap_probe(struct platform_device *pdev) - - if (IS_ERR(tll->ch_clk[i])) - dev_dbg(dev, "can't get clock : %s\n", clkname); -+ else -+ clk_prepare(tll->ch_clk[i]); - } - - pm_runtime_put_sync(dev); -@@ -301,9 +303,12 @@ static int usbtll_omap_remove(struct platform_device *pdev) - tll_dev = NULL; - spin_unlock(&tll_lock); - -- for (i = 0; i < tll->nch; i++) -- if (!IS_ERR(tll->ch_clk[i])) -+ for (i = 0; i < tll->nch; i++) { -+ if (!IS_ERR(tll->ch_clk[i])) { -+ clk_unprepare(tll->ch_clk[i]); - clk_put(tll->ch_clk[i]); -+ } -+ } - - pm_runtime_disable(&pdev->dev); - return 0; -@@ -420,7 +425,7 @@ int omap_tll_enable(struct usbhs_omap_platform_data *pdata) - if (IS_ERR(tll->ch_clk[i])) - continue; - -- r = clk_prepare_enable(tll->ch_clk[i]); -+ r = clk_enable(tll->ch_clk[i]); - if (r) { - dev_err(tll_dev, - "Error enabling ch %d clock: %d\n", i, r); -@@ -448,7 +453,7 @@ int omap_tll_disable(struct usbhs_omap_platform_data *pdata) - for (i = 0; i < tll->nch; i++) { - if (omap_usb_mode_needs_tll(pdata->port_mode[i])) { - if (!IS_ERR(tll->ch_clk[i])) -- clk_disable_unprepare(tll->ch_clk[i]); -+ clk_disable(tll->ch_clk[i]); - } - } - -diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig -index 054fc10cb3b6..b22c03264270 100644 ---- a/drivers/misc/Kconfig -+++ b/drivers/misc/Kconfig -@@ -440,7 +440,7 @@ config ARM_CHARLCD - still useful. - - config BMP085 -- bool -+ tristate - depends on SYSFS - - config BMP085_I2C -diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c -index 15e88078ba1e..f1a0b99f5a9a 100644 ---- a/drivers/misc/ad525x_dpot.c -+++ b/drivers/misc/ad525x_dpot.c -@@ -216,7 +216,7 @@ static s32 dpot_read_i2c(struct dpot_data *dpot, u8 reg) - */ - value = swab16(value); - -- if (dpot->uid == DPOT_UID(AD5271_ID)) -+ if (dpot->uid == DPOT_UID(AD5274_ID)) - value = value >> 2; - return value; - default: -diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c -index 09a406058c46..efbb6945eb18 100644 ---- a/drivers/misc/cxl/irq.c -+++ b/drivers/misc/cxl/irq.c -@@ -288,7 +288,6 @@ unsigned int cxl_map_irq(struct cxl *adapter, irq_hw_number_t hwirq, - void cxl_unmap_irq(unsigned int virq, void *cookie) - { - free_irq(virq, cookie); -- irq_dispose_mapping(virq); - } - - static int cxl_register_one_irq(struct cxl *adapter, -diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c -index cd0403f09267..e79c0371ee6f 100644 ---- a/drivers/misc/mei/amthif.c -+++ b/drivers/misc/mei/amthif.c -@@ -417,8 +417,10 @@ int mei_amthif_irq_read_msg(struct mei_cl *cl, - - dev = cl->dev; - -- if (dev->iamthif_state != MEI_IAMTHIF_READING) -+ if (dev->iamthif_state != MEI_IAMTHIF_READING) { -+ mei_irq_discard_msg(dev, mei_hdr); - return 0; -+ } - - ret = mei_cl_irq_read_msg(cl, mei_hdr, cmpl_list); - if (ret) -diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c -index 0b05aa938799..a77643954523 100644 ---- a/drivers/misc/mei/bus.c -+++ b/drivers/misc/mei/bus.c -@@ -53,6 +53,11 @@ ssize_t __mei_cl_send(struct mei_cl *cl, u8 *buf, size_t length, - bus = cl->dev; - - mutex_lock(&bus->device_lock); -+ if (bus->dev_state != MEI_DEV_ENABLED) { -+ rets = -ENODEV; -+ goto out; -+ } -+ - if (!mei_cl_is_connected(cl)) { - rets = -ENODEV; - goto out; -@@ -109,6 +114,10 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length) - bus = cl->dev; - - mutex_lock(&bus->device_lock); -+ if (bus->dev_state != MEI_DEV_ENABLED) { -+ rets = -ENODEV; -+ goto out; -+ } - - cb = mei_cl_read_cb(cl, NULL); - if (cb) -@@ -213,17 +222,23 @@ EXPORT_SYMBOL_GPL(mei_cldev_recv); - static void mei_cl_bus_event_work(struct work_struct *work) - { - struct mei_cl_device *cldev; -+ struct mei_device *bus; - - cldev = container_of(work, struct mei_cl_device, event_work); - -+ bus = cldev->bus; -+ - if (cldev->event_cb) - cldev->event_cb(cldev, cldev->events, cldev->event_context); - - cldev->events = 0; - - /* Prepare for the next read */ -- if (cldev->events_mask & BIT(MEI_CL_EVENT_RX)) -+ if (cldev->events_mask & BIT(MEI_CL_EVENT_RX)) { -+ mutex_lock(&bus->device_lock); - mei_cl_read_start(cldev->cl, 0, NULL); -+ mutex_unlock(&bus->device_lock); -+ } - } - - /** -@@ -287,6 +302,7 @@ int mei_cldev_register_event_cb(struct mei_cl_device *cldev, - unsigned long events_mask, - mei_cldev_event_cb_t event_cb, void *context) - { -+ struct mei_device *bus = cldev->bus; - int ret; - - if (cldev->event_cb) -@@ -299,15 +315,17 @@ int mei_cldev_register_event_cb(struct mei_cl_device *cldev, - INIT_WORK(&cldev->event_work, mei_cl_bus_event_work); - - if (cldev->events_mask & BIT(MEI_CL_EVENT_RX)) { -+ mutex_lock(&bus->device_lock); - ret = mei_cl_read_start(cldev->cl, 0, NULL); -+ mutex_unlock(&bus->device_lock); - if (ret && ret != -EBUSY) - return ret; - } - - if (cldev->events_mask & BIT(MEI_CL_EVENT_NOTIF)) { -- mutex_lock(&cldev->cl->dev->device_lock); -+ mutex_lock(&bus->device_lock); - ret = mei_cl_notify_request(cldev->cl, NULL, event_cb ? 1 : 0); -- mutex_unlock(&cldev->cl->dev->device_lock); -+ mutex_unlock(&bus->device_lock); - if (ret) - return ret; - } -diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c -index a6c87c713193..958af84884b5 100644 ---- a/drivers/misc/mei/client.c -+++ b/drivers/misc/mei/client.c -@@ -1735,6 +1735,10 @@ void mei_cl_complete(struct mei_cl *cl, struct mei_cl_cb *cb) - wake_up(&cl->wait); - - break; -+ case MEI_FOP_DISCONNECT_RSP: -+ mei_io_cb_free(cb); -+ mei_cl_set_disconnected(cl); -+ break; - default: - BUG_ON(0); - } -diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c -index e7b7aad0999b..fd8a9f057ea6 100644 ---- a/drivers/misc/mei/hbm.c -+++ b/drivers/misc/mei/hbm.c -@@ -873,8 +873,7 @@ static int mei_hbm_fw_disconnect_req(struct mei_device *dev, - cb = mei_io_cb_init(cl, MEI_FOP_DISCONNECT_RSP, NULL); - if (!cb) - return -ENOMEM; -- cl_dbg(dev, cl, "add disconnect response as first\n"); -- list_add(&cb->list, &dev->ctrl_wr_list.list); -+ list_add_tail(&cb->list, &dev->ctrl_wr_list.list); - } - return 0; - } -diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c -index 64b568a0268d..d1df797c7568 100644 ---- a/drivers/misc/mei/interrupt.c -+++ b/drivers/misc/mei/interrupt.c -@@ -76,7 +76,6 @@ static inline int mei_cl_hbm_equal(struct mei_cl *cl, - * @dev: mei device - * @hdr: message header - */ --static inline - void mei_irq_discard_msg(struct mei_device *dev, struct mei_msg_hdr *hdr) - { - /* -@@ -184,10 +183,7 @@ static int mei_cl_irq_disconnect_rsp(struct mei_cl *cl, struct mei_cl_cb *cb, - return -EMSGSIZE; - - ret = mei_hbm_cl_disconnect_rsp(dev, cl); -- mei_cl_set_disconnected(cl); -- mei_io_cb_free(cb); -- mei_me_cl_put(cl->me_cl); -- cl->me_cl = NULL; -+ list_move_tail(&cb->list, &cmpl_list->list); - - return ret; - } -diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h -index 4250555d5e72..1b06e2fd6858 100644 ---- a/drivers/misc/mei/mei_dev.h -+++ b/drivers/misc/mei/mei_dev.h -@@ -782,6 +782,8 @@ bool mei_hbuf_acquire(struct mei_device *dev); - - bool mei_write_is_idle(struct mei_device *dev); - -+void mei_irq_discard_msg(struct mei_device *dev, struct mei_msg_hdr *hdr); -+ - #if IS_ENABLED(CONFIG_DEBUG_FS) - int mei_dbgfs_register(struct mei_device *dev, const char *name); - void mei_dbgfs_deregister(struct mei_device *dev); -diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c -index 8310b4dbff06..6a451bd65bf3 100644 ---- a/drivers/misc/mic/scif/scif_rma.c -+++ b/drivers/misc/mic/scif/scif_rma.c -@@ -1511,7 +1511,7 @@ off_t scif_register_pinned_pages(scif_epd_t epd, - if ((map_flags & SCIF_MAP_FIXED) && - ((ALIGN(offset, PAGE_SIZE) != offset) || - (offset < 0) || -- (offset + (off_t)len < offset))) -+ (len > LONG_MAX - offset))) - return -EINVAL; - - might_sleep(); -@@ -1614,7 +1614,7 @@ off_t scif_register(scif_epd_t epd, void *addr, size_t len, off_t offset, - if ((map_flags & SCIF_MAP_FIXED) && - ((ALIGN(offset, PAGE_SIZE) != offset) || - (offset < 0) || -- (offset + (off_t)len < offset))) -+ (len > LONG_MAX - offset))) - return -EINVAL; - - /* Unsupported protection requested */ -@@ -1732,7 +1732,8 @@ scif_unregister(scif_epd_t epd, off_t offset, size_t len) - - /* Offset is not page aligned or offset+len wraps around */ - if ((ALIGN(offset, PAGE_SIZE) != offset) || -- (offset + (off_t)len < offset)) -+ (offset < 0) || -+ (len > LONG_MAX - offset)) - return -EINVAL; - - err = scif_verify_epd(ep); -diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c -index fe207e542032..7630b6b7eb75 100644 ---- a/drivers/mmc/card/block.c -+++ b/drivers/mmc/card/block.c -@@ -86,7 +86,6 @@ static int max_devices; - - /* TODO: Replace these with struct ida */ - static DECLARE_BITMAP(dev_use, MAX_DEVICES); --static DECLARE_BITMAP(name_use, MAX_DEVICES); - - /* - * There is one mmc_blk_data per slot. -@@ -105,7 +104,6 @@ struct mmc_blk_data { - unsigned int usage; - unsigned int read_only; - unsigned int part_type; -- unsigned int name_idx; - unsigned int reset_done; - #define MMC_BLK_READ BIT(0) - #define MMC_BLK_WRITE BIT(1) -@@ -589,6 +587,14 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev, - struct mmc_card *card; - int err = 0, ioc_err = 0; - -+ /* -+ * The caller must have CAP_SYS_RAWIO, and must be calling this on the -+ * whole block device, not on a partition. This prevents overspray -+ * between sibling partitions. -+ */ -+ if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains)) -+ return -EPERM; -+ - idata = mmc_blk_ioctl_copy_from_user(ic_ptr); - if (IS_ERR(idata)) - return PTR_ERR(idata); -@@ -631,6 +637,14 @@ static int mmc_blk_ioctl_multi_cmd(struct block_device *bdev, - int i, err = 0, ioc_err = 0; - __u64 num_of_cmds; - -+ /* -+ * The caller must have CAP_SYS_RAWIO, and must be calling this on the -+ * whole block device, not on a partition. This prevents overspray -+ * between sibling partitions. -+ */ -+ if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains)) -+ return -EPERM; -+ - if (copy_from_user(&num_of_cmds, &user->num_of_cmds, - sizeof(num_of_cmds))) - return -EFAULT; -@@ -688,14 +702,6 @@ cmd_err: - static int mmc_blk_ioctl(struct block_device *bdev, fmode_t mode, - unsigned int cmd, unsigned long arg) - { -- /* -- * The caller must have CAP_SYS_RAWIO, and must be calling this on the -- * whole block device, not on a partition. This prevents overspray -- * between sibling partitions. -- */ -- if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains)) -- return -EPERM; -- - switch (cmd) { - case MMC_IOC_CMD: - return mmc_blk_ioctl_cmd(bdev, -@@ -2194,19 +2200,6 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card, - goto out; - } - -- /* -- * !subname implies we are creating main mmc_blk_data that will be -- * associated with mmc_card with dev_set_drvdata. Due to device -- * partitions, devidx will not coincide with a per-physical card -- * index anymore so we keep track of a name index. -- */ -- if (!subname) { -- md->name_idx = find_first_zero_bit(name_use, max_devices); -- __set_bit(md->name_idx, name_use); -- } else -- md->name_idx = ((struct mmc_blk_data *) -- dev_to_disk(parent)->private_data)->name_idx; -- - md->area_type = area_type; - - /* -@@ -2256,7 +2249,7 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card, - */ - - snprintf(md->disk->disk_name, sizeof(md->disk->disk_name), -- "mmcblk%u%s", md->name_idx, subname ? subname : ""); -+ "mmcblk%u%s", card->host->index, subname ? subname : ""); - - if (mmc_card_mmc(card)) - blk_queue_logical_block_size(md->queue.queue, -@@ -2410,7 +2403,6 @@ static void mmc_blk_remove_parts(struct mmc_card *card, - struct list_head *pos, *q; - struct mmc_blk_data *part_md; - -- __clear_bit(md->name_idx, name_use); - list_for_each_safe(pos, q, &md->part) { - part_md = list_entry(pos, struct mmc_blk_data, part); - list_del(pos); -@@ -2502,11 +2494,12 @@ static const struct mmc_fixup blk_fixups[] = - MMC_QUIRK_BLK_NO_CMD23), - - /* -- * Some Micron MMC cards needs longer data read timeout than -- * indicated in CSD. -+ * Some MMC cards need longer data read timeout than indicated in CSD. - */ - MMC_FIXUP(CID_NAME_ANY, CID_MANFID_MICRON, 0x200, add_quirk_mmc, - MMC_QUIRK_LONG_READ_TIME), -+ MMC_FIXUP("008GE0", CID_MANFID_TOSHIBA, CID_OEMID_ANY, add_quirk_mmc, -+ MMC_QUIRK_LONG_READ_TIME), - - /* - * On these Samsung MoviNAND parts, performing secure erase or -diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c -index f95d41ffc766..228a81bcea49 100644 ---- a/drivers/mmc/core/core.c -+++ b/drivers/mmc/core/core.c -@@ -868,11 +868,11 @@ void mmc_set_data_timeout(struct mmc_data *data, const struct mmc_card *card) - /* - * Some cards require longer data read timeout than indicated in CSD. - * Address this by setting the read timeout to a "reasonably high" -- * value. For the cards tested, 300ms has proven enough. If necessary, -+ * value. For the cards tested, 600ms has proven enough. If necessary, - * this value can be increased if other problematic cards require this. - */ - if (mmc_card_long_read_time(card) && data->flags & MMC_DATA_READ) { -- data->timeout_ns = 300000000; -+ data->timeout_ns = 600000000; - data->timeout_clks = 0; - } - -diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c -index bf49e44571f2..07a419fedd43 100644 ---- a/drivers/mmc/core/mmc.c -+++ b/drivers/mmc/core/mmc.c -@@ -333,6 +333,9 @@ static void mmc_manage_gp_partitions(struct mmc_card *card, u8 *ext_csd) - } - } - -+/* Minimum partition switch timeout in milliseconds */ -+#define MMC_MIN_PART_SWITCH_TIME 300 -+ - /* - * Decode extended CSD. - */ -@@ -397,6 +400,10 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd) - - /* EXT_CSD value is in units of 10ms, but we store in ms */ - card->ext_csd.part_time = 10 * ext_csd[EXT_CSD_PART_SWITCH_TIME]; -+ /* Some eMMC set the value too low so set a minimum */ -+ if (card->ext_csd.part_time && -+ card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME) -+ card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME; - - /* Sleep / awake timeout in 100ns units */ - if (sa_shift > 0 && sa_shift <= 0x17) -diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig -index 1526b8a10b09..3b944fc70eec 100644 ---- a/drivers/mmc/host/Kconfig -+++ b/drivers/mmc/host/Kconfig -@@ -97,6 +97,7 @@ config MMC_RICOH_MMC - config MMC_SDHCI_ACPI - tristate "SDHCI support for ACPI enumerated SDHCI controllers" - depends on MMC_SDHCI && ACPI -+ select IOSF_MBI if X86 - help - This selects support for ACPI enumerated SDHCI controllers, - identified by ACPI Compatibility ID PNP0D40 or specific -diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c -index 851ccd9ac868..25c179592125 100644 ---- a/drivers/mmc/host/atmel-mci.c -+++ b/drivers/mmc/host/atmel-mci.c -@@ -2443,7 +2443,7 @@ static int atmci_configure_dma(struct atmel_mci *host) - struct mci_platform_data *pdata = host->pdev->dev.platform_data; - dma_cap_mask_t mask; - -- if (!pdata->dma_filter) -+ if (!pdata || !pdata->dma_filter) - return -ENODEV; - - dma_cap_zero(mask); -diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c -index 3446097a43c0..e77d79c8cd9f 100644 ---- a/drivers/mmc/host/mmc_spi.c -+++ b/drivers/mmc/host/mmc_spi.c -@@ -1442,6 +1442,12 @@ static int mmc_spi_probe(struct spi_device *spi) - host->pdata->cd_debounce); - if (status != 0) - goto fail_add_host; -+ -+ /* The platform has a CD GPIO signal that may support -+ * interrupts, so let mmc_gpiod_request_cd_irq() decide -+ * if polling is needed or not. -+ */ -+ mmc->caps &= ~MMC_CAP_NEEDS_POLL; - mmc_gpiod_request_cd_irq(mmc); - } - -diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c -index a5cda926d38e..e517be7f03bf 100644 ---- a/drivers/mmc/host/sdhci-acpi.c -+++ b/drivers/mmc/host/sdhci-acpi.c -@@ -41,6 +41,11 @@ - #include - #include - -+#ifdef CONFIG_X86 -+#include -+#include -+#endif -+ - #include "sdhci.h" - - enum { -@@ -146,6 +151,75 @@ static const struct sdhci_acpi_chip sdhci_acpi_chip_int = { - .ops = &sdhci_acpi_ops_int, - }; - -+#ifdef CONFIG_X86 -+ -+static bool sdhci_acpi_byt(void) -+{ -+ static const struct x86_cpu_id byt[] = { -+ { X86_VENDOR_INTEL, 6, 0x37 }, -+ {} -+ }; -+ -+ return x86_match_cpu(byt); -+} -+ -+#define BYT_IOSF_SCCEP 0x63 -+#define BYT_IOSF_OCP_NETCTRL0 0x1078 -+#define BYT_IOSF_OCP_TIMEOUT_BASE GENMASK(10, 8) -+ -+static void sdhci_acpi_byt_setting(struct device *dev) -+{ -+ u32 val = 0; -+ -+ if (!sdhci_acpi_byt()) -+ return; -+ -+ if (iosf_mbi_read(BYT_IOSF_SCCEP, MBI_CR_READ, BYT_IOSF_OCP_NETCTRL0, -+ &val)) { -+ dev_err(dev, "%s read error\n", __func__); -+ return; -+ } -+ -+ if (!(val & BYT_IOSF_OCP_TIMEOUT_BASE)) -+ return; -+ -+ val &= ~BYT_IOSF_OCP_TIMEOUT_BASE; -+ -+ if (iosf_mbi_write(BYT_IOSF_SCCEP, MBI_CR_WRITE, BYT_IOSF_OCP_NETCTRL0, -+ val)) { -+ dev_err(dev, "%s write error\n", __func__); -+ return; -+ } -+ -+ dev_dbg(dev, "%s completed\n", __func__); -+} -+ -+static bool sdhci_acpi_byt_defer(struct device *dev) -+{ -+ if (!sdhci_acpi_byt()) -+ return false; -+ -+ if (!iosf_mbi_available()) -+ return true; -+ -+ sdhci_acpi_byt_setting(dev); -+ -+ return false; -+} -+ -+#else -+ -+static inline void sdhci_acpi_byt_setting(struct device *dev) -+{ -+} -+ -+static inline bool sdhci_acpi_byt_defer(struct device *dev) -+{ -+ return false; -+} -+ -+#endif -+ - static int bxt_get_cd(struct mmc_host *mmc) - { - int gpio_cd = mmc_gpio_get_cd(mmc); -@@ -233,7 +307,7 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_int_emmc = { - .chip = &sdhci_acpi_chip_int, - .caps = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE | - MMC_CAP_HW_RESET | MMC_CAP_1_8V_DDR | -- MMC_CAP_BUS_WIDTH_TEST | MMC_CAP_WAIT_WHILE_BUSY, -+ MMC_CAP_WAIT_WHILE_BUSY, - .caps2 = MMC_CAP2_HC_ERASE_SZ, - .flags = SDHCI_ACPI_RUNTIME_PM, - .quirks = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC, -@@ -248,7 +322,7 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_int_sdio = { - SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC, - .quirks2 = SDHCI_QUIRK2_HOST_OFF_CARD_ON, - .caps = MMC_CAP_NONREMOVABLE | MMC_CAP_POWER_OFF_CARD | -- MMC_CAP_BUS_WIDTH_TEST | MMC_CAP_WAIT_WHILE_BUSY, -+ MMC_CAP_WAIT_WHILE_BUSY, - .flags = SDHCI_ACPI_RUNTIME_PM, - .pm_caps = MMC_PM_KEEP_POWER, - .probe_slot = sdhci_acpi_sdio_probe_slot, -@@ -260,7 +334,7 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_int_sd = { - .quirks = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC, - .quirks2 = SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON | - SDHCI_QUIRK2_STOP_WITH_TC, -- .caps = MMC_CAP_BUS_WIDTH_TEST | MMC_CAP_WAIT_WHILE_BUSY, -+ .caps = MMC_CAP_WAIT_WHILE_BUSY, - .probe_slot = sdhci_acpi_sd_probe_slot, - }; - -@@ -322,7 +396,7 @@ static int sdhci_acpi_probe(struct platform_device *pdev) - { - struct device *dev = &pdev->dev; - acpi_handle handle = ACPI_HANDLE(dev); -- struct acpi_device *device; -+ struct acpi_device *device, *child; - struct sdhci_acpi_host *c; - struct sdhci_host *host; - struct resource *iomem; -@@ -334,9 +408,17 @@ static int sdhci_acpi_probe(struct platform_device *pdev) - if (acpi_bus_get_device(handle, &device)) - return -ENODEV; - -+ /* Power on the SDHCI controller and its children */ -+ acpi_device_fix_up_power(device); -+ list_for_each_entry(child, &device->children, node) -+ acpi_device_fix_up_power(child); -+ - if (acpi_bus_get_status(device) || !device->status.present) - return -ENODEV; - -+ if (sdhci_acpi_byt_defer(dev)) -+ return -EPROBE_DEFER; -+ - hid = acpi_device_hid(device); - uid = device->pnp.unique_id; - -@@ -460,6 +542,8 @@ static int sdhci_acpi_resume(struct device *dev) - { - struct sdhci_acpi_host *c = dev_get_drvdata(dev); - -+ sdhci_acpi_byt_setting(&c->pdev->dev); -+ - return sdhci_resume_host(c->host); - } - -@@ -483,6 +567,8 @@ static int sdhci_acpi_runtime_resume(struct device *dev) - { - struct sdhci_acpi_host *c = dev_get_drvdata(dev); - -+ sdhci_acpi_byt_setting(&c->pdev->dev); -+ - return sdhci_runtime_resume_host(c->host); - } - -diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c -index df3b8eced8c4..807f930a7c14 100644 ---- a/drivers/mmc/host/sdhci-pci-core.c -+++ b/drivers/mmc/host/sdhci-pci-core.c -@@ -361,7 +361,6 @@ static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot) - { - slot->host->mmc->caps |= MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE | - MMC_CAP_HW_RESET | MMC_CAP_1_8V_DDR | -- MMC_CAP_BUS_WIDTH_TEST | - MMC_CAP_WAIT_WHILE_BUSY; - slot->host->mmc->caps2 |= MMC_CAP2_HC_ERASE_SZ; - slot->hw_reset = sdhci_pci_int_hw_reset; -@@ -377,19 +376,18 @@ static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot) - static int byt_sdio_probe_slot(struct sdhci_pci_slot *slot) - { - slot->host->mmc->caps |= MMC_CAP_POWER_OFF_CARD | MMC_CAP_NONREMOVABLE | -- MMC_CAP_BUS_WIDTH_TEST | - MMC_CAP_WAIT_WHILE_BUSY; - return 0; - } - - static int byt_sd_probe_slot(struct sdhci_pci_slot *slot) - { -- slot->host->mmc->caps |= MMC_CAP_BUS_WIDTH_TEST | -- MMC_CAP_WAIT_WHILE_BUSY; -+ slot->host->mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY; - slot->cd_con_id = NULL; - slot->cd_idx = 0; - slot->cd_override_level = true; - if (slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXT_SD || -+ slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXTM_SD || - slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_APL_SD) - slot->host->mmc_host_ops.get_cd = bxt_get_cd; - -@@ -1173,6 +1171,30 @@ static const struct pci_device_id pci_ids[] = { - - { - .vendor = PCI_VENDOR_ID_INTEL, -+ .device = PCI_DEVICE_ID_INTEL_BXTM_EMMC, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_emmc, -+ }, -+ -+ { -+ .vendor = PCI_VENDOR_ID_INTEL, -+ .device = PCI_DEVICE_ID_INTEL_BXTM_SDIO, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sdio, -+ }, -+ -+ { -+ .vendor = PCI_VENDOR_ID_INTEL, -+ .device = PCI_DEVICE_ID_INTEL_BXTM_SD, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sd, -+ }, -+ -+ { -+ .vendor = PCI_VENDOR_ID_INTEL, - .device = PCI_DEVICE_ID_INTEL_APL_EMMC, - .subvendor = PCI_ANY_ID, - .subdevice = PCI_ANY_ID, -diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h -index d1a0b4db60db..89e7151684a1 100644 ---- a/drivers/mmc/host/sdhci-pci.h -+++ b/drivers/mmc/host/sdhci-pci.h -@@ -28,6 +28,9 @@ - #define PCI_DEVICE_ID_INTEL_BXT_SD 0x0aca - #define PCI_DEVICE_ID_INTEL_BXT_EMMC 0x0acc - #define PCI_DEVICE_ID_INTEL_BXT_SDIO 0x0ad0 -+#define PCI_DEVICE_ID_INTEL_BXTM_SD 0x1aca -+#define PCI_DEVICE_ID_INTEL_BXTM_EMMC 0x1acc -+#define PCI_DEVICE_ID_INTEL_BXTM_SDIO 0x1ad0 - #define PCI_DEVICE_ID_INTEL_APL_SD 0x5aca - #define PCI_DEVICE_ID_INTEL_APL_EMMC 0x5acc - #define PCI_DEVICE_ID_INTEL_APL_SDIO 0x5ad0 -diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c -index f5edf9d3a18a..452bf500c82e 100644 ---- a/drivers/mmc/host/sdhci-pxav3.c -+++ b/drivers/mmc/host/sdhci-pxav3.c -@@ -137,6 +137,10 @@ static int armada_38x_quirks(struct platform_device *pdev, - - host->quirks &= ~SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN; - host->quirks |= SDHCI_QUIRK_MISSING_CAPS; -+ -+ host->caps = sdhci_readl(host, SDHCI_CAPABILITIES); -+ host->caps1 = sdhci_readl(host, SDHCI_CAPABILITIES_1); -+ - res = platform_get_resource_byname(pdev, IORESOURCE_MEM, - "conf-sdio3"); - if (res) { -@@ -150,7 +154,6 @@ static int armada_38x_quirks(struct platform_device *pdev, - * Configuration register, if the adjustment is not done, - * remove them from the capabilities. - */ -- host->caps1 = sdhci_readl(host, SDHCI_CAPABILITIES_1); - host->caps1 &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_DDR50); - - dev_warn(&pdev->dev, "conf-sdio3 register not found: disabling SDR50 and DDR50 modes.\nConsider updating your dtb\n"); -@@ -161,7 +164,6 @@ static int armada_38x_quirks(struct platform_device *pdev, - * controller has different capabilities than the ones shown - * in its registers - */ -- host->caps = sdhci_readl(host, SDHCI_CAPABILITIES); - if (of_property_read_bool(np, "no-1-8-v")) { - host->caps &= ~SDHCI_CAN_VDD_180; - host->mmc->caps &= ~MMC_CAP_1_8V_DDR; -@@ -307,8 +309,30 @@ static void pxav3_set_uhs_signaling(struct sdhci_host *host, unsigned int uhs) - __func__, uhs, ctrl_2); - } - -+static void pxav3_set_power(struct sdhci_host *host, unsigned char mode, -+ unsigned short vdd) -+{ -+ struct mmc_host *mmc = host->mmc; -+ u8 pwr = host->pwr; -+ -+ sdhci_set_power(host, mode, vdd); -+ -+ if (host->pwr == pwr) -+ return; -+ -+ if (host->pwr == 0) -+ vdd = 0; -+ -+ if (!IS_ERR(mmc->supply.vmmc)) { -+ spin_unlock_irq(&host->lock); -+ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); -+ spin_lock_irq(&host->lock); -+ } -+} -+ - static const struct sdhci_ops pxav3_sdhci_ops = { - .set_clock = sdhci_set_clock, -+ .set_power = pxav3_set_power, - .platform_send_init_74_clocks = pxav3_gen_init_74_clocks, - .get_max_clock = sdhci_pltfm_clk_get_max_clock, - .set_bus_width = sdhci_set_bus_width, -diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c -index 83c4bf7bc16c..0004721cd213 100644 ---- a/drivers/mmc/host/sdhci-tegra.c -+++ b/drivers/mmc/host/sdhci-tegra.c -@@ -147,10 +147,16 @@ static void tegra_sdhci_reset(struct sdhci_host *host, u8 mask) - /* Advertise UHS modes as supported by host */ - if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR50) - misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR50; -+ else -+ misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_SDR50; - if (soc_data->nvquirks & NVQUIRK_ENABLE_DDR50) - misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_DDR50; -+ else -+ misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_DDR50; - if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR104) - misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR104; -+ else -+ misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_SDR104; - sdhci_writel(host, misc_ctrl, SDHCI_TEGRA_VENDOR_MISC_CTRL); - - clk_ctrl = sdhci_readl(host, SDHCI_TEGRA_VENDOR_CLOCK_CTRL); -@@ -188,7 +194,7 @@ static void tegra_sdhci_set_clock(struct sdhci_host *host, unsigned int clock) - unsigned long host_clk; - - if (!clock) -- return; -+ return sdhci_set_clock(host, clock); - - host_clk = tegra_host->ddr_signaling ? clock * 2 : clock; - clk_set_rate(pltfm_host->clk, host_clk); -@@ -335,6 +341,10 @@ static const struct sdhci_pltfm_data sdhci_tegra114_pdata = { - - static const struct sdhci_tegra_soc_data soc_data_tegra114 = { - .pdata = &sdhci_tegra114_pdata, -+}; -+ -+static const struct sdhci_tegra_soc_data soc_data_tegra124 = { -+ .pdata = &sdhci_tegra114_pdata, - .nvquirks = NVQUIRK_ENABLE_SDR50 | - NVQUIRK_ENABLE_DDR50 | - NVQUIRK_ENABLE_SDR104, -@@ -357,7 +367,7 @@ static const struct sdhci_tegra_soc_data soc_data_tegra210 = { - - static const struct of_device_id sdhci_tegra_dt_match[] = { - { .compatible = "nvidia,tegra210-sdhci", .data = &soc_data_tegra210 }, -- { .compatible = "nvidia,tegra124-sdhci", .data = &soc_data_tegra114 }, -+ { .compatible = "nvidia,tegra124-sdhci", .data = &soc_data_tegra124 }, - { .compatible = "nvidia,tegra114-sdhci", .data = &soc_data_tegra114 }, - { .compatible = "nvidia,tegra30-sdhci", .data = &soc_data_tegra30 }, - { .compatible = "nvidia,tegra20-sdhci", .data = &soc_data_tegra20 }, -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index add9fdfd1d8f..6d485b5fa5ca 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -465,8 +465,6 @@ static void sdhci_adma_mark_end(void *desc) - static int sdhci_adma_table_pre(struct sdhci_host *host, - struct mmc_data *data) - { -- int direction; -- - void *desc; - void *align; - dma_addr_t addr; -@@ -483,20 +481,9 @@ static int sdhci_adma_table_pre(struct sdhci_host *host, - * We currently guess that it is LE. - */ - -- if (data->flags & MMC_DATA_READ) -- direction = DMA_FROM_DEVICE; -- else -- direction = DMA_TO_DEVICE; -- -- host->align_addr = dma_map_single(mmc_dev(host->mmc), -- host->align_buffer, host->align_buffer_sz, direction); -- if (dma_mapping_error(mmc_dev(host->mmc), host->align_addr)) -- goto fail; -- BUG_ON(host->align_addr & SDHCI_ADMA2_MASK); -- - host->sg_count = sdhci_pre_dma_transfer(host, data); - if (host->sg_count < 0) -- goto unmap_align; -+ return -EINVAL; - - desc = host->adma_table; - align = host->align_buffer; -@@ -570,22 +557,7 @@ static int sdhci_adma_table_pre(struct sdhci_host *host, - /* nop, end, valid */ - sdhci_adma_write_desc(host, desc, 0, 0, ADMA2_NOP_END_VALID); - } -- -- /* -- * Resync align buffer as we might have changed it. -- */ -- if (data->flags & MMC_DATA_WRITE) { -- dma_sync_single_for_device(mmc_dev(host->mmc), -- host->align_addr, host->align_buffer_sz, direction); -- } -- - return 0; -- --unmap_align: -- dma_unmap_single(mmc_dev(host->mmc), host->align_addr, -- host->align_buffer_sz, direction); --fail: -- return -EINVAL; - } - - static void sdhci_adma_table_post(struct sdhci_host *host, -@@ -605,9 +577,6 @@ static void sdhci_adma_table_post(struct sdhci_host *host, - else - direction = DMA_TO_DEVICE; - -- dma_unmap_single(mmc_dev(host->mmc), host->align_addr, -- host->align_buffer_sz, direction); -- - /* Do a quick scan of the SG list for any unaligned mappings */ - has_unaligned = false; - for_each_sg(data->sg, sg, host->sg_count, i) -@@ -666,9 +635,20 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd) - if (!data) - target_timeout = cmd->busy_timeout * 1000; - else { -- target_timeout = data->timeout_ns / 1000; -- if (host->clock) -- target_timeout += data->timeout_clks / host->clock; -+ target_timeout = DIV_ROUND_UP(data->timeout_ns, 1000); -+ if (host->clock && data->timeout_clks) { -+ unsigned long long val; -+ -+ /* -+ * data->timeout_clks is in units of clock cycles. -+ * host->clock is in Hz. target_timeout is in us. -+ * Hence, us = 1000000 * cycles / Hz. Round up. -+ */ -+ val = 1000000 * data->timeout_clks; -+ if (do_div(val, host->clock)) -+ target_timeout++; -+ target_timeout += val; -+ } - } - - /* -@@ -1003,6 +983,9 @@ void sdhci_send_command(struct sdhci_host *host, struct mmc_command *cmd) - - WARN_ON(host->cmd); - -+ /* Initially, a command has no error */ -+ cmd->error = 0; -+ - /* Wait max 10 ms */ - timeout = 10; - -@@ -1097,8 +1080,6 @@ static void sdhci_finish_command(struct sdhci_host *host) - } - } - -- host->cmd->error = 0; -- - /* Finished CMD23, now send actual command. */ - if (host->cmd == host->mrq->sbc) { - host->cmd = NULL; -@@ -1269,10 +1250,24 @@ clock_set: - } - EXPORT_SYMBOL_GPL(sdhci_set_clock); - --static void sdhci_set_power(struct sdhci_host *host, unsigned char mode, -- unsigned short vdd) -+static void sdhci_set_power_reg(struct sdhci_host *host, unsigned char mode, -+ unsigned short vdd) - { - struct mmc_host *mmc = host->mmc; -+ -+ spin_unlock_irq(&host->lock); -+ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); -+ spin_lock_irq(&host->lock); -+ -+ if (mode != MMC_POWER_OFF) -+ sdhci_writeb(host, SDHCI_POWER_ON, SDHCI_POWER_CONTROL); -+ else -+ sdhci_writeb(host, 0, SDHCI_POWER_CONTROL); -+} -+ -+void sdhci_set_power(struct sdhci_host *host, unsigned char mode, -+ unsigned short vdd) -+{ - u8 pwr = 0; - - if (mode != MMC_POWER_OFF) { -@@ -1304,7 +1299,6 @@ static void sdhci_set_power(struct sdhci_host *host, unsigned char mode, - sdhci_writeb(host, 0, SDHCI_POWER_CONTROL); - if (host->quirks2 & SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON) - sdhci_runtime_pm_bus_off(host); -- vdd = 0; - } else { - /* - * Spec says that we should clear the power reg before setting -@@ -1335,12 +1329,20 @@ static void sdhci_set_power(struct sdhci_host *host, unsigned char mode, - if (host->quirks & SDHCI_QUIRK_DELAY_AFTER_POWER) - mdelay(10); - } -+} -+EXPORT_SYMBOL_GPL(sdhci_set_power); - -- if (!IS_ERR(mmc->supply.vmmc)) { -- spin_unlock_irq(&host->lock); -- mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); -- spin_lock_irq(&host->lock); -- } -+static void __sdhci_set_power(struct sdhci_host *host, unsigned char mode, -+ unsigned short vdd) -+{ -+ struct mmc_host *mmc = host->mmc; -+ -+ if (host->ops->set_power) -+ host->ops->set_power(host, mode, vdd); -+ else if (!IS_ERR(mmc->supply.vmmc)) -+ sdhci_set_power_reg(host, mode, vdd); -+ else -+ sdhci_set_power(host, mode, vdd); - } - - /*****************************************************************************\ -@@ -1490,7 +1492,7 @@ static void sdhci_do_set_ios(struct sdhci_host *host, struct mmc_ios *ios) - } - } - -- sdhci_set_power(host, ios->power_mode, ios->vdd); -+ __sdhci_set_power(host, ios->power_mode, ios->vdd); - - if (host->ops->platform_send_init_74_clocks) - host->ops->platform_send_init_74_clocks(host, ios->power_mode); -@@ -2114,14 +2116,13 @@ static void sdhci_post_req(struct mmc_host *mmc, struct mmc_request *mrq, - struct sdhci_host *host = mmc_priv(mmc); - struct mmc_data *data = mrq->data; - -- if (host->flags & SDHCI_REQ_USE_DMA) { -- if (data->host_cookie == COOKIE_GIVEN || -- data->host_cookie == COOKIE_MAPPED) -- dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len, -- data->flags & MMC_DATA_WRITE ? -- DMA_TO_DEVICE : DMA_FROM_DEVICE); -- data->host_cookie = COOKIE_UNMAPPED; -- } -+ if (data->host_cookie == COOKIE_GIVEN || -+ data->host_cookie == COOKIE_MAPPED) -+ dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len, -+ data->flags & MMC_DATA_WRITE ? -+ DMA_TO_DEVICE : DMA_FROM_DEVICE); -+ -+ data->host_cookie = COOKIE_UNMAPPED; - } - - static int sdhci_pre_dma_transfer(struct sdhci_host *host, -@@ -2238,6 +2239,22 @@ static void sdhci_tasklet_finish(unsigned long param) - mrq = host->mrq; - - /* -+ * Always unmap the data buffers if they were mapped by -+ * sdhci_prepare_data() whenever we finish with a request. -+ * This avoids leaking DMA mappings on error. -+ */ -+ if (host->flags & SDHCI_REQ_USE_DMA) { -+ struct mmc_data *data = mrq->data; -+ -+ if (data && data->host_cookie == COOKIE_MAPPED) { -+ dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len, -+ (data->flags & MMC_DATA_READ) ? -+ DMA_FROM_DEVICE : DMA_TO_DEVICE); -+ data->host_cookie = COOKIE_UNMAPPED; -+ } -+ } -+ -+ /* - * The controller needs a reset of internal state machines - * upon error conditions. - */ -@@ -2322,13 +2339,30 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *mask) - return; - } - -- if (intmask & SDHCI_INT_TIMEOUT) -- host->cmd->error = -ETIMEDOUT; -- else if (intmask & (SDHCI_INT_CRC | SDHCI_INT_END_BIT | -- SDHCI_INT_INDEX)) -- host->cmd->error = -EILSEQ; -+ if (intmask & (SDHCI_INT_TIMEOUT | SDHCI_INT_CRC | -+ SDHCI_INT_END_BIT | SDHCI_INT_INDEX)) { -+ if (intmask & SDHCI_INT_TIMEOUT) -+ host->cmd->error = -ETIMEDOUT; -+ else -+ host->cmd->error = -EILSEQ; -+ -+ /* -+ * If this command initiates a data phase and a response -+ * CRC error is signalled, the card can start transferring -+ * data - the card may have received the command without -+ * error. We must not terminate the mmc_request early. -+ * -+ * If the card did not receive the command or returned an -+ * error which prevented it sending data, the data phase -+ * will time out. -+ */ -+ if (host->cmd->data && -+ (intmask & (SDHCI_INT_CRC | SDHCI_INT_TIMEOUT)) == -+ SDHCI_INT_CRC) { -+ host->cmd = NULL; -+ return; -+ } - -- if (host->cmd->error) { - tasklet_schedule(&host->finish_tasklet); - return; - } -@@ -2967,14 +3001,21 @@ int sdhci_add_host(struct sdhci_host *host) - &host->adma_addr, - GFP_KERNEL); - host->align_buffer_sz = SDHCI_MAX_SEGS * SDHCI_ADMA2_ALIGN; -- host->align_buffer = kmalloc(host->align_buffer_sz, GFP_KERNEL); -+ host->align_buffer = dma_alloc_coherent(mmc_dev(mmc), -+ host->align_buffer_sz, -+ &host->align_addr, -+ GFP_KERNEL); - if (!host->adma_table || !host->align_buffer) { - if (host->adma_table) - dma_free_coherent(mmc_dev(mmc), - host->adma_table_sz, - host->adma_table, - host->adma_addr); -- kfree(host->align_buffer); -+ if (host->align_buffer) -+ dma_free_coherent(mmc_dev(mmc), -+ host->align_buffer_sz, -+ host->align_buffer, -+ host->align_addr); - pr_warn("%s: Unable to allocate ADMA buffers - falling back to standard DMA\n", - mmc_hostname(mmc)); - host->flags &= ~SDHCI_USE_ADMA; -@@ -2986,10 +3027,14 @@ int sdhci_add_host(struct sdhci_host *host) - host->flags &= ~SDHCI_USE_ADMA; - dma_free_coherent(mmc_dev(mmc), host->adma_table_sz, - host->adma_table, host->adma_addr); -- kfree(host->align_buffer); -+ dma_free_coherent(mmc_dev(mmc), host->align_buffer_sz, -+ host->align_buffer, host->align_addr); - host->adma_table = NULL; - host->align_buffer = NULL; - } -+ -+ /* dma_alloc_coherent returns page aligned and sized buffers */ -+ BUG_ON(host->align_addr & SDHCI_ADMA2_MASK); - } - - /* -@@ -3072,14 +3117,14 @@ int sdhci_add_host(struct sdhci_host *host) - if (caps[0] & SDHCI_TIMEOUT_CLK_UNIT) - host->timeout_clk *= 1000; - -+ if (override_timeout_clk) -+ host->timeout_clk = override_timeout_clk; -+ - mmc->max_busy_timeout = host->ops->get_max_timeout_count ? - host->ops->get_max_timeout_count(host) : 1 << 27; - mmc->max_busy_timeout /= host->timeout_clk; - } - -- if (override_timeout_clk) -- host->timeout_clk = override_timeout_clk; -- - mmc->caps |= MMC_CAP_SDIO_IRQ | MMC_CAP_ERASE | MMC_CAP_CMD23; - mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD; - -@@ -3452,7 +3497,9 @@ void sdhci_remove_host(struct sdhci_host *host, int dead) - if (host->adma_table) - dma_free_coherent(mmc_dev(mmc), host->adma_table_sz, - host->adma_table, host->adma_addr); -- kfree(host->align_buffer); -+ if (host->align_buffer) -+ dma_free_coherent(mmc_dev(mmc), host->align_buffer_sz, -+ host->align_buffer, host->align_addr); - - host->adma_table = NULL; - host->align_buffer = NULL; -diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h -index 0115e9907bf8..033d72b5bbd5 100644 ---- a/drivers/mmc/host/sdhci.h -+++ b/drivers/mmc/host/sdhci.h -@@ -529,6 +529,8 @@ struct sdhci_ops { - #endif - - void (*set_clock)(struct sdhci_host *host, unsigned int clock); -+ void (*set_power)(struct sdhci_host *host, unsigned char mode, -+ unsigned short vdd); - - int (*enable_dma)(struct sdhci_host *host); - unsigned int (*get_max_clock)(struct sdhci_host *host); -@@ -660,6 +662,8 @@ static inline bool sdhci_sdio_irq_enabled(struct sdhci_host *host) - } - - void sdhci_set_clock(struct sdhci_host *host, unsigned int clock); -+void sdhci_set_power(struct sdhci_host *host, unsigned char mode, -+ unsigned short vdd); - void sdhci_set_bus_width(struct sdhci_host *host, int width); - void sdhci_reset(struct sdhci_host *host, u8 mask); - void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing); -diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c -index 844fc07d22cd..f7009c1cb90c 100644 ---- a/drivers/mtd/nand/brcmnand/brcmnand.c -+++ b/drivers/mtd/nand/brcmnand/brcmnand.c -@@ -311,6 +311,36 @@ static const u16 brcmnand_regs_v60[] = { - [BRCMNAND_FC_BASE] = 0x400, - }; - -+/* BRCMNAND v7.1 */ -+static const u16 brcmnand_regs_v71[] = { -+ [BRCMNAND_CMD_START] = 0x04, -+ [BRCMNAND_CMD_EXT_ADDRESS] = 0x08, -+ [BRCMNAND_CMD_ADDRESS] = 0x0c, -+ [BRCMNAND_INTFC_STATUS] = 0x14, -+ [BRCMNAND_CS_SELECT] = 0x18, -+ [BRCMNAND_CS_XOR] = 0x1c, -+ [BRCMNAND_LL_OP] = 0x20, -+ [BRCMNAND_CS0_BASE] = 0x50, -+ [BRCMNAND_CS1_BASE] = 0, -+ [BRCMNAND_CORR_THRESHOLD] = 0xdc, -+ [BRCMNAND_CORR_THRESHOLD_EXT] = 0xe0, -+ [BRCMNAND_UNCORR_COUNT] = 0xfc, -+ [BRCMNAND_CORR_COUNT] = 0x100, -+ [BRCMNAND_CORR_EXT_ADDR] = 0x10c, -+ [BRCMNAND_CORR_ADDR] = 0x110, -+ [BRCMNAND_UNCORR_EXT_ADDR] = 0x114, -+ [BRCMNAND_UNCORR_ADDR] = 0x118, -+ [BRCMNAND_SEMAPHORE] = 0x150, -+ [BRCMNAND_ID] = 0x194, -+ [BRCMNAND_ID_EXT] = 0x198, -+ [BRCMNAND_LL_RDATA] = 0x19c, -+ [BRCMNAND_OOB_READ_BASE] = 0x200, -+ [BRCMNAND_OOB_READ_10_BASE] = 0, -+ [BRCMNAND_OOB_WRITE_BASE] = 0x280, -+ [BRCMNAND_OOB_WRITE_10_BASE] = 0, -+ [BRCMNAND_FC_BASE] = 0x400, -+}; -+ - enum brcmnand_cs_reg { - BRCMNAND_CS_CFG_EXT = 0, - BRCMNAND_CS_CFG, -@@ -406,7 +436,9 @@ static int brcmnand_revision_init(struct brcmnand_controller *ctrl) - } - - /* Register offsets */ -- if (ctrl->nand_version >= 0x0600) -+ if (ctrl->nand_version >= 0x0701) -+ ctrl->reg_offsets = brcmnand_regs_v71; -+ else if (ctrl->nand_version >= 0x0600) - ctrl->reg_offsets = brcmnand_regs_v60; - else if (ctrl->nand_version >= 0x0500) - ctrl->reg_offsets = brcmnand_regs_v50; -diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c -index f2c8ff398d6c..171d146645ba 100644 ---- a/drivers/mtd/nand/nand_base.c -+++ b/drivers/mtd/nand/nand_base.c -@@ -4021,7 +4021,6 @@ static int nand_dt_init(struct nand_chip *chip) - * This is the first phase of the normal nand_scan() function. It reads the - * flash ID and sets up MTD fields accordingly. - * -- * The mtd->owner field must be set to the module of the caller. - */ - int nand_scan_ident(struct mtd_info *mtd, int maxchips, - struct nand_flash_dev *table) -@@ -4443,19 +4442,12 @@ EXPORT_SYMBOL(nand_scan_tail); - * - * This fills out all the uninitialized function pointers with the defaults. - * The flash ID is read and the mtd/chip structures are filled with the -- * appropriate values. The mtd->owner field must be set to the module of the -- * caller. -+ * appropriate values. - */ - int nand_scan(struct mtd_info *mtd, int maxchips) - { - int ret; - -- /* Many callers got this wrong, so check for it for a while... */ -- if (!mtd->owner && caller_is_module()) { -- pr_crit("%s called with NULL mtd->owner!\n", __func__); -- BUG(); -- } -- - ret = nand_scan_ident(mtd, maxchips, NULL); - if (!ret) - ret = nand_scan_tail(mtd); -diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c -index 86fc245dc71a..fd78644469fa 100644 ---- a/drivers/mtd/nand/pxa3xx_nand.c -+++ b/drivers/mtd/nand/pxa3xx_nand.c -@@ -1738,7 +1738,7 @@ static int alloc_nand_resource(struct platform_device *pdev) - if (ret < 0) - return ret; - -- if (use_dma) { -+ if (!np && use_dma) { - r = platform_get_resource(pdev, IORESOURCE_DMA, 0); - if (r == NULL) { - dev_err(&pdev->dev, -diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c -index 43b3392ffee7..652d01832873 100644 ---- a/drivers/mtd/onenand/onenand_base.c -+++ b/drivers/mtd/onenand/onenand_base.c -@@ -2599,6 +2599,7 @@ static int onenand_default_block_markbad(struct mtd_info *mtd, loff_t ofs) - */ - static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs) - { -+ struct onenand_chip *this = mtd->priv; - int ret; - - ret = onenand_block_isbad(mtd, ofs); -@@ -2610,7 +2611,7 @@ static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs) - } - - onenand_get_device(mtd, FL_WRITING); -- ret = mtd_block_markbad(mtd, ofs); -+ ret = this->block_markbad(mtd, ofs); - onenand_release_device(mtd); - return ret; - } -diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c -index ed0c19c558b5..3028c06547c1 100644 ---- a/drivers/mtd/spi-nor/spi-nor.c -+++ b/drivers/mtd/spi-nor/spi-nor.c -@@ -1100,45 +1100,6 @@ static int spansion_quad_enable(struct spi_nor *nor) - return 0; - } - --static int micron_quad_enable(struct spi_nor *nor) --{ -- int ret; -- u8 val; -- -- ret = nor->read_reg(nor, SPINOR_OP_RD_EVCR, &val, 1); -- if (ret < 0) { -- dev_err(nor->dev, "error %d reading EVCR\n", ret); -- return ret; -- } -- -- write_enable(nor); -- -- /* set EVCR, enable quad I/O */ -- nor->cmd_buf[0] = val & ~EVCR_QUAD_EN_MICRON; -- ret = nor->write_reg(nor, SPINOR_OP_WD_EVCR, nor->cmd_buf, 1); -- if (ret < 0) { -- dev_err(nor->dev, "error while writing EVCR register\n"); -- return ret; -- } -- -- ret = spi_nor_wait_till_ready(nor); -- if (ret) -- return ret; -- -- /* read EVCR and check it */ -- ret = nor->read_reg(nor, SPINOR_OP_RD_EVCR, &val, 1); -- if (ret < 0) { -- dev_err(nor->dev, "error %d reading EVCR\n", ret); -- return ret; -- } -- if (val & EVCR_QUAD_EN_MICRON) { -- dev_err(nor->dev, "Micron EVCR Quad bit not clear\n"); -- return -EINVAL; -- } -- -- return 0; --} -- - static int set_quad_mode(struct spi_nor *nor, const struct flash_info *info) - { - int status; -@@ -1152,12 +1113,7 @@ static int set_quad_mode(struct spi_nor *nor, const struct flash_info *info) - } - return status; - case SNOR_MFR_MICRON: -- status = micron_quad_enable(nor); -- if (status) { -- dev_err(nor->dev, "Micron quad-read not enabled\n"); -- return -EINVAL; -- } -- return status; -+ return 0; - default: - status = spansion_quad_enable(nor); - if (status) { -diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c -index 5b9834cf2820..96fddb016bf1 100644 ---- a/drivers/mtd/ubi/eba.c -+++ b/drivers/mtd/ubi/eba.c -@@ -426,8 +426,25 @@ retry: - pnum, vol_id, lnum); - err = -EBADMSG; - } else { -- err = -EINVAL; -- ubi_ro_mode(ubi); -+ /* -+ * Ending up here in the non-Fastmap case -+ * is a clear bug as the VID header had to -+ * be present at scan time to have it referenced. -+ * With fastmap the story is more complicated. -+ * Fastmap has the mapping info without the need -+ * of a full scan. So the LEB could have been -+ * unmapped, Fastmap cannot know this and keeps -+ * the LEB referenced. -+ * This is valid and works as the layer above UBI -+ * has to do bookkeeping about used/referenced -+ * LEBs in any case. -+ */ -+ if (ubi->fast_attach) { -+ err = -EBADMSG; -+ } else { -+ err = -EINVAL; -+ ubi_ro_mode(ubi); -+ } - } - } - goto out_free; -diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c -index 263b439e21a8..990898b9dc72 100644 ---- a/drivers/mtd/ubi/fastmap.c -+++ b/drivers/mtd/ubi/fastmap.c -@@ -1058,6 +1058,7 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai, - ubi_msg(ubi, "fastmap WL pool size: %d", - ubi->fm_wl_pool.max_size); - ubi->fm_disabled = 0; -+ ubi->fast_attach = 1; - - ubi_free_vid_hdr(ubi, vh); - kfree(ech); -diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h -index 2974b67f6c6c..de1ea2e4c37d 100644 ---- a/drivers/mtd/ubi/ubi.h -+++ b/drivers/mtd/ubi/ubi.h -@@ -462,6 +462,7 @@ struct ubi_debug_info { - * @fm_eba_sem: allows ubi_update_fastmap() to block EBA table changes - * @fm_work: fastmap work queue - * @fm_work_scheduled: non-zero if fastmap work was scheduled -+ * @fast_attach: non-zero if UBI was attached by fastmap - * - * @used: RB-tree of used physical eraseblocks - * @erroneous: RB-tree of erroneous used physical eraseblocks -@@ -570,6 +571,7 @@ struct ubi_device { - size_t fm_size; - struct work_struct fm_work; - int fm_work_scheduled; -+ int fast_attach; - - /* Wear-leveling sub-system's stuff */ - struct rb_root used; -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index b7f1a9919033..5ec8195b02c0 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -3308,6 +3308,30 @@ static int bond_close(struct net_device *bond_dev) - return 0; - } - -+/* fold stats, assuming all rtnl_link_stats64 fields are u64, but -+ * that some drivers can provide 32bit values only. -+ */ -+static void bond_fold_stats(struct rtnl_link_stats64 *_res, -+ const struct rtnl_link_stats64 *_new, -+ const struct rtnl_link_stats64 *_old) -+{ -+ const u64 *new = (const u64 *)_new; -+ const u64 *old = (const u64 *)_old; -+ u64 *res = (u64 *)_res; -+ int i; -+ -+ for (i = 0; i < sizeof(*_res) / sizeof(u64); i++) { -+ u64 nv = new[i]; -+ u64 ov = old[i]; -+ -+ /* detects if this particular field is 32bit only */ -+ if (((nv | ov) >> 32) == 0) -+ res[i] += (u32)nv - (u32)ov; -+ else -+ res[i] += nv - ov; -+ } -+} -+ - static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, - struct rtnl_link_stats64 *stats) - { -@@ -3316,43 +3340,23 @@ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, - struct list_head *iter; - struct slave *slave; - -+ spin_lock(&bond->stats_lock); - memcpy(stats, &bond->bond_stats, sizeof(*stats)); - -- bond_for_each_slave(bond, slave, iter) { -- const struct rtnl_link_stats64 *sstats = -+ rcu_read_lock(); -+ bond_for_each_slave_rcu(bond, slave, iter) { -+ const struct rtnl_link_stats64 *new = - dev_get_stats(slave->dev, &temp); -- struct rtnl_link_stats64 *pstats = &slave->slave_stats; -- -- stats->rx_packets += sstats->rx_packets - pstats->rx_packets; -- stats->rx_bytes += sstats->rx_bytes - pstats->rx_bytes; -- stats->rx_errors += sstats->rx_errors - pstats->rx_errors; -- stats->rx_dropped += sstats->rx_dropped - pstats->rx_dropped; -- -- stats->tx_packets += sstats->tx_packets - pstats->tx_packets;; -- stats->tx_bytes += sstats->tx_bytes - pstats->tx_bytes; -- stats->tx_errors += sstats->tx_errors - pstats->tx_errors; -- stats->tx_dropped += sstats->tx_dropped - pstats->tx_dropped; -- -- stats->multicast += sstats->multicast - pstats->multicast; -- stats->collisions += sstats->collisions - pstats->collisions; -- -- stats->rx_length_errors += sstats->rx_length_errors - pstats->rx_length_errors; -- stats->rx_over_errors += sstats->rx_over_errors - pstats->rx_over_errors; -- stats->rx_crc_errors += sstats->rx_crc_errors - pstats->rx_crc_errors; -- stats->rx_frame_errors += sstats->rx_frame_errors - pstats->rx_frame_errors; -- stats->rx_fifo_errors += sstats->rx_fifo_errors - pstats->rx_fifo_errors; -- stats->rx_missed_errors += sstats->rx_missed_errors - pstats->rx_missed_errors; -- -- stats->tx_aborted_errors += sstats->tx_aborted_errors - pstats->tx_aborted_errors; -- stats->tx_carrier_errors += sstats->tx_carrier_errors - pstats->tx_carrier_errors; -- stats->tx_fifo_errors += sstats->tx_fifo_errors - pstats->tx_fifo_errors; -- stats->tx_heartbeat_errors += sstats->tx_heartbeat_errors - pstats->tx_heartbeat_errors; -- stats->tx_window_errors += sstats->tx_window_errors - pstats->tx_window_errors; -+ -+ bond_fold_stats(stats, new, &slave->slave_stats); - - /* save off the slave stats for the next run */ -- memcpy(pstats, sstats, sizeof(*sstats)); -+ memcpy(&slave->slave_stats, new, sizeof(*new)); - } -+ rcu_read_unlock(); -+ - memcpy(&bond->bond_stats, stats, sizeof(*stats)); -+ spin_unlock(&bond->stats_lock); - - return stats; - } -@@ -4166,6 +4170,7 @@ void bond_setup(struct net_device *bond_dev) - struct bonding *bond = netdev_priv(bond_dev); - - spin_lock_init(&bond->mode_lock); -+ spin_lock_init(&bond->stats_lock); - bond->params = bonding_defaults; - - /* Initialize pointers */ -diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c -index 141c2a42d7ed..910c12e2638e 100644 ---- a/drivers/net/can/dev.c -+++ b/drivers/net/can/dev.c -@@ -696,11 +696,17 @@ int can_change_mtu(struct net_device *dev, int new_mtu) - /* allow change of MTU according to the CANFD ability of the device */ - switch (new_mtu) { - case CAN_MTU: -+ /* 'CANFD-only' controllers can not switch to CAN_MTU */ -+ if (priv->ctrlmode_static & CAN_CTRLMODE_FD) -+ return -EINVAL; -+ - priv->ctrlmode &= ~CAN_CTRLMODE_FD; - break; - - case CANFD_MTU: -- if (!(priv->ctrlmode_supported & CAN_CTRLMODE_FD)) -+ /* check for potential CANFD ability */ -+ if (!(priv->ctrlmode_supported & CAN_CTRLMODE_FD) && -+ !(priv->ctrlmode_static & CAN_CTRLMODE_FD)) - return -EINVAL; - - priv->ctrlmode |= CAN_CTRLMODE_FD; -@@ -782,6 +788,35 @@ static const struct nla_policy can_policy[IFLA_CAN_MAX + 1] = { - = { .len = sizeof(struct can_bittiming_const) }, - }; - -+static int can_validate(struct nlattr *tb[], struct nlattr *data[]) -+{ -+ bool is_can_fd = false; -+ -+ /* Make sure that valid CAN FD configurations always consist of -+ * - nominal/arbitration bittiming -+ * - data bittiming -+ * - control mode with CAN_CTRLMODE_FD set -+ */ -+ -+ if (data[IFLA_CAN_CTRLMODE]) { -+ struct can_ctrlmode *cm = nla_data(data[IFLA_CAN_CTRLMODE]); -+ -+ is_can_fd = cm->flags & cm->mask & CAN_CTRLMODE_FD; -+ } -+ -+ if (is_can_fd) { -+ if (!data[IFLA_CAN_BITTIMING] || !data[IFLA_CAN_DATA_BITTIMING]) -+ return -EOPNOTSUPP; -+ } -+ -+ if (data[IFLA_CAN_DATA_BITTIMING]) { -+ if (!is_can_fd || !data[IFLA_CAN_BITTIMING]) -+ return -EOPNOTSUPP; -+ } -+ -+ return 0; -+} -+ - static int can_changelink(struct net_device *dev, - struct nlattr *tb[], struct nlattr *data[]) - { -@@ -813,19 +848,31 @@ static int can_changelink(struct net_device *dev, - - if (data[IFLA_CAN_CTRLMODE]) { - struct can_ctrlmode *cm; -+ u32 ctrlstatic; -+ u32 maskedflags; - - /* Do not allow changing controller mode while running */ - if (dev->flags & IFF_UP) - return -EBUSY; - cm = nla_data(data[IFLA_CAN_CTRLMODE]); -+ ctrlstatic = priv->ctrlmode_static; -+ maskedflags = cm->flags & cm->mask; -+ -+ /* check whether provided bits are allowed to be passed */ -+ if (cm->mask & ~(priv->ctrlmode_supported | ctrlstatic)) -+ return -EOPNOTSUPP; -+ -+ /* do not check for static fd-non-iso if 'fd' is disabled */ -+ if (!(maskedflags & CAN_CTRLMODE_FD)) -+ ctrlstatic &= ~CAN_CTRLMODE_FD_NON_ISO; - -- /* check whether changed bits are allowed to be modified */ -- if (cm->mask & ~priv->ctrlmode_supported) -+ /* make sure static options are provided by configuration */ -+ if ((maskedflags & ctrlstatic) != ctrlstatic) - return -EOPNOTSUPP; - - /* clear bits to be modified and copy the flag values */ - priv->ctrlmode &= ~cm->mask; -- priv->ctrlmode |= (cm->flags & cm->mask); -+ priv->ctrlmode |= maskedflags; - - /* CAN_CTRLMODE_FD can only be set when driver supports FD */ - if (priv->ctrlmode & CAN_CTRLMODE_FD) -@@ -966,6 +1013,7 @@ static struct rtnl_link_ops can_link_ops __read_mostly = { - .maxtype = IFLA_CAN_MAX, - .policy = can_policy, - .setup = can_setup, -+ .validate = can_validate, - .newlink = can_newlink, - .changelink = can_changelink, - .get_size = can_get_size, -diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c -index 39cf911f7a1e..195f15edb32e 100644 ---- a/drivers/net/can/m_can/m_can.c -+++ b/drivers/net/can/m_can/m_can.c -@@ -955,7 +955,7 @@ static struct net_device *alloc_m_can_dev(void) - priv->can.do_get_berr_counter = m_can_get_berr_counter; - - /* CAN_CTRLMODE_FD_NON_ISO is fixed with M_CAN IP v3.0.1 */ -- priv->can.ctrlmode = CAN_CTRLMODE_FD_NON_ISO; -+ can_set_static_ctrlmode(dev, CAN_CTRLMODE_FD_NON_ISO); - - /* CAN_CTRLMODE_FD_NON_ISO can not be changed with M_CAN IP v3.0.1 */ - priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK | -diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c -index 8f76f4558a88..2ff465848b65 100644 ---- a/drivers/net/ethernet/atheros/atlx/atl2.c -+++ b/drivers/net/ethernet/atheros/atlx/atl2.c -@@ -1412,7 +1412,7 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - - err = -EIO; - -- netdev->hw_features = NETIF_F_SG | NETIF_F_HW_VLAN_CTAG_RX; -+ netdev->hw_features = NETIF_F_HW_VLAN_CTAG_RX; - netdev->features |= (NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX); - - /* Init PHY as early as possible due to power saving issue */ -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -index d7e01a74e927..6746fd03cb3a 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -@@ -1197,7 +1197,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev, - dev->stats.tx_bytes += tx_cb_ptr->skb->len; - dma_unmap_single(&dev->dev, - dma_unmap_addr(tx_cb_ptr, dma_addr), -- tx_cb_ptr->skb->len, -+ dma_unmap_len(tx_cb_ptr, dma_len), - DMA_TO_DEVICE); - bcmgenet_free_cb(tx_cb_ptr); - } else if (dma_unmap_addr(tx_cb_ptr, dma_addr)) { -@@ -1308,7 +1308,7 @@ static int bcmgenet_xmit_single(struct net_device *dev, - } - - dma_unmap_addr_set(tx_cb_ptr, dma_addr, mapping); -- dma_unmap_len_set(tx_cb_ptr, dma_len, skb->len); -+ dma_unmap_len_set(tx_cb_ptr, dma_len, skb_len); - length_status = (skb_len << DMA_BUFLENGTH_SHIFT) | dma_desc_flags | - (priv->hw_params->qtag_mask << DMA_TX_QTAG_SHIFT) | - DMA_TX_APPEND_CRC; -diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c -index 767347b1f631..f50bdbfaae7c 100644 ---- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c -+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c -@@ -519,6 +519,7 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs, - nicvf_config_vlan_stripping(nic, nic->netdev->features); - - /* Enable Receive queue */ -+ memset(&rq_cfg, 0, sizeof(struct rq_cfg)); - rq_cfg.ena = 1; - rq_cfg.tcp_ena = 0; - nicvf_queue_reg_write(nic, NIC_QSET_RQ_0_7_CFG, qidx, *(u64 *)&rq_cfg); -@@ -551,6 +552,7 @@ void nicvf_cmp_queue_config(struct nicvf *nic, struct queue_set *qs, - qidx, (u64)(cq->dmem.phys_base)); - - /* Enable Completion queue */ -+ memset(&cq_cfg, 0, sizeof(struct cq_cfg)); - cq_cfg.ena = 1; - cq_cfg.reset = 0; - cq_cfg.caching = 0; -@@ -599,6 +601,7 @@ static void nicvf_snd_queue_config(struct nicvf *nic, struct queue_set *qs, - qidx, (u64)(sq->dmem.phys_base)); - - /* Enable send queue & set queue size */ -+ memset(&sq_cfg, 0, sizeof(struct sq_cfg)); - sq_cfg.ena = 1; - sq_cfg.reset = 0; - sq_cfg.ldwb = 0; -@@ -635,6 +638,7 @@ static void nicvf_rbdr_config(struct nicvf *nic, struct queue_set *qs, - - /* Enable RBDR & set queue size */ - /* Buffer size should be in multiples of 128 bytes */ -+ memset(&rbdr_cfg, 0, sizeof(struct rbdr_cfg)); - rbdr_cfg.ena = 1; - rbdr_cfg.reset = 0; - rbdr_cfg.ldwb = 0; -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index 41c81f6ec630..0d6e8c177650 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -1566,9 +1566,15 @@ fec_enet_rx(struct net_device *ndev, int budget) - struct fec_enet_private *fep = netdev_priv(ndev); - - for_each_set_bit(queue_id, &fep->work_rx, FEC_ENET_MAX_RX_QS) { -- clear_bit(queue_id, &fep->work_rx); -- pkt_received += fec_enet_rx_queue(ndev, -+ int ret; -+ -+ ret = fec_enet_rx_queue(ndev, - budget - pkt_received, queue_id); -+ -+ if (ret < budget - pkt_received) -+ clear_bit(queue_id, &fep->work_rx); -+ -+ pkt_received += ret; - } - return pkt_received; - } -diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c -index b0ae69f84493..2ee05cebea75 100644 ---- a/drivers/net/ethernet/marvell/mvneta.c -+++ b/drivers/net/ethernet/marvell/mvneta.c -@@ -3070,17 +3070,17 @@ static int mvneta_stop(struct net_device *dev) - struct mvneta_port *pp = netdev_priv(dev); - - /* Inform that we are stopping so we don't want to setup the -- * driver for new CPUs in the notifiers -+ * driver for new CPUs in the notifiers. The code of the -+ * notifier for CPU online is protected by the same spinlock, -+ * so when we get the lock, the notifer work is done. - */ - spin_lock(&pp->lock); - pp->is_stopped = true; -+ spin_unlock(&pp->lock); -+ - mvneta_stop_dev(pp); - mvneta_mdio_remove(pp); - unregister_cpu_notifier(&pp->cpu_notifier); -- /* Now that the notifier are unregistered, we can release le -- * lock -- */ -- spin_unlock(&pp->lock); - on_each_cpu(mvneta_percpu_disable, pp, true); - free_percpu_irq(dev->irq, pp->ports); - mvneta_cleanup_rxqs(pp); -@@ -3612,6 +3612,7 @@ static int mvneta_probe(struct platform_device *pdev) - dev->ethtool_ops = &mvneta_eth_tool_ops; - - pp = netdev_priv(dev); -+ spin_lock_init(&pp->lock); - pp->phy_node = phy_node; - pp->phy_interface = phy_mode; - -@@ -3720,7 +3721,7 @@ static int mvneta_probe(struct platform_device *pdev) - dev->features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO; - dev->hw_features |= dev->features; - dev->vlan_features |= dev->features; -- dev->priv_flags |= IFF_UNICAST_FLT; -+ dev->priv_flags |= IFF_UNICAST_FLT | IFF_LIVE_ADDR_CHANGE; - dev->gso_max_segs = MVNETA_MAX_TSO_SEGS; - - err = register_netdev(dev); -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c -index 41440b2b20a3..03ef9aca21e4 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c -@@ -704,7 +704,7 @@ static int get_fixed_ipv6_csum(__wsum hw_checksum, struct sk_buff *skb, - - if (ipv6h->nexthdr == IPPROTO_FRAGMENT || ipv6h->nexthdr == IPPROTO_HOPOPTS) - return -1; -- hw_checksum = csum_add(hw_checksum, (__force __wsum)(ipv6h->nexthdr << 8)); -+ hw_checksum = csum_add(hw_checksum, (__force __wsum)htons(ipv6h->nexthdr)); - - csum_pseudo_hdr = csum_partial(&ipv6h->saddr, - sizeof(ipv6h->saddr) + sizeof(ipv6h->daddr), 0); -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c -index e0946ab22010..0debb611da8b 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c -@@ -402,7 +402,6 @@ static bool mlx4_en_process_tx_cq(struct net_device *dev, - u32 packets = 0; - u32 bytes = 0; - int factor = priv->cqe_factor; -- u64 timestamp = 0; - int done = 0; - int budget = priv->tx_work_limit; - u32 last_nr_txbb; -@@ -442,9 +441,12 @@ static bool mlx4_en_process_tx_cq(struct net_device *dev, - new_index = be16_to_cpu(cqe->wqe_index) & size_mask; - - do { -+ u64 timestamp = 0; -+ - txbbs_skipped += last_nr_txbb; - ring_index = (ring_index + last_nr_txbb) & size_mask; -- if (ring->tx_info[ring_index].ts_requested) -+ -+ if (unlikely(ring->tx_info[ring_index].ts_requested)) - timestamp = mlx4_en_get_cqe_ts(cqe); - - /* free next descriptor */ -diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -index 25ce1b030a00..cd9b2b28df88 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -@@ -3141,7 +3141,7 @@ static int verify_qp_parameters(struct mlx4_dev *dev, - case QP_TRANS_RTS2RTS: - case QP_TRANS_SQD2SQD: - case QP_TRANS_SQD2RTS: -- if (slave != mlx4_master_func_num(dev)) -+ if (slave != mlx4_master_func_num(dev)) { - if (optpar & MLX4_QP_OPTPAR_PRIMARY_ADDR_PATH) { - port = (qp_ctx->pri_path.sched_queue >> 6 & 1) + 1; - if (dev->caps.port_mask[port] != MLX4_PORT_TYPE_IB) -@@ -3160,6 +3160,7 @@ static int verify_qp_parameters(struct mlx4_dev *dev, - if (qp_ctx->alt_path.mgid_index >= num_gids) - return -EINVAL; - } -+ } - break; - default: - break; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 402994bf7e16..e293a2ec2775 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -1389,24 +1389,50 @@ static int mlx5e_refresh_tirs_self_loopback_enable(struct mlx5e_priv *priv) - return 0; - } - --static int mlx5e_set_dev_port_mtu(struct net_device *netdev) -+static int mlx5e_set_mtu(struct mlx5e_priv *priv, u16 mtu) - { -- struct mlx5e_priv *priv = netdev_priv(netdev); - struct mlx5_core_dev *mdev = priv->mdev; -- int hw_mtu; -+ u16 hw_mtu = MLX5E_SW2HW_MTU(mtu); - int err; - -- err = mlx5_set_port_mtu(mdev, MLX5E_SW2HW_MTU(netdev->mtu), 1); -+ err = mlx5_set_port_mtu(mdev, hw_mtu, 1); - if (err) - return err; - -- mlx5_query_port_oper_mtu(mdev, &hw_mtu, 1); -+ /* Update vport context MTU */ -+ mlx5_modify_nic_vport_mtu(mdev, hw_mtu); -+ return 0; -+} -+ -+static void mlx5e_query_mtu(struct mlx5e_priv *priv, u16 *mtu) -+{ -+ struct mlx5_core_dev *mdev = priv->mdev; -+ u16 hw_mtu = 0; -+ int err; -+ -+ err = mlx5_query_nic_vport_mtu(mdev, &hw_mtu); -+ if (err || !hw_mtu) /* fallback to port oper mtu */ -+ mlx5_query_port_oper_mtu(mdev, &hw_mtu, 1); -+ -+ *mtu = MLX5E_HW2SW_MTU(hw_mtu); -+} -+ -+static int mlx5e_set_dev_port_mtu(struct net_device *netdev) -+{ -+ struct mlx5e_priv *priv = netdev_priv(netdev); -+ u16 mtu; -+ int err; - -- if (MLX5E_HW2SW_MTU(hw_mtu) != netdev->mtu) -- netdev_warn(netdev, "%s: Port MTU %d is different than netdev mtu %d\n", -- __func__, MLX5E_HW2SW_MTU(hw_mtu), netdev->mtu); -+ err = mlx5e_set_mtu(priv, netdev->mtu); -+ if (err) -+ return err; - -- netdev->mtu = MLX5E_HW2SW_MTU(hw_mtu); -+ mlx5e_query_mtu(priv, &mtu); -+ if (mtu != netdev->mtu) -+ netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n", -+ __func__, mtu, netdev->mtu); -+ -+ netdev->mtu = mtu; - return 0; - } - -@@ -1906,22 +1932,27 @@ static int mlx5e_set_features(struct net_device *netdev, - return err; - } - -+#define MXL5_HW_MIN_MTU 64 -+#define MXL5E_MIN_MTU (MXL5_HW_MIN_MTU + ETH_FCS_LEN) -+ - static int mlx5e_change_mtu(struct net_device *netdev, int new_mtu) - { - struct mlx5e_priv *priv = netdev_priv(netdev); - struct mlx5_core_dev *mdev = priv->mdev; - bool was_opened; -- int max_mtu; -+ u16 max_mtu; -+ u16 min_mtu; - int err = 0; - - mlx5_query_port_max_mtu(mdev, &max_mtu, 1); - - max_mtu = MLX5E_HW2SW_MTU(max_mtu); -+ min_mtu = MLX5E_HW2SW_MTU(MXL5E_MIN_MTU); - -- if (new_mtu > max_mtu) { -+ if (new_mtu > max_mtu || new_mtu < min_mtu) { - netdev_err(netdev, -- "%s: Bad MTU (%d) > (%d) Max\n", -- __func__, new_mtu, max_mtu); -+ "%s: Bad MTU (%d), valid range is: [%d..%d]\n", -+ __func__, new_mtu, min_mtu, max_mtu); - return -EINVAL; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 6f68dba8d7ed..cc901852f1a9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -957,33 +957,6 @@ unlock_fg: - return rule; - } - --static struct mlx5_flow_rule *add_rule_to_auto_fg(struct mlx5_flow_table *ft, -- u8 match_criteria_enable, -- u32 *match_criteria, -- u32 *match_value, -- u8 action, -- u32 flow_tag, -- struct mlx5_flow_destination *dest) --{ -- struct mlx5_flow_rule *rule; -- struct mlx5_flow_group *g; -- -- g = create_autogroup(ft, match_criteria_enable, match_criteria); -- if (IS_ERR(g)) -- return (void *)g; -- -- rule = add_rule_fg(g, match_value, -- action, flow_tag, dest); -- if (IS_ERR(rule)) { -- /* Remove assumes refcount > 0 and autogroup creates a group -- * with a refcount = 0. -- */ -- tree_get_node(&g->node); -- tree_remove_node(&g->node); -- } -- return rule; --} -- - struct mlx5_flow_rule * - mlx5_add_flow_rule(struct mlx5_flow_table *ft, - u8 match_criteria_enable, -@@ -1008,8 +981,23 @@ mlx5_add_flow_rule(struct mlx5_flow_table *ft, - goto unlock; - } - -- rule = add_rule_to_auto_fg(ft, match_criteria_enable, match_criteria, -- match_value, action, flow_tag, dest); -+ g = create_autogroup(ft, match_criteria_enable, match_criteria); -+ if (IS_ERR(g)) { -+ rule = (void *)g; -+ goto unlock; -+ } -+ -+ rule = add_rule_fg(g, match_value, -+ action, flow_tag, dest); -+ if (IS_ERR(rule)) { -+ /* Remove assumes refcount > 0 and autogroup creates a group -+ * with a refcount = 0. -+ */ -+ unlock_ref_node(&ft->node); -+ tree_get_node(&g->node); -+ tree_remove_node(&g->node); -+ return rule; -+ } - unlock: - unlock_ref_node(&ft->node); - return rule; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 1545a944c309..b86fe50d5d93 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -423,6 +423,10 @@ static int handle_hca_cap_atomic(struct mlx5_core_dev *dev) - HCA_CAP_OPMOD_GET_CUR); - if (err) - return err; -+ err = mlx5_core_get_caps(dev, MLX5_CAP_ATOMIC, -+ HCA_CAP_OPMOD_GET_MAX); -+ if (err) -+ return err; - } else { - return 0; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c -index a87e773e93f3..53a793bc2e3d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/port.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c -@@ -246,8 +246,8 @@ int mlx5_query_port_admin_status(struct mlx5_core_dev *dev, - } - EXPORT_SYMBOL_GPL(mlx5_query_port_admin_status); - --static void mlx5_query_port_mtu(struct mlx5_core_dev *dev, int *admin_mtu, -- int *max_mtu, int *oper_mtu, u8 port) -+static void mlx5_query_port_mtu(struct mlx5_core_dev *dev, u16 *admin_mtu, -+ u16 *max_mtu, u16 *oper_mtu, u8 port) - { - u32 in[MLX5_ST_SZ_DW(pmtu_reg)]; - u32 out[MLX5_ST_SZ_DW(pmtu_reg)]; -@@ -267,7 +267,7 @@ static void mlx5_query_port_mtu(struct mlx5_core_dev *dev, int *admin_mtu, - *admin_mtu = MLX5_GET(pmtu_reg, out, admin_mtu); - } - --int mlx5_set_port_mtu(struct mlx5_core_dev *dev, int mtu, u8 port) -+int mlx5_set_port_mtu(struct mlx5_core_dev *dev, u16 mtu, u8 port) - { - u32 in[MLX5_ST_SZ_DW(pmtu_reg)]; - u32 out[MLX5_ST_SZ_DW(pmtu_reg)]; -@@ -282,14 +282,14 @@ int mlx5_set_port_mtu(struct mlx5_core_dev *dev, int mtu, u8 port) - } - EXPORT_SYMBOL_GPL(mlx5_set_port_mtu); - --void mlx5_query_port_max_mtu(struct mlx5_core_dev *dev, int *max_mtu, -+void mlx5_query_port_max_mtu(struct mlx5_core_dev *dev, u16 *max_mtu, - u8 port) - { - mlx5_query_port_mtu(dev, NULL, max_mtu, NULL, port); - } - EXPORT_SYMBOL_GPL(mlx5_query_port_max_mtu); - --void mlx5_query_port_oper_mtu(struct mlx5_core_dev *dev, int *oper_mtu, -+void mlx5_query_port_oper_mtu(struct mlx5_core_dev *dev, u16 *oper_mtu, - u8 port) - { - mlx5_query_port_mtu(dev, NULL, NULL, oper_mtu, port); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -index c7398b95aecd..6d5f56e73b5d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -@@ -196,6 +196,46 @@ int mlx5_modify_nic_vport_mac_address(struct mlx5_core_dev *mdev, - } - EXPORT_SYMBOL_GPL(mlx5_modify_nic_vport_mac_address); - -+int mlx5_query_nic_vport_mtu(struct mlx5_core_dev *mdev, u16 *mtu) -+{ -+ int outlen = MLX5_ST_SZ_BYTES(query_nic_vport_context_out); -+ u32 *out; -+ int err; -+ -+ out = mlx5_vzalloc(outlen); -+ if (!out) -+ return -ENOMEM; -+ -+ err = mlx5_query_nic_vport_context(mdev, 0, out, outlen); -+ if (!err) -+ *mtu = MLX5_GET(query_nic_vport_context_out, out, -+ nic_vport_context.mtu); -+ -+ kvfree(out); -+ return err; -+} -+EXPORT_SYMBOL_GPL(mlx5_query_nic_vport_mtu); -+ -+int mlx5_modify_nic_vport_mtu(struct mlx5_core_dev *mdev, u16 mtu) -+{ -+ int inlen = MLX5_ST_SZ_BYTES(modify_nic_vport_context_in); -+ void *in; -+ int err; -+ -+ in = mlx5_vzalloc(inlen); -+ if (!in) -+ return -ENOMEM; -+ -+ MLX5_SET(modify_nic_vport_context_in, in, field_select.mtu, 1); -+ MLX5_SET(modify_nic_vport_context_in, in, nic_vport_context.mtu, mtu); -+ -+ err = mlx5_modify_nic_vport_context(mdev, in, inlen); -+ -+ kvfree(in); -+ return err; -+} -+EXPORT_SYMBOL_GPL(mlx5_modify_nic_vport_mtu); -+ - int mlx5_query_nic_vport_mac_list(struct mlx5_core_dev *dev, - u32 vport, - enum mlx5_list_type list_type, -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h -index 3b89ed2f3c76..65a115fc0c96 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h -@@ -118,6 +118,8 @@ struct mlxsw_sp { - #define MLXSW_SP_DEFAULT_LEARNING_INTERVAL 100 - unsigned int interval; /* ms */ - } fdb_notify; -+#define MLXSW_SP_MIN_AGEING_TIME 10 -+#define MLXSW_SP_MAX_AGEING_TIME 1000000 - #define MLXSW_SP_DEFAULT_AGEING_TIME 300 - u32 ageing_time; - struct mlxsw_sp_upper master_bridge; -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c -index 7b56098acc58..e1c74efff51a 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c -@@ -311,8 +311,13 @@ static int mlxsw_sp_port_attr_br_ageing_set(struct mlxsw_sp_port *mlxsw_sp_port, - unsigned long ageing_jiffies = clock_t_to_jiffies(ageing_clock_t); - u32 ageing_time = jiffies_to_msecs(ageing_jiffies) / 1000; - -- if (switchdev_trans_ph_prepare(trans)) -- return 0; -+ if (switchdev_trans_ph_prepare(trans)) { -+ if (ageing_time < MLXSW_SP_MIN_AGEING_TIME || -+ ageing_time > MLXSW_SP_MAX_AGEING_TIME) -+ return -ERANGE; -+ else -+ return 0; -+ } - - return mlxsw_sp_ageing_set(mlxsw_sp, ageing_time); - } -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h -index 46bbea8e023c..55007f1e6bbc 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h -@@ -566,6 +566,7 @@ struct qlcnic_adapter_stats { - u64 tx_dma_map_error; - u64 spurious_intr; - u64 mac_filter_limit_overrun; -+ u64 mbx_spurious_intr; - }; - - /* -@@ -1099,7 +1100,7 @@ struct qlcnic_mailbox { - unsigned long status; - spinlock_t queue_lock; /* Mailbox queue lock */ - spinlock_t aen_lock; /* Mailbox response/AEN lock */ -- atomic_t rsp_status; -+ u32 rsp_status; - u32 num_cmds; - }; - -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -index 37a731be7d39..f9640d5ce6ba 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -@@ -491,7 +491,7 @@ irqreturn_t qlcnic_83xx_clear_legacy_intr(struct qlcnic_adapter *adapter) - - static inline void qlcnic_83xx_notify_mbx_response(struct qlcnic_mailbox *mbx) - { -- atomic_set(&mbx->rsp_status, QLC_83XX_MBX_RESPONSE_ARRIVED); -+ mbx->rsp_status = QLC_83XX_MBX_RESPONSE_ARRIVED; - complete(&mbx->completion); - } - -@@ -510,7 +510,7 @@ static void qlcnic_83xx_poll_process_aen(struct qlcnic_adapter *adapter) - if (event & QLCNIC_MBX_ASYNC_EVENT) { - __qlcnic_83xx_process_aen(adapter); - } else { -- if (atomic_read(&mbx->rsp_status) != rsp_status) -+ if (mbx->rsp_status != rsp_status) - qlcnic_83xx_notify_mbx_response(mbx); - } - out: -@@ -1023,7 +1023,7 @@ static void qlcnic_83xx_process_aen(struct qlcnic_adapter *adapter) - if (event & QLCNIC_MBX_ASYNC_EVENT) { - __qlcnic_83xx_process_aen(adapter); - } else { -- if (atomic_read(&mbx->rsp_status) != rsp_status) -+ if (mbx->rsp_status != rsp_status) - qlcnic_83xx_notify_mbx_response(mbx); - } - } -@@ -2338,9 +2338,9 @@ static void qlcnic_83xx_handle_link_aen(struct qlcnic_adapter *adapter, - - static irqreturn_t qlcnic_83xx_handle_aen(int irq, void *data) - { -+ u32 mask, resp, event, rsp_status = QLC_83XX_MBX_RESPONSE_ARRIVED; - struct qlcnic_adapter *adapter = data; - struct qlcnic_mailbox *mbx; -- u32 mask, resp, event; - unsigned long flags; - - mbx = adapter->ahw->mailbox; -@@ -2350,10 +2350,14 @@ static irqreturn_t qlcnic_83xx_handle_aen(int irq, void *data) - goto out; - - event = readl(QLCNIC_MBX_FW(adapter->ahw, 0)); -- if (event & QLCNIC_MBX_ASYNC_EVENT) -+ if (event & QLCNIC_MBX_ASYNC_EVENT) { - __qlcnic_83xx_process_aen(adapter); -- else -- qlcnic_83xx_notify_mbx_response(mbx); -+ } else { -+ if (mbx->rsp_status != rsp_status) -+ qlcnic_83xx_notify_mbx_response(mbx); -+ else -+ adapter->stats.mbx_spurious_intr++; -+ } - - out: - mask = QLCRDX(adapter->ahw, QLCNIC_DEF_INT_MASK); -@@ -4050,10 +4054,10 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work) - struct qlcnic_adapter *adapter = mbx->adapter; - const struct qlcnic_mbx_ops *mbx_ops = mbx->ops; - struct device *dev = &adapter->pdev->dev; -- atomic_t *rsp_status = &mbx->rsp_status; - struct list_head *head = &mbx->cmd_q; - struct qlcnic_hardware_context *ahw; - struct qlcnic_cmd_args *cmd = NULL; -+ unsigned long flags; - - ahw = adapter->ahw; - -@@ -4063,7 +4067,9 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work) - return; - } - -- atomic_set(rsp_status, QLC_83XX_MBX_RESPONSE_WAIT); -+ spin_lock_irqsave(&mbx->aen_lock, flags); -+ mbx->rsp_status = QLC_83XX_MBX_RESPONSE_WAIT; -+ spin_unlock_irqrestore(&mbx->aen_lock, flags); - - spin_lock(&mbx->queue_lock); - -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c -index 494e8105adee..0a2318cad34d 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c -@@ -59,7 +59,8 @@ static const struct qlcnic_stats qlcnic_gstrings_stats[] = { - QLC_OFF(stats.mac_filter_limit_overrun)}, - {"spurious intr", QLC_SIZEOF(stats.spurious_intr), - QLC_OFF(stats.spurious_intr)}, -- -+ {"mbx spurious intr", QLC_SIZEOF(stats.mbx_spurious_intr), -+ QLC_OFF(stats.mbx_spurious_intr)}, - }; - - static const char qlcnic_device_gstrings_stats[][ETH_GSTRING_LEN] = { -diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c -index 997976426799..b28e73ea2c25 100644 ---- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c -+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c -@@ -1648,7 +1648,18 @@ static void ql_process_mac_rx_skb(struct ql_adapter *qdev, - return; - } - skb_reserve(new_skb, NET_IP_ALIGN); -+ -+ pci_dma_sync_single_for_cpu(qdev->pdev, -+ dma_unmap_addr(sbq_desc, mapaddr), -+ dma_unmap_len(sbq_desc, maplen), -+ PCI_DMA_FROMDEVICE); -+ - memcpy(skb_put(new_skb, length), skb->data, length); -+ -+ pci_dma_sync_single_for_device(qdev->pdev, -+ dma_unmap_addr(sbq_desc, mapaddr), -+ dma_unmap_len(sbq_desc, maplen), -+ PCI_DMA_FROMDEVICE); - skb = new_skb; - - /* Frame error, so drop the packet. */ -diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c -index 738449992876..01f6d5bbd420 100644 ---- a/drivers/net/ethernet/renesas/sh_eth.c -+++ b/drivers/net/ethernet/renesas/sh_eth.c -@@ -1136,11 +1136,8 @@ static void sh_eth_ring_format(struct net_device *ndev) - break; - sh_eth_set_receive_align(skb); - -- /* RX descriptor */ -- rxdesc = &mdp->rx_ring[i]; - /* The size of the buffer is a multiple of 32 bytes. */ - buf_len = ALIGN(mdp->rx_buf_sz, 32); -- rxdesc->len = cpu_to_le32(buf_len << 16); - dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len, - DMA_FROM_DEVICE); - if (dma_mapping_error(&ndev->dev, dma_addr)) { -@@ -1148,6 +1145,10 @@ static void sh_eth_ring_format(struct net_device *ndev) - break; - } - mdp->rx_skbuff[i] = skb; -+ -+ /* RX descriptor */ -+ rxdesc = &mdp->rx_ring[i]; -+ rxdesc->len = cpu_to_le32(buf_len << 16); - rxdesc->addr = cpu_to_le32(dma_addr); - rxdesc->status = cpu_to_le32(RD_RACT | RD_RFP); - -@@ -1163,7 +1164,8 @@ static void sh_eth_ring_format(struct net_device *ndev) - mdp->dirty_rx = (u32) (i - mdp->num_rx_ring); - - /* Mark the last entry as wrapping the ring. */ -- rxdesc->status |= cpu_to_le32(RD_RDLE); -+ if (rxdesc) -+ rxdesc->status |= cpu_to_le32(RD_RDLE); - - memset(mdp->tx_ring, 0, tx_ringsize); - -diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c -index 166a7fc87e2f..f39e7198e818 100644 ---- a/drivers/net/ethernet/rocker/rocker.c -+++ b/drivers/net/ethernet/rocker/rocker.c -@@ -239,6 +239,7 @@ struct rocker { - struct { - u64 id; - } hw; -+ unsigned long ageing_time; - spinlock_t cmd_ring_lock; /* for cmd ring accesses */ - struct rocker_dma_ring_info cmd_ring; - struct rocker_dma_ring_info event_ring; -@@ -3704,7 +3705,7 @@ static void rocker_fdb_cleanup(unsigned long data) - struct rocker_port *rocker_port; - struct rocker_fdb_tbl_entry *entry; - struct hlist_node *tmp; -- unsigned long next_timer = jiffies + BR_MIN_AGEING_TIME; -+ unsigned long next_timer = jiffies + rocker->ageing_time; - unsigned long expires; - unsigned long lock_flags; - int flags = ROCKER_OP_FLAG_NOWAIT | ROCKER_OP_FLAG_REMOVE | -@@ -4367,8 +4368,12 @@ static int rocker_port_bridge_ageing_time(struct rocker_port *rocker_port, - struct switchdev_trans *trans, - u32 ageing_time) - { -+ struct rocker *rocker = rocker_port->rocker; -+ - if (!switchdev_trans_ph_prepare(trans)) { - rocker_port->ageing_time = clock_t_to_jiffies(ageing_time); -+ if (rocker_port->ageing_time < rocker->ageing_time) -+ rocker->ageing_time = rocker_port->ageing_time; - mod_timer(&rocker_port->rocker->fdb_cleanup_timer, jiffies); - } - -@@ -5206,10 +5211,13 @@ static int rocker_probe(struct pci_dev *pdev, const struct pci_device_id *id) - goto err_init_tbls; - } - -+ rocker->ageing_time = BR_DEFAULT_AGEING_TIME; - setup_timer(&rocker->fdb_cleanup_timer, rocker_fdb_cleanup, - (unsigned long) rocker); - mod_timer(&rocker->fdb_cleanup_timer, jiffies); - -+ rocker->ageing_time = BR_DEFAULT_AGEING_TIME; -+ - err = rocker_probe_ports(rocker); - if (err) { - dev_err(&pdev->dev, "failed to probe ports\n"); -diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c -index 696852eb23c3..7a3f990c1935 100644 ---- a/drivers/net/irda/irtty-sir.c -+++ b/drivers/net/irda/irtty-sir.c -@@ -430,16 +430,6 @@ static int irtty_open(struct tty_struct *tty) - - /* Module stuff handled via irda_ldisc.owner - Jean II */ - -- /* First make sure we're not already connected. */ -- if (tty->disc_data != NULL) { -- priv = tty->disc_data; -- if (priv && priv->magic == IRTTY_MAGIC) { -- ret = -EEXIST; -- goto out; -- } -- tty->disc_data = NULL; /* ### */ -- } -- - /* stop the underlying driver */ - irtty_stop_receiver(tty, TRUE); - if (tty->ops->stop) -diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c -index d636d051fac8..95394edd1ed5 100644 ---- a/drivers/net/macvtap.c -+++ b/drivers/net/macvtap.c -@@ -760,6 +760,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, - macvtap16_to_cpu(q, vnet_hdr.hdr_len) : GOODCOPY_LEN; - if (copylen > good_linear) - copylen = good_linear; -+ else if (copylen < ETH_HLEN) -+ copylen = ETH_HLEN; - linear = copylen; - i = *from; - iov_iter_advance(&i, copylen); -@@ -769,10 +771,11 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, - - if (!zerocopy) { - copylen = len; -- if (macvtap16_to_cpu(q, vnet_hdr.hdr_len) > good_linear) -+ linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len); -+ if (linear > good_linear) - linear = good_linear; -- else -- linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len); -+ else if (linear < ETH_HLEN) -+ linear = ETH_HLEN; - } - - skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen, -diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index d61da9ece3ba..aafe237b25ac 100644 ---- a/drivers/net/ppp/ppp_generic.c -+++ b/drivers/net/ppp/ppp_generic.c -@@ -575,7 +575,7 @@ static int get_filter(void __user *arg, struct sock_filter **p) - - static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - { -- struct ppp_file *pf = file->private_data; -+ struct ppp_file *pf; - struct ppp *ppp; - int err = -EFAULT, val, val2, i; - struct ppp_idle idle; -@@ -585,9 +585,14 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - void __user *argp = (void __user *)arg; - int __user *p = argp; - -- if (!pf) -- return ppp_unattached_ioctl(current->nsproxy->net_ns, -- pf, file, cmd, arg); -+ mutex_lock(&ppp_mutex); -+ -+ pf = file->private_data; -+ if (!pf) { -+ err = ppp_unattached_ioctl(current->nsproxy->net_ns, -+ pf, file, cmd, arg); -+ goto out; -+ } - - if (cmd == PPPIOCDETACH) { - /* -@@ -602,7 +607,6 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - * this fd and reopening /dev/ppp. - */ - err = -EINVAL; -- mutex_lock(&ppp_mutex); - if (pf->kind == INTERFACE) { - ppp = PF_TO_PPP(pf); - rtnl_lock(); -@@ -616,15 +620,13 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - } else - pr_warn("PPPIOCDETACH file->f_count=%ld\n", - atomic_long_read(&file->f_count)); -- mutex_unlock(&ppp_mutex); -- return err; -+ goto out; - } - - if (pf->kind == CHANNEL) { - struct channel *pch; - struct ppp_channel *chan; - -- mutex_lock(&ppp_mutex); - pch = PF_TO_CHANNEL(pf); - - switch (cmd) { -@@ -646,17 +648,16 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - err = chan->ops->ioctl(chan, cmd, arg); - up_read(&pch->chan_sem); - } -- mutex_unlock(&ppp_mutex); -- return err; -+ goto out; - } - - if (pf->kind != INTERFACE) { - /* can't happen */ - pr_err("PPP: not interface or channel??\n"); -- return -EINVAL; -+ err = -EINVAL; -+ goto out; - } - -- mutex_lock(&ppp_mutex); - ppp = PF_TO_PPP(pf); - switch (cmd) { - case PPPIOCSMRU: -@@ -831,7 +832,10 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - default: - err = -ENOTTY; - } -+ -+out: - mutex_unlock(&ppp_mutex); -+ - return err; - } - -@@ -844,7 +848,6 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf, - struct ppp_net *pn; - int __user *p = (int __user *)arg; - -- mutex_lock(&ppp_mutex); - switch (cmd) { - case PPPIOCNEWUNIT: - /* Create a new ppp unit */ -@@ -894,7 +897,7 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf, - default: - err = -ENOTTY; - } -- mutex_unlock(&ppp_mutex); -+ - return err; - } - -@@ -2304,7 +2307,7 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan) - - pch->ppp = NULL; - pch->chan = chan; -- pch->chan_net = net; -+ pch->chan_net = get_net(net); - chan->ppp = pch; - init_ppp_file(&pch->file, CHANNEL); - pch->file.hdrlen = chan->hdrlen; -@@ -2401,6 +2404,8 @@ ppp_unregister_channel(struct ppp_channel *chan) - spin_lock_bh(&pn->all_channels_lock); - list_del(&pch->list); - spin_unlock_bh(&pn->all_channels_lock); -+ put_net(pch->chan_net); -+ pch->chan_net = NULL; - - pch->file.dead = 1; - wake_up_interruptible(&pch->file.rwait); -diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c -index 01f08a7751f7..e7034c55e796 100644 ---- a/drivers/net/rionet.c -+++ b/drivers/net/rionet.c -@@ -280,7 +280,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, void *dev_id, int mbo - struct net_device *ndev = dev_id; - struct rionet_private *rnet = netdev_priv(ndev); - -- spin_lock(&rnet->lock); -+ spin_lock(&rnet->tx_lock); - - if (netif_msg_intr(rnet)) - printk(KERN_INFO -@@ -299,7 +299,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, void *dev_id, int mbo - if (rnet->tx_cnt < RIONET_TX_RING_SIZE) - netif_wake_queue(ndev); - -- spin_unlock(&rnet->lock); -+ spin_unlock(&rnet->tx_lock); - } - - static int rionet_open(struct net_device *ndev) -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index 88bb8cc3555b..81ecc2ed8137 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -621,7 +621,8 @@ static int tun_attach(struct tun_struct *tun, struct file *file, bool skip_filte - - /* Re-attach the filter to persist device */ - if (!skip_filter && (tun->filter_attached == true)) { -- err = sk_attach_filter(&tun->fprog, tfile->socket.sk); -+ err = __sk_attach_filter(&tun->fprog, tfile->socket.sk, -+ lockdep_rtnl_is_held()); - if (!err) - goto out; - } -@@ -1000,7 +1001,6 @@ static void tun_net_init(struct net_device *dev) - /* Zero header length */ - dev->type = ARPHRD_NONE; - dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST; -- dev->tx_queue_len = TUN_READQ_SIZE; /* We prefer our own queue length */ - break; - - case IFF_TAP: -@@ -1012,7 +1012,6 @@ static void tun_net_init(struct net_device *dev) - - eth_hw_addr_random(dev); - -- dev->tx_queue_len = TUN_READQ_SIZE; /* We prefer our own queue length */ - break; - } - } -@@ -1466,6 +1465,8 @@ static void tun_setup(struct net_device *dev) - - dev->ethtool_ops = &tun_ethtool_ops; - dev->destructor = tun_free_netdev; -+ /* We prefer our own queue length */ -+ dev->tx_queue_len = TUN_READQ_SIZE; - } - - /* Trivial set of netlink ops to allow deleting tun or tap -@@ -1807,7 +1808,7 @@ static void tun_detach_filter(struct tun_struct *tun, int n) - - for (i = 0; i < n; i++) { - tfile = rtnl_dereference(tun->tfiles[i]); -- sk_detach_filter(tfile->socket.sk); -+ __sk_detach_filter(tfile->socket.sk, lockdep_rtnl_is_held()); - } - - tun->filter_attached = false; -@@ -1820,7 +1821,8 @@ static int tun_attach_filter(struct tun_struct *tun) - - for (i = 0; i < tun->numqueues; i++) { - tfile = rtnl_dereference(tun->tfiles[i]); -- ret = sk_attach_filter(&tun->fprog, tfile->socket.sk); -+ ret = __sk_attach_filter(&tun->fprog, tfile->socket.sk, -+ lockdep_rtnl_is_held()); - if (ret) { - tun_detach_filter(tun, i); - return ret; -diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c -index 0c5c22b84da8..7de5ab589e4e 100644 ---- a/drivers/net/usb/asix_common.c -+++ b/drivers/net/usb/asix_common.c -@@ -66,7 +66,7 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb, - * buffer. - */ - if (rx->remaining && (rx->remaining + sizeof(u32) <= skb->len)) { -- offset = ((rx->remaining + 1) & 0xfffe) + sizeof(u32); -+ offset = ((rx->remaining + 1) & 0xfffe); - rx->header = get_unaligned_le32(skb->data + offset); - offset = 0; - -diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c -index bdd83d95ec0a..96a5028621c8 100644 ---- a/drivers/net/usb/cdc_mbim.c -+++ b/drivers/net/usb/cdc_mbim.c -@@ -617,8 +617,13 @@ static const struct usb_device_id mbim_devs[] = { - { USB_VENDOR_AND_INTERFACE_INFO(0x0bdb, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), - .driver_info = (unsigned long)&cdc_mbim_info, - }, -- /* Huawei E3372 fails unless NDP comes after the IP packets */ -- { USB_DEVICE_AND_INTERFACE_INFO(0x12d1, 0x157d, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), -+ -+ /* Some Huawei devices, ME906s-158 (12d1:15c1) and E3372 -+ * (12d1:157d), are known to fail unless the NDP is placed -+ * after the IP packets. Applying the quirk to all Huawei -+ * devices is broader than necessary, but harmless. -+ */ -+ { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), - .driver_info = (unsigned long)&cdc_mbim_info_ndp_to_end, - }, - /* default entry */ -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index a3a4ccf7cf52..1232a8c608b4 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -844,6 +844,7 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x19d2, 0x1426, 2)}, /* ZTE MF91 */ - {QMI_FIXED_INTF(0x19d2, 0x1428, 2)}, /* Telewell TW-LTE 4G v2 */ - {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ -+ {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */ - {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ - {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ - {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ -diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c -index 44541dbc5c28..69b994f3b8c5 100644 ---- a/drivers/net/wan/farsync.c -+++ b/drivers/net/wan/farsync.c -@@ -2516,7 +2516,7 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent) - dev->mem_start = card->phys_mem - + BUF_OFFSET ( txBuffer[i][0][0]); - dev->mem_end = card->phys_mem -- + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]); -+ + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER - 1][LEN_RX_BUFFER - 1]); - dev->base_addr = card->pci_conf; - dev->irq = card->irq; - -diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c -index 91afa3ae414c..a192d451dab2 100644 ---- a/drivers/net/wireless/ath/ath10k/htt_rx.c -+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c -@@ -2143,11 +2143,7 @@ EXPORT_SYMBOL(ath10k_htt_t2h_msg_handler); - void ath10k_htt_rx_pktlog_completion_handler(struct ath10k *ar, - struct sk_buff *skb) - { -- struct ath10k_pktlog_10_4_hdr *hdr = -- (struct ath10k_pktlog_10_4_hdr *)skb->data; -- -- trace_ath10k_htt_pktlog(ar, hdr->payload, -- sizeof(*hdr) + __le16_to_cpu(hdr->size)); -+ trace_ath10k_htt_pktlog(ar, skb->data, skb->len); - dev_kfree_skb_any(skb); - } - EXPORT_SYMBOL(ath10k_htt_rx_pktlog_completion_handler); -diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c -index 8f8793004b9f..1b271b99c49e 100644 ---- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c -+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c -@@ -274,6 +274,9 @@ void ar5008_hw_cmn_spur_mitigate(struct ath_hw *ah, - }; - static const int inc[4] = { 0, 100, 0, 0 }; - -+ memset(&mask_m, 0, sizeof(int8_t) * 123); -+ memset(&mask_p, 0, sizeof(int8_t) * 123); -+ - cur_bin = -6000; - upper = bin + 100; - lower = bin - 100; -@@ -424,14 +427,9 @@ static void ar5008_hw_spur_mitigate(struct ath_hw *ah, - int tmp, new; - int i; - -- int8_t mask_m[123]; -- int8_t mask_p[123]; - int cur_bb_spur; - bool is2GHz = IS_CHAN_2GHZ(chan); - -- memset(&mask_m, 0, sizeof(int8_t) * 123); -- memset(&mask_p, 0, sizeof(int8_t) * 123); -- - for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) { - cur_bb_spur = ah->eep_ops->get_spur_channel(ah, i, is2GHz); - if (AR_NO_SPUR == cur_bb_spur) -diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.c b/drivers/net/wireless/ath/ath9k/ar9002_phy.c -index db6624527d99..53d7445a5d12 100644 ---- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c -+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c -@@ -178,14 +178,9 @@ static void ar9002_hw_spur_mitigate(struct ath_hw *ah, - int i; - struct chan_centers centers; - -- int8_t mask_m[123]; -- int8_t mask_p[123]; - int cur_bb_spur; - bool is2GHz = IS_CHAN_2GHZ(chan); - -- memset(&mask_m, 0, sizeof(int8_t) * 123); -- memset(&mask_p, 0, sizeof(int8_t) * 123); -- - ath9k_hw_get_channel_centers(ah, chan, ¢ers); - freq = centers.synth_center; - -diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c -index 73fb4232f9f2..a794157a147d 100644 ---- a/drivers/net/wireless/ath/ath9k/eeprom.c -+++ b/drivers/net/wireless/ath/ath9k/eeprom.c -@@ -477,10 +477,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, - - if (match) { - if (AR_SREV_9287(ah)) { -- /* FIXME: array overrun? */ - for (i = 0; i < numXpdGains; i++) { - minPwrT4[i] = data_9287[idxL].pwrPdg[i][0]; -- maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4]; -+ maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1]; - ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], - data_9287[idxL].pwrPdg[i], - data_9287[idxL].vpdPdg[i], -@@ -490,7 +489,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, - } else if (eeprom_4k) { - for (i = 0; i < numXpdGains; i++) { - minPwrT4[i] = data_4k[idxL].pwrPdg[i][0]; -- maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4]; -+ maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1]; - ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], - data_4k[idxL].pwrPdg[i], - data_4k[idxL].vpdPdg[i], -@@ -500,7 +499,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, - } else { - for (i = 0; i < numXpdGains; i++) { - minPwrT4[i] = data_def[idxL].pwrPdg[i][0]; -- maxPwrT4[i] = data_def[idxL].pwrPdg[i][4]; -+ maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1]; - ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], - data_def[idxL].pwrPdg[i], - data_def[idxL].vpdPdg[i], -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c -index 2ca783fa50cf..7e269f9aa607 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c -@@ -32,7 +32,7 @@ - #define BRCMF_FLOWRING_LOW (BRCMF_FLOWRING_HIGH - 256) - #define BRCMF_FLOWRING_INVALID_IFIDX 0xff - --#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] + fifo + ifidx * 16) -+#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] * 2 + fifo + ifidx * 16) - #define BRCMF_FLOWRING_HASH_STA(fifo, ifidx) (fifo + ifidx * 16) - - static const u8 brcmf_flowring_prio2fifo[] = { -@@ -68,7 +68,7 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN], - u8 prio, u8 ifidx) - { - struct brcmf_flowring_hash *hash; -- u8 hash_idx; -+ u16 hash_idx; - u32 i; - bool found; - bool sta; -@@ -88,6 +88,7 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN], - } - hash_idx = sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) : - BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx); -+ hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1); - found = false; - hash = flow->hash; - for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) { -@@ -98,6 +99,7 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN], - break; - } - hash_idx++; -+ hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1); - } - if (found) - return hash[hash_idx].flowid; -@@ -111,7 +113,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN], - { - struct brcmf_flowring_ring *ring; - struct brcmf_flowring_hash *hash; -- u8 hash_idx; -+ u16 hash_idx; - u32 i; - bool found; - u8 fifo; -@@ -131,6 +133,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN], - } - hash_idx = sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) : - BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx); -+ hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1); - found = false; - hash = flow->hash; - for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) { -@@ -140,6 +143,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN], - break; - } - hash_idx++; -+ hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1); - } - if (found) { - for (i = 0; i < flow->nrofrings; i++) { -@@ -169,7 +173,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN], - } - - --u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid) -+u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid) - { - struct brcmf_flowring_ring *ring; - -@@ -179,7 +183,7 @@ u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid) - } - - --static void brcmf_flowring_block(struct brcmf_flowring *flow, u8 flowid, -+static void brcmf_flowring_block(struct brcmf_flowring *flow, u16 flowid, - bool blocked) - { - struct brcmf_flowring_ring *ring; -@@ -228,10 +232,10 @@ static void brcmf_flowring_block(struct brcmf_flowring *flow, u8 flowid, - } - - --void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid) -+void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid) - { - struct brcmf_flowring_ring *ring; -- u8 hash_idx; -+ u16 hash_idx; - struct sk_buff *skb; - - ring = flow->rings[flowid]; -@@ -253,7 +257,7 @@ void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid) - } - - --u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid, -+u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid, - struct sk_buff *skb) - { - struct brcmf_flowring_ring *ring; -@@ -279,7 +283,7 @@ u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid, - } - - --struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid) -+struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid) - { - struct brcmf_flowring_ring *ring; - struct sk_buff *skb; -@@ -300,7 +304,7 @@ struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid) - } - - --void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid, -+void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid, - struct sk_buff *skb) - { - struct brcmf_flowring_ring *ring; -@@ -311,7 +315,7 @@ void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid, - } - - --u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid) -+u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid) - { - struct brcmf_flowring_ring *ring; - -@@ -326,7 +330,7 @@ u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid) - } - - --void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid) -+void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid) - { - struct brcmf_flowring_ring *ring; - -@@ -340,10 +344,10 @@ void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid) - } - - --u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid) -+u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid) - { - struct brcmf_flowring_ring *ring; -- u8 hash_idx; -+ u16 hash_idx; - - ring = flow->rings[flowid]; - hash_idx = ring->hash_id; -@@ -384,7 +388,7 @@ void brcmf_flowring_detach(struct brcmf_flowring *flow) - struct brcmf_pub *drvr = bus_if->drvr; - struct brcmf_flowring_tdls_entry *search; - struct brcmf_flowring_tdls_entry *remove; -- u8 flowid; -+ u16 flowid; - - for (flowid = 0; flowid < flow->nrofrings; flowid++) { - if (flow->rings[flowid]) -@@ -408,7 +412,7 @@ void brcmf_flowring_configure_addr_mode(struct brcmf_flowring *flow, int ifidx, - struct brcmf_bus *bus_if = dev_get_drvdata(flow->dev); - struct brcmf_pub *drvr = bus_if->drvr; - u32 i; -- u8 flowid; -+ u16 flowid; - - if (flow->addr_mode[ifidx] != addr_mode) { - for (i = 0; i < ARRAY_SIZE(flow->hash); i++) { -@@ -434,7 +438,7 @@ void brcmf_flowring_delete_peer(struct brcmf_flowring *flow, int ifidx, - struct brcmf_flowring_tdls_entry *prev; - struct brcmf_flowring_tdls_entry *search; - u32 i; -- u8 flowid; -+ u16 flowid; - bool sta; - - sta = (flow->addr_mode[ifidx] == ADDR_INDIRECT); -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h -index 95fd1c9675d1..068e68d94999 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h -@@ -16,7 +16,7 @@ - #define BRCMFMAC_FLOWRING_H - - --#define BRCMF_FLOWRING_HASHSIZE 256 -+#define BRCMF_FLOWRING_HASHSIZE 512 /* has to be 2^x */ - #define BRCMF_FLOWRING_INVALID_ID 0xFFFFFFFF - - -@@ -24,7 +24,7 @@ struct brcmf_flowring_hash { - u8 mac[ETH_ALEN]; - u8 fifo; - u8 ifidx; -- u8 flowid; -+ u16 flowid; - }; - - enum ring_status { -@@ -61,16 +61,16 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN], - u8 prio, u8 ifidx); - u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN], - u8 prio, u8 ifidx); --void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid); --void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid); --u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid); --u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid, -+void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid); -+void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid); -+u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid); -+u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid, - struct sk_buff *skb); --struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid); --void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid, -+struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid); -+void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid, - struct sk_buff *skb); --u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid); --u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid); -+u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid); -+u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid); - struct brcmf_flowring *brcmf_flowring_attach(struct device *dev, u16 nrofrings); - void brcmf_flowring_detach(struct brcmf_flowring *flow); - void brcmf_flowring_configure_addr_mode(struct brcmf_flowring *flow, int ifidx, -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c -index c2bdb91746cf..922966734a7f 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c -@@ -677,7 +677,7 @@ static u32 brcmf_msgbuf_flowring_create(struct brcmf_msgbuf *msgbuf, int ifidx, - } - - --static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid) -+static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u16 flowid) - { - struct brcmf_flowring *flow = msgbuf->flow; - struct brcmf_commonring *commonring; -@@ -1310,7 +1310,7 @@ int brcmf_proto_msgbuf_rx_trigger(struct device *dev) - } - - --void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid) -+void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid) - { - struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd; - struct msgbuf_tx_flowring_delete_req *delete; -@@ -1415,6 +1415,13 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr) - u32 count; - - if_msgbuf = drvr->bus_if->msgbuf; -+ -+ if (if_msgbuf->nrof_flowrings >= BRCMF_FLOWRING_HASHSIZE) { -+ brcmf_err("driver not configured for this many flowrings %d\n", -+ if_msgbuf->nrof_flowrings); -+ if_msgbuf->nrof_flowrings = BRCMF_FLOWRING_HASHSIZE - 1; -+ } -+ - msgbuf = kzalloc(sizeof(*msgbuf), GFP_KERNEL); - if (!msgbuf) - goto fail; -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h -index 3d513e407e3d..ee6906a3c3f6 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h -@@ -33,7 +33,7 @@ - - - int brcmf_proto_msgbuf_rx_trigger(struct device *dev); --void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid); -+void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid); - int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr); - void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr); - #else -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -index d70a1716f3e0..1486f33a743e 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -@@ -1143,6 +1143,8 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm) - /* the fw is stopped, the aux sta is dead: clean up driver state */ - iwl_mvm_del_aux_sta(mvm); - -+ iwl_free_fw_paging(mvm); -+ - /* - * Clear IN_HW_RESTART flag when stopping the hw (as restart_complete() - * won't be called in this case). -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -index e80be9a59520..89ea70deeb84 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -@@ -684,8 +684,6 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode) - for (i = 0; i < NVM_MAX_NUM_SECTIONS; i++) - kfree(mvm->nvm_sections[i].data); - -- iwl_free_fw_paging(mvm); -- - iwl_mvm_tof_clean(mvm); - - ieee80211_free_hw(mvm->hw); -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -index 5a854c609477..1198caac35c8 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -@@ -731,8 +731,8 @@ static int iwl_pcie_rsa_race_bug_wa(struct iwl_trans *trans) - */ - val = iwl_read_prph(trans, PREG_AUX_BUS_WPROT_0); - if (val & (BIT(1) | BIT(17))) { -- IWL_INFO(trans, -- "can't access the RSA semaphore it is write protected\n"); -+ IWL_DEBUG_INFO(trans, -+ "can't access the RSA semaphore it is write protected\n"); - return 0; - } - -diff --git a/drivers/net/wireless/marvell/mwifiex/sta_event.c b/drivers/net/wireless/marvell/mwifiex/sta_event.c -index ff3ee9dfbbd5..23bae87d4d3d 100644 ---- a/drivers/net/wireless/marvell/mwifiex/sta_event.c -+++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c -@@ -607,11 +607,13 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv) - - case EVENT_PS_AWAKE: - mwifiex_dbg(adapter, EVENT, "info: EVENT: AWAKE\n"); -- if (!adapter->pps_uapsd_mode && priv->port_open && -+ if (!adapter->pps_uapsd_mode && -+ (priv->port_open || -+ (priv->bss_mode == NL80211_IFTYPE_ADHOC)) && - priv->media_connected && adapter->sleep_period.period) { -- adapter->pps_uapsd_mode = true; -- mwifiex_dbg(adapter, EVENT, -- "event: PPS/UAPSD mode activated\n"); -+ adapter->pps_uapsd_mode = true; -+ mwifiex_dbg(adapter, EVENT, -+ "event: PPS/UAPSD mode activated\n"); - } - adapter->tx_lock_flag = false; - if (adapter->pps_uapsd_mode && adapter->gen_null_pkt) { -diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c -index 6a4fc5d183cf..d7db6f23e728 100644 ---- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c -+++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c -@@ -314,6 +314,7 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss, - mwifiex_dbg(adapter, ERROR, - "Attempt to reconnect on csa closed chan(%d)\n", - bss_desc->channel); -+ ret = -1; - goto done; - } - -diff --git a/drivers/net/wireless/marvell/mwifiex/wmm.c b/drivers/net/wireless/marvell/mwifiex/wmm.c -index acccd6734e3b..499e5a741c62 100644 ---- a/drivers/net/wireless/marvell/mwifiex/wmm.c -+++ b/drivers/net/wireless/marvell/mwifiex/wmm.c -@@ -475,7 +475,8 @@ mwifiex_wmm_lists_empty(struct mwifiex_adapter *adapter) - priv = adapter->priv[i]; - if (!priv) - continue; -- if (!priv->port_open) -+ if (!priv->port_open && -+ (priv->bss_mode != NL80211_IFTYPE_ADHOC)) - continue; - if (adapter->if_ops.is_port_ready && - !adapter->if_ops.is_port_ready(priv)) -@@ -1099,7 +1100,8 @@ mwifiex_wmm_get_highest_priolist_ptr(struct mwifiex_adapter *adapter, - - priv_tmp = adapter->bss_prio_tbl[j].bss_prio_cur->priv; - -- if (!priv_tmp->port_open || -+ if (((priv_tmp->bss_mode != NL80211_IFTYPE_ADHOC) && -+ !priv_tmp->port_open) || - (atomic_read(&priv_tmp->wmm.tx_pkts_queued) == 0)) - continue; - -diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c -index bf9afbf46c1b..4b0bb6b4f6f1 100644 ---- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c -+++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c -@@ -1026,6 +1026,7 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x0411, 0x01a2) }, - { USB_DEVICE(0x0411, 0x01ee) }, - { USB_DEVICE(0x0411, 0x01a8) }, -+ { USB_DEVICE(0x0411, 0x01fd) }, - /* Corega */ - { USB_DEVICE(0x07aa, 0x002f) }, - { USB_DEVICE(0x07aa, 0x003c) }, -diff --git a/drivers/net/wireless/realtek/rtlwifi/rc.c b/drivers/net/wireless/realtek/rtlwifi/rc.c -index 28f7010e7108..1aca77719521 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rc.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rc.c -@@ -41,7 +41,7 @@ static u8 _rtl_rc_get_highest_rix(struct rtl_priv *rtlpriv, - struct rtl_hal *rtlhal = rtl_hal(rtlpriv); - struct rtl_phy *rtlphy = &(rtlpriv->phy); - struct rtl_sta_info *sta_entry = NULL; -- u8 wireless_mode = 0; -+ u16 wireless_mode = 0; - - /* - *this rate is no use for true rate, firmware -@@ -99,7 +99,7 @@ static void _rtl_rc_rate_set_series(struct rtl_priv *rtlpriv, - { - struct rtl_mac *mac = rtl_mac(rtlpriv); - struct rtl_sta_info *sta_entry = NULL; -- u8 wireless_mode = 0; -+ u16 wireless_mode = 0; - u8 sgi_20 = 0, sgi_40 = 0, sgi_80 = 0; - - if (sta) { -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -index bbb789f8990b..5e5719b26774 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -@@ -3855,7 +3855,7 @@ void rtl8821ae_update_channel_access_setting(struct ieee80211_hw *hw) - { - struct rtl_priv *rtlpriv = rtl_priv(hw); - struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); -- u8 wireless_mode = mac->mode; -+ u16 wireless_mode = mac->mode; - u8 sifs_timer, r2t_sifs; - - rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_SLOT_TIME, -diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h -index 4544752a2ba8..84397b190cc0 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/wifi.h -+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h -@@ -1323,14 +1323,13 @@ struct rtl_tid_data { - - struct rtl_sta_info { - struct list_head list; -- u8 ratr_index; -- u8 wireless_mode; -- u8 mimo_ps; -- u8 mac_addr[ETH_ALEN]; - struct rtl_tid_data tids[MAX_TID_COUNT]; -- - /* just used for ap adhoc or mesh*/ - struct rssi_sta rssi_stat; -+ u16 wireless_mode; -+ u8 ratr_index; -+ u8 mimo_ps; -+ u8 mac_addr[ETH_ALEN]; - } __packed; - - struct rtl_priv; -diff --git a/drivers/net/wireless/ti/wlcore/event.c b/drivers/net/wireless/ti/wlcore/event.c -index c96405498bf4..4b59f67724de 100644 ---- a/drivers/net/wireless/ti/wlcore/event.c -+++ b/drivers/net/wireless/ti/wlcore/event.c -@@ -38,7 +38,7 @@ - - int wlcore_event_fw_logger(struct wl1271 *wl) - { -- u32 ret; -+ int ret; - struct fw_logger_information fw_log; - u8 *buffer; - u32 internal_fw_addrbase = WL18XX_DATA_RAM_BASE_ADDRESS; -diff --git a/drivers/nfc/st21nfca/i2c.c b/drivers/nfc/st21nfca/i2c.c -index 1f44a151d206..d5a099b022e4 100644 ---- a/drivers/nfc/st21nfca/i2c.c -+++ b/drivers/nfc/st21nfca/i2c.c -@@ -524,8 +524,10 @@ static int st21nfca_hci_i2c_acpi_request_resources(struct i2c_client *client) - /* Get EN GPIO from ACPI */ - gpiod_ena = devm_gpiod_get_index(dev, ST21NFCA_GPIO_NAME_EN, 1, - GPIOD_OUT_LOW); -- if (!IS_ERR(gpiod_ena)) -- phy->gpio_ena = desc_to_gpio(gpiod_ena); -+ if (!IS_ERR(gpiod_ena)) { -+ nfc_err(dev, "Unable to get ENABLE GPIO\n"); -+ return -ENODEV; -+ } - - phy->gpio_ena = desc_to_gpio(gpiod_ena); - -diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c -index 588803ad6847..6ccba0d862df 100644 ---- a/drivers/ntb/hw/amd/ntb_hw_amd.c -+++ b/drivers/ntb/hw/amd/ntb_hw_amd.c -@@ -357,20 +357,6 @@ static int amd_ntb_db_clear_mask(struct ntb_dev *ntb, u64 db_bits) - return 0; - } - --static int amd_ntb_peer_db_addr(struct ntb_dev *ntb, -- phys_addr_t *db_addr, -- resource_size_t *db_size) --{ -- struct amd_ntb_dev *ndev = ntb_ndev(ntb); -- -- if (db_addr) -- *db_addr = (phys_addr_t)(ndev->peer_mmio + AMD_DBREQ_OFFSET); -- if (db_size) -- *db_size = sizeof(u32); -- -- return 0; --} -- - static int amd_ntb_peer_db_set(struct ntb_dev *ntb, u64 db_bits) - { - struct amd_ntb_dev *ndev = ntb_ndev(ntb); -@@ -415,20 +401,6 @@ static int amd_ntb_spad_write(struct ntb_dev *ntb, - return 0; - } - --static int amd_ntb_peer_spad_addr(struct ntb_dev *ntb, int idx, -- phys_addr_t *spad_addr) --{ -- struct amd_ntb_dev *ndev = ntb_ndev(ntb); -- -- if (idx < 0 || idx >= ndev->spad_count) -- return -EINVAL; -- -- if (spad_addr) -- *spad_addr = (phys_addr_t)(ndev->self_mmio + AMD_SPAD_OFFSET + -- ndev->peer_spad + (idx << 2)); -- return 0; --} -- - static u32 amd_ntb_peer_spad_read(struct ntb_dev *ntb, int idx) - { - struct amd_ntb_dev *ndev = ntb_ndev(ntb); -@@ -472,12 +444,10 @@ static const struct ntb_dev_ops amd_ntb_ops = { - .db_clear = amd_ntb_db_clear, - .db_set_mask = amd_ntb_db_set_mask, - .db_clear_mask = amd_ntb_db_clear_mask, -- .peer_db_addr = amd_ntb_peer_db_addr, - .peer_db_set = amd_ntb_peer_db_set, - .spad_count = amd_ntb_spad_count, - .spad_read = amd_ntb_spad_read, - .spad_write = amd_ntb_spad_write, -- .peer_spad_addr = amd_ntb_peer_spad_addr, - .peer_spad_read = amd_ntb_peer_spad_read, - .peer_spad_write = amd_ntb_peer_spad_write, - }; -diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c -index c8a37ba4b4f9..6bdc1e7b7503 100644 ---- a/drivers/ntb/test/ntb_perf.c -+++ b/drivers/ntb/test/ntb_perf.c -@@ -178,7 +178,7 @@ static void perf_copy_callback(void *data) - atomic_dec(&pctx->dma_sync); - } - --static ssize_t perf_copy(struct pthr_ctx *pctx, char *dst, -+static ssize_t perf_copy(struct pthr_ctx *pctx, char __iomem *dst, - char *src, size_t size) - { - struct perf_ctx *perf = pctx->perf; -@@ -189,7 +189,8 @@ static ssize_t perf_copy(struct pthr_ctx *pctx, char *dst, - dma_cookie_t cookie; - size_t src_off, dst_off; - struct perf_mw *mw = &perf->mw; -- u64 vbase, dst_vaddr; -+ void __iomem *vbase; -+ void __iomem *dst_vaddr; - dma_addr_t dst_phys; - int retries = 0; - -@@ -204,14 +205,14 @@ static ssize_t perf_copy(struct pthr_ctx *pctx, char *dst, - } - - device = chan->device; -- src_off = (size_t)src & ~PAGE_MASK; -- dst_off = (size_t)dst & ~PAGE_MASK; -+ src_off = (uintptr_t)src & ~PAGE_MASK; -+ dst_off = (uintptr_t __force)dst & ~PAGE_MASK; - - if (!is_dma_copy_aligned(device, src_off, dst_off, size)) - return -ENODEV; - -- vbase = (u64)(u64 *)mw->vbase; -- dst_vaddr = (u64)(u64 *)dst; -+ vbase = mw->vbase; -+ dst_vaddr = dst; - dst_phys = mw->phys_addr + (dst_vaddr - vbase); - - unmap = dmaengine_get_unmap_data(device->dev, 1, GFP_NOWAIT); -@@ -261,13 +262,13 @@ err_get_unmap: - return 0; - } - --static int perf_move_data(struct pthr_ctx *pctx, char *dst, char *src, -+static int perf_move_data(struct pthr_ctx *pctx, char __iomem *dst, char *src, - u64 buf_size, u64 win_size, u64 total) - { - int chunks, total_chunks, i; - int copied_chunks = 0; - u64 copied = 0, result; -- char *tmp = dst; -+ char __iomem *tmp = dst; - u64 perf, diff_us; - ktime_t kstart, kstop, kdiff; - -@@ -324,7 +325,7 @@ static int ntb_perf_thread(void *data) - struct perf_ctx *perf = pctx->perf; - struct pci_dev *pdev = perf->ntb->pdev; - struct perf_mw *mw = &perf->mw; -- char *dst; -+ char __iomem *dst; - u64 win_size, buf_size, total; - void *src; - int rc, node, i; -@@ -364,7 +365,7 @@ static int ntb_perf_thread(void *data) - if (buf_size > MAX_TEST_SIZE) - buf_size = MAX_TEST_SIZE; - -- dst = (char *)mw->vbase; -+ dst = (char __iomem *)mw->vbase; - - atomic_inc(&perf->tsync); - while (atomic_read(&perf->tsync) != perf->perf_threads) -diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c -index 5d28e9405f32..cdbab06bf74f 100644 ---- a/drivers/nvdimm/bus.c -+++ b/drivers/nvdimm/bus.c -@@ -335,7 +335,7 @@ static const struct nd_cmd_desc __nd_cmd_dimm_descs[] = { - [ND_CMD_IMPLEMENTED] = { }, - [ND_CMD_SMART] = { - .out_num = 2, -- .out_sizes = { 4, 8, }, -+ .out_sizes = { 4, 128, }, - }, - [ND_CMD_SMART_THRESHOLD] = { - .out_num = 2, -@@ -513,10 +513,10 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, - - /* fail write commands (when read-only) */ - if (read_only) -- switch (ioctl_cmd) { -- case ND_IOCTL_VENDOR: -- case ND_IOCTL_SET_CONFIG_DATA: -- case ND_IOCTL_ARS_START: -+ switch (cmd) { -+ case ND_CMD_VENDOR: -+ case ND_CMD_SET_CONFIG_DATA: -+ case ND_CMD_ARS_START: - dev_dbg(&nvdimm_bus->dev, "'%s' command while read-only.\n", - nvdimm ? nvdimm_cmd_name(cmd) - : nvdimm_bus_cmd_name(cmd)); -diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c -index ae81a2f1da50..f0b56b3aac4d 100644 ---- a/drivers/nvdimm/pfn_devs.c -+++ b/drivers/nvdimm/pfn_devs.c -@@ -315,7 +315,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn) - } else { - /* from init we validate */ - if (memcmp(nd_pfn->uuid, pfn_sb->uuid, 16) != 0) -- return -EINVAL; -+ return -ENODEV; - } - - if (nd_pfn->align > nvdimm_namespace_capacity(ndns)) { -diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c -index 8d0b54670184..02c574f8ccb3 100644 ---- a/drivers/nvdimm/pmem.c -+++ b/drivers/nvdimm/pmem.c -@@ -66,22 +66,25 @@ static int pmem_do_bvec(struct pmem_device *pmem, struct page *page, - unsigned int len, unsigned int off, int rw, - sector_t sector) - { -+ int rc = 0; - void *mem = kmap_atomic(page); - phys_addr_t pmem_off = sector * 512 + pmem->data_offset; - void __pmem *pmem_addr = pmem->virt_addr + pmem_off; - - if (rw == READ) { - if (unlikely(is_bad_pmem(&pmem->bb, sector, len))) -- return -EIO; -- memcpy_from_pmem(mem + off, pmem_addr, len); -- flush_dcache_page(page); -+ rc = -EIO; -+ else { -+ memcpy_from_pmem(mem + off, pmem_addr, len); -+ flush_dcache_page(page); -+ } - } else { - flush_dcache_page(page); - memcpy_to_pmem(pmem_addr, mem + off, len); - } - - kunmap_atomic(mem); -- return 0; -+ return rc; - } - - static blk_qc_t pmem_make_request(struct request_queue *q, struct bio *bio) -@@ -311,9 +314,16 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn) - * implementation will limit the pfns advertised through - * ->direct_access() to those that are included in the memmap. - */ -- if (nd_pfn->mode == PFN_MODE_PMEM) -- offset = ALIGN(SZ_8K + 64 * npfns, nd_pfn->align); -- else if (nd_pfn->mode == PFN_MODE_RAM) -+ if (nd_pfn->mode == PFN_MODE_PMEM) { -+ unsigned long memmap_size; -+ -+ /* -+ * vmemmap_populate_hugepages() allocates the memmap array in -+ * HPAGE_SIZE chunks. -+ */ -+ memmap_size = ALIGN(64 * npfns, PMD_SIZE); -+ offset = ALIGN(SZ_8K + memmap_size, nd_pfn->align); -+ } else if (nd_pfn->mode == PFN_MODE_RAM) - offset = ALIGN(SZ_8K, nd_pfn->align); - else - goto err; -diff --git a/drivers/nvmem/mxs-ocotp.c b/drivers/nvmem/mxs-ocotp.c -index 8ba19bba3156..2bb3c5799ac4 100644 ---- a/drivers/nvmem/mxs-ocotp.c -+++ b/drivers/nvmem/mxs-ocotp.c -@@ -94,7 +94,7 @@ static int mxs_ocotp_read(void *context, const void *reg, size_t reg_size, - if (ret) - goto close_banks; - -- while (val_size) { -+ while (val_size >= reg_size) { - if ((offset < OCOTP_DATA_OFFSET) || (offset % 16)) { - /* fill up non-data register */ - *buf = 0; -@@ -103,7 +103,7 @@ static int mxs_ocotp_read(void *context, const void *reg, size_t reg_size, - } - - buf++; -- val_size--; -+ val_size -= reg_size; - offset += reg_size; - } - -diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c -index 1a3556a9e9ea..ed01c0172e4a 100644 ---- a/drivers/of/of_reserved_mem.c -+++ b/drivers/of/of_reserved_mem.c -@@ -32,11 +32,13 @@ int __init __weak early_init_dt_alloc_reserved_memory_arch(phys_addr_t size, - phys_addr_t align, phys_addr_t start, phys_addr_t end, bool nomap, - phys_addr_t *res_base) - { -+ phys_addr_t base; - /* - * We use __memblock_alloc_base() because memblock_alloc_base() - * panic()s on allocation failure. - */ -- phys_addr_t base = __memblock_alloc_base(size, align, end); -+ end = !end ? MEMBLOCK_ALLOC_ANYWHERE : end; -+ base = __memblock_alloc_base(size, align, end); - if (!base) - return -ENOMEM; - -diff --git a/drivers/pci/host/pci-imx6.c b/drivers/pci/host/pci-imx6.c -index fe600964fa50..88ccfeaa49c7 100644 ---- a/drivers/pci/host/pci-imx6.c -+++ b/drivers/pci/host/pci-imx6.c -@@ -32,7 +32,7 @@ - #define to_imx6_pcie(x) container_of(x, struct imx6_pcie, pp) - - struct imx6_pcie { -- struct gpio_desc *reset_gpio; -+ int reset_gpio; - struct clk *pcie_bus; - struct clk *pcie_phy; - struct clk *pcie; -@@ -287,10 +287,10 @@ static int imx6_pcie_deassert_core_reset(struct pcie_port *pp) - usleep_range(200, 500); - - /* Some boards don't have PCIe reset GPIO. */ -- if (imx6_pcie->reset_gpio) { -- gpiod_set_value_cansleep(imx6_pcie->reset_gpio, 0); -+ if (gpio_is_valid(imx6_pcie->reset_gpio)) { -+ gpio_set_value_cansleep(imx6_pcie->reset_gpio, 0); - msleep(100); -- gpiod_set_value_cansleep(imx6_pcie->reset_gpio, 1); -+ gpio_set_value_cansleep(imx6_pcie->reset_gpio, 1); - } - return 0; - -@@ -561,6 +561,7 @@ static int __init imx6_pcie_probe(struct platform_device *pdev) - { - struct imx6_pcie *imx6_pcie; - struct pcie_port *pp; -+ struct device_node *np = pdev->dev.of_node; - struct resource *dbi_base; - int ret; - -@@ -581,8 +582,15 @@ static int __init imx6_pcie_probe(struct platform_device *pdev) - return PTR_ERR(pp->dbi_base); - - /* Fetch GPIOs */ -- imx6_pcie->reset_gpio = devm_gpiod_get_optional(&pdev->dev, "reset", -- GPIOD_OUT_LOW); -+ imx6_pcie->reset_gpio = of_get_named_gpio(np, "reset-gpio", 0); -+ if (gpio_is_valid(imx6_pcie->reset_gpio)) { -+ ret = devm_gpio_request_one(&pdev->dev, imx6_pcie->reset_gpio, -+ GPIOF_OUT_INIT_LOW, "PCIe reset"); -+ if (ret) { -+ dev_err(&pdev->dev, "unable to get reset gpio\n"); -+ return ret; -+ } -+ } - - /* Fetch clocks */ - imx6_pcie->pcie_phy = devm_clk_get(&pdev->dev, "pcie_phy"); -diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c -index 6d7ab9bb0d5a..6b0056e9c33e 100644 ---- a/drivers/pci/probe.c -+++ b/drivers/pci/probe.c -@@ -179,6 +179,9 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, - u16 orig_cmd; - struct pci_bus_region region, inverted_region; - -+ if (dev->non_compliant_bars) -+ return 0; -+ - mask = type ? PCI_ROM_ADDRESS_MASK : ~0; - - /* No printks while decoding is disabled! */ -@@ -1171,6 +1174,7 @@ static void pci_msi_setup_pci_dev(struct pci_dev *dev) - int pci_setup_device(struct pci_dev *dev) - { - u32 class; -+ u16 cmd; - u8 hdr_type; - int pos = 0; - struct pci_bus_region region; -@@ -1214,6 +1218,16 @@ int pci_setup_device(struct pci_dev *dev) - /* device class may be changed after fixup */ - class = dev->class >> 8; - -+ if (dev->non_compliant_bars) { -+ pci_read_config_word(dev, PCI_COMMAND, &cmd); -+ if (cmd & (PCI_COMMAND_IO | PCI_COMMAND_MEMORY)) { -+ dev_info(&dev->dev, "device has non-compliant BARs; disabling IO/MEM decoding\n"); -+ cmd &= ~PCI_COMMAND_IO; -+ cmd &= ~PCI_COMMAND_MEMORY; -+ pci_write_config_word(dev, PCI_COMMAND, cmd); -+ } -+ } -+ - switch (dev->hdr_type) { /* header type */ - case PCI_HEADER_TYPE_NORMAL: /* standard header */ - if (class == PCI_CLASS_BRIDGE_PCI) -diff --git a/drivers/pcmcia/db1xxx_ss.c b/drivers/pcmcia/db1xxx_ss.c -index 4c2fa05b4589..944674ee3464 100644 ---- a/drivers/pcmcia/db1xxx_ss.c -+++ b/drivers/pcmcia/db1xxx_ss.c -@@ -56,6 +56,7 @@ struct db1x_pcmcia_sock { - int stschg_irq; /* card-status-change irq */ - int card_irq; /* card irq */ - int eject_irq; /* db1200/pb1200 have these */ -+ int insert_gpio; /* db1000 carddetect gpio */ - - #define BOARD_TYPE_DEFAULT 0 /* most boards */ - #define BOARD_TYPE_DB1200 1 /* IRQs aren't gpios */ -@@ -83,7 +84,7 @@ static int db1200_card_inserted(struct db1x_pcmcia_sock *sock) - /* carddetect gpio: low-active */ - static int db1000_card_inserted(struct db1x_pcmcia_sock *sock) - { -- return !gpio_get_value(irq_to_gpio(sock->insert_irq)); -+ return !gpio_get_value(sock->insert_gpio); - } - - static int db1x_card_inserted(struct db1x_pcmcia_sock *sock) -@@ -457,9 +458,15 @@ static int db1x_pcmcia_socket_probe(struct platform_device *pdev) - r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "card"); - sock->card_irq = r ? r->start : 0; - -- /* insert: irq which triggers on card insertion/ejection */ -+ /* insert: irq which triggers on card insertion/ejection -+ * BIG FAT NOTE: on DB1000/1100/1500/1550 we pass a GPIO here! -+ */ - r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "insert"); - sock->insert_irq = r ? r->start : -1; -+ if (sock->board_type == BOARD_TYPE_DEFAULT) { -+ sock->insert_gpio = r ? r->start : -1; -+ sock->insert_irq = r ? gpio_to_irq(r->start) : -1; -+ } - - /* stschg: irq which trigger on card status change (optional) */ - r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "stschg"); -diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c -index 0f5997ceb494..08b1d93da9fe 100644 ---- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c -+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c -@@ -779,7 +779,7 @@ static int bcm2835_pctl_dt_node_to_map(struct pinctrl_dev *pctldev, - } - if (num_pulls) { - err = of_property_read_u32_index(np, "brcm,pull", -- (num_funcs > 1) ? i : 0, &pull); -+ (num_pulls > 1) ? i : 0, &pull); - if (err) - goto out; - err = bcm2835_pctl_dt_node_to_map_pull(pc, np, pin, -diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c -index a5bb93987378..1029aa7889b5 100644 ---- a/drivers/pinctrl/freescale/pinctrl-imx.c -+++ b/drivers/pinctrl/freescale/pinctrl-imx.c -@@ -726,19 +726,18 @@ int imx_pinctrl_probe(struct platform_device *pdev, - - if (of_property_read_bool(dev_np, "fsl,input-sel")) { - np = of_parse_phandle(dev_np, "fsl,input-sel", 0); -- if (np) { -- ipctl->input_sel_base = of_iomap(np, 0); -- if (IS_ERR(ipctl->input_sel_base)) { -- of_node_put(np); -- dev_err(&pdev->dev, -- "iomuxc input select base address not found\n"); -- return PTR_ERR(ipctl->input_sel_base); -- } -- } else { -+ if (!np) { - dev_err(&pdev->dev, "iomuxc fsl,input-sel property not found\n"); - return -EINVAL; - } -+ -+ ipctl->input_sel_base = of_iomap(np, 0); - of_node_put(np); -+ if (!ipctl->input_sel_base) { -+ dev_err(&pdev->dev, -+ "iomuxc input select base address not found\n"); -+ return -ENOMEM; -+ } - } - - imx_pinctrl_desc.name = dev_name(&pdev->dev); -diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c -index e96e86d2e745..3878d23ca7a8 100644 ---- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c -+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c -@@ -949,7 +949,8 @@ static int mtk_gpio_set_debounce(struct gpio_chip *chip, unsigned offset, - struct mtk_pinctrl *pctl = dev_get_drvdata(chip->parent); - int eint_num, virq, eint_offset; - unsigned int set_offset, bit, clr_bit, clr_offset, rst, i, unmask, dbnc; -- static const unsigned int dbnc_arr[] = {0 , 1, 16, 32, 64, 128, 256}; -+ static const unsigned int debounce_time[] = {500, 1000, 16000, 32000, 64000, -+ 128000, 256000}; - const struct mtk_desc_pin *pin; - struct irq_data *d; - -@@ -967,9 +968,9 @@ static int mtk_gpio_set_debounce(struct gpio_chip *chip, unsigned offset, - if (!mtk_eint_can_en_debounce(pctl, eint_num)) - return -ENOSYS; - -- dbnc = ARRAY_SIZE(dbnc_arr); -- for (i = 0; i < ARRAY_SIZE(dbnc_arr); i++) { -- if (debounce <= dbnc_arr[i]) { -+ dbnc = ARRAY_SIZE(debounce_time); -+ for (i = 0; i < ARRAY_SIZE(debounce_time); i++) { -+ if (debounce <= debounce_time[i]) { - dbnc = i; - break; - } -diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c -index 352406108fa0..c8969dd49449 100644 ---- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c -+++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c -@@ -990,7 +990,7 @@ static void nmk_gpio_dbg_show_one(struct seq_file *s, - int val; - - if (pull) -- pullidx = data_out ? 1 : 2; -+ pullidx = data_out ? 2 : 1; - - seq_printf(s, " gpio-%-3d (%-20.20s) in %s %s", - gpio, -diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c -index ee69db6ae1c7..e1c0d4e1bb33 100644 ---- a/drivers/pinctrl/pinctrl-at91-pio4.c -+++ b/drivers/pinctrl/pinctrl-at91-pio4.c -@@ -722,9 +722,11 @@ static int atmel_conf_pin_config_group_set(struct pinctrl_dev *pctldev, - break; - case PIN_CONFIG_BIAS_PULL_UP: - conf |= ATMEL_PIO_PUEN_MASK; -+ conf &= (~ATMEL_PIO_PDEN_MASK); - break; - case PIN_CONFIG_BIAS_PULL_DOWN: - conf |= ATMEL_PIO_PDEN_MASK; -+ conf &= (~ATMEL_PIO_PUEN_MASK); - break; - case PIN_CONFIG_DRIVE_OPEN_DRAIN: - if (arg == 0) -diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c -index 856f736cb1a6..2673cd9d106e 100644 ---- a/drivers/pinctrl/pinctrl-pistachio.c -+++ b/drivers/pinctrl/pinctrl-pistachio.c -@@ -469,27 +469,27 @@ static const char * const pistachio_mips_pll_lock_groups[] = { - "mfio83", - }; - --static const char * const pistachio_sys_pll_lock_groups[] = { -+static const char * const pistachio_audio_pll_lock_groups[] = { - "mfio84", - }; - --static const char * const pistachio_wifi_pll_lock_groups[] = { -+static const char * const pistachio_rpu_v_pll_lock_groups[] = { - "mfio85", - }; - --static const char * const pistachio_bt_pll_lock_groups[] = { -+static const char * const pistachio_rpu_l_pll_lock_groups[] = { - "mfio86", - }; - --static const char * const pistachio_rpu_v_pll_lock_groups[] = { -+static const char * const pistachio_sys_pll_lock_groups[] = { - "mfio87", - }; - --static const char * const pistachio_rpu_l_pll_lock_groups[] = { -+static const char * const pistachio_wifi_pll_lock_groups[] = { - "mfio88", - }; - --static const char * const pistachio_audio_pll_lock_groups[] = { -+static const char * const pistachio_bt_pll_lock_groups[] = { - "mfio89", - }; - -@@ -559,12 +559,12 @@ enum pistachio_mux_option { - PISTACHIO_FUNCTION_DREQ4, - PISTACHIO_FUNCTION_DREQ5, - PISTACHIO_FUNCTION_MIPS_PLL_LOCK, -+ PISTACHIO_FUNCTION_AUDIO_PLL_LOCK, -+ PISTACHIO_FUNCTION_RPU_V_PLL_LOCK, -+ PISTACHIO_FUNCTION_RPU_L_PLL_LOCK, - PISTACHIO_FUNCTION_SYS_PLL_LOCK, - PISTACHIO_FUNCTION_WIFI_PLL_LOCK, - PISTACHIO_FUNCTION_BT_PLL_LOCK, -- PISTACHIO_FUNCTION_RPU_V_PLL_LOCK, -- PISTACHIO_FUNCTION_RPU_L_PLL_LOCK, -- PISTACHIO_FUNCTION_AUDIO_PLL_LOCK, - PISTACHIO_FUNCTION_DEBUG_RAW_CCA_IND, - PISTACHIO_FUNCTION_DEBUG_ED_SEC20_CCA_IND, - PISTACHIO_FUNCTION_DEBUG_ED_SEC40_CCA_IND, -@@ -620,12 +620,12 @@ static const struct pistachio_function pistachio_functions[] = { - FUNCTION(dreq4), - FUNCTION(dreq5), - FUNCTION(mips_pll_lock), -+ FUNCTION(audio_pll_lock), -+ FUNCTION(rpu_v_pll_lock), -+ FUNCTION(rpu_l_pll_lock), - FUNCTION(sys_pll_lock), - FUNCTION(wifi_pll_lock), - FUNCTION(bt_pll_lock), -- FUNCTION(rpu_v_pll_lock), -- FUNCTION(rpu_l_pll_lock), -- FUNCTION(audio_pll_lock), - FUNCTION(debug_raw_cca_ind), - FUNCTION(debug_ed_sec20_cca_ind), - FUNCTION(debug_ed_sec40_cca_ind), -diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c -index d24e5f1d1525..bd2e657163b8 100644 ---- a/drivers/pinctrl/pinctrl-single.c -+++ b/drivers/pinctrl/pinctrl-single.c -@@ -1273,9 +1273,9 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs, - - /* Parse pins in each row from LSB */ - while (mask) { -- bit_pos = ffs(mask); -+ bit_pos = __ffs(mask); - pin_num_from_lsb = bit_pos / pcs->bits_per_pin; -- mask_pos = ((pcs->fmask) << (bit_pos - 1)); -+ mask_pos = ((pcs->fmask) << bit_pos); - val_pos = val & mask_pos; - submask = mask & mask_pos; - -@@ -1844,7 +1844,7 @@ static int pcs_probe(struct platform_device *pdev) - ret = of_property_read_u32(np, "pinctrl-single,function-mask", - &pcs->fmask); - if (!ret) { -- pcs->fshift = ffs(pcs->fmask) - 1; -+ pcs->fshift = __ffs(pcs->fmask); - pcs->fmax = pcs->fmask >> pcs->fshift; - } else { - /* If mask property doesn't exist, function mux is invalid. */ -diff --git a/drivers/pinctrl/sh-pfc/core.c b/drivers/pinctrl/sh-pfc/core.c -index 181ea98a63b7..2b0d70217bbd 100644 ---- a/drivers/pinctrl/sh-pfc/core.c -+++ b/drivers/pinctrl/sh-pfc/core.c -@@ -545,7 +545,9 @@ static int sh_pfc_probe(struct platform_device *pdev) - return ret; - } - -- pinctrl_provide_dummies(); -+ /* Enable dummy states for those platforms without pinctrl support */ -+ if (!of_have_populated_dt()) -+ pinctrl_provide_dummies(); - - ret = sh_pfc_init_ranges(pfc); - if (ret < 0) -diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c -index 00265f0435a7..8b381d69df86 100644 ---- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c -+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c -@@ -485,6 +485,7 @@ static const struct sunxi_pinctrl_desc sun8i_a33_pinctrl_data = { - .pins = sun8i_a33_pins, - .npins = ARRAY_SIZE(sun8i_a33_pins), - .irq_banks = 2, -+ .irq_bank_base = 1, - }; - - static int sun8i_a33_pinctrl_probe(struct platform_device *pdev) -diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c -index 7a2465f5e71e..884c2b314567 100644 ---- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c -+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c -@@ -578,7 +578,7 @@ static void sunxi_pinctrl_irq_release_resources(struct irq_data *d) - static int sunxi_pinctrl_irq_set_type(struct irq_data *d, unsigned int type) - { - struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d); -- u32 reg = sunxi_irq_cfg_reg(d->hwirq); -+ u32 reg = sunxi_irq_cfg_reg(d->hwirq, pctl->desc->irq_bank_base); - u8 index = sunxi_irq_cfg_offset(d->hwirq); - unsigned long flags; - u32 regval; -@@ -625,7 +625,8 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d, unsigned int type) - static void sunxi_pinctrl_irq_ack(struct irq_data *d) - { - struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d); -- u32 status_reg = sunxi_irq_status_reg(d->hwirq); -+ u32 status_reg = sunxi_irq_status_reg(d->hwirq, -+ pctl->desc->irq_bank_base); - u8 status_idx = sunxi_irq_status_offset(d->hwirq); - - /* Clear the IRQ */ -@@ -635,7 +636,7 @@ static void sunxi_pinctrl_irq_ack(struct irq_data *d) - static void sunxi_pinctrl_irq_mask(struct irq_data *d) - { - struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d); -- u32 reg = sunxi_irq_ctrl_reg(d->hwirq); -+ u32 reg = sunxi_irq_ctrl_reg(d->hwirq, pctl->desc->irq_bank_base); - u8 idx = sunxi_irq_ctrl_offset(d->hwirq); - unsigned long flags; - u32 val; -@@ -652,7 +653,7 @@ static void sunxi_pinctrl_irq_mask(struct irq_data *d) - static void sunxi_pinctrl_irq_unmask(struct irq_data *d) - { - struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d); -- u32 reg = sunxi_irq_ctrl_reg(d->hwirq); -+ u32 reg = sunxi_irq_ctrl_reg(d->hwirq, pctl->desc->irq_bank_base); - u8 idx = sunxi_irq_ctrl_offset(d->hwirq); - unsigned long flags; - u32 val; -@@ -744,7 +745,7 @@ static void sunxi_pinctrl_irq_handler(struct irq_desc *desc) - if (bank == pctl->desc->irq_banks) - return; - -- reg = sunxi_irq_status_reg_from_bank(bank); -+ reg = sunxi_irq_status_reg_from_bank(bank, pctl->desc->irq_bank_base); - val = readl(pctl->membase + reg); - - if (val) { -@@ -1023,9 +1024,11 @@ int sunxi_pinctrl_init(struct platform_device *pdev, - - for (i = 0; i < pctl->desc->irq_banks; i++) { - /* Mask and clear all IRQs before registering a handler */ -- writel(0, pctl->membase + sunxi_irq_ctrl_reg_from_bank(i)); -+ writel(0, pctl->membase + sunxi_irq_ctrl_reg_from_bank(i, -+ pctl->desc->irq_bank_base)); - writel(0xffffffff, -- pctl->membase + sunxi_irq_status_reg_from_bank(i)); -+ pctl->membase + sunxi_irq_status_reg_from_bank(i, -+ pctl->desc->irq_bank_base)); - - irq_set_chained_handler_and_data(pctl->irq[i], - sunxi_pinctrl_irq_handler, -diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h -index e248e81a0f9e..0afce1ab12d0 100644 ---- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h -+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h -@@ -97,6 +97,7 @@ struct sunxi_pinctrl_desc { - int npins; - unsigned pin_base; - unsigned irq_banks; -+ unsigned irq_bank_base; - bool irq_read_needs_mux; - }; - -@@ -233,12 +234,12 @@ static inline u32 sunxi_pull_offset(u16 pin) - return pin_num * PULL_PINS_BITS; - } - --static inline u32 sunxi_irq_cfg_reg(u16 irq) -+static inline u32 sunxi_irq_cfg_reg(u16 irq, unsigned bank_base) - { - u8 bank = irq / IRQ_PER_BANK; - u8 reg = (irq % IRQ_PER_BANK) / IRQ_CFG_IRQ_PER_REG * 0x04; - -- return IRQ_CFG_REG + bank * IRQ_MEM_SIZE + reg; -+ return IRQ_CFG_REG + (bank_base + bank) * IRQ_MEM_SIZE + reg; - } - - static inline u32 sunxi_irq_cfg_offset(u16 irq) -@@ -247,16 +248,16 @@ static inline u32 sunxi_irq_cfg_offset(u16 irq) - return irq_num * IRQ_CFG_IRQ_BITS; - } - --static inline u32 sunxi_irq_ctrl_reg_from_bank(u8 bank) -+static inline u32 sunxi_irq_ctrl_reg_from_bank(u8 bank, unsigned bank_base) - { -- return IRQ_CTRL_REG + bank * IRQ_MEM_SIZE; -+ return IRQ_CTRL_REG + (bank_base + bank) * IRQ_MEM_SIZE; - } - --static inline u32 sunxi_irq_ctrl_reg(u16 irq) -+static inline u32 sunxi_irq_ctrl_reg(u16 irq, unsigned bank_base) - { - u8 bank = irq / IRQ_PER_BANK; - -- return sunxi_irq_ctrl_reg_from_bank(bank); -+ return sunxi_irq_ctrl_reg_from_bank(bank, bank_base); - } - - static inline u32 sunxi_irq_ctrl_offset(u16 irq) -@@ -265,16 +266,16 @@ static inline u32 sunxi_irq_ctrl_offset(u16 irq) - return irq_num * IRQ_CTRL_IRQ_BITS; - } - --static inline u32 sunxi_irq_status_reg_from_bank(u8 bank) -+static inline u32 sunxi_irq_status_reg_from_bank(u8 bank, unsigned bank_base) - { -- return IRQ_STATUS_REG + bank * IRQ_MEM_SIZE; -+ return IRQ_STATUS_REG + (bank_base + bank) * IRQ_MEM_SIZE; - } - --static inline u32 sunxi_irq_status_reg(u16 irq) -+static inline u32 sunxi_irq_status_reg(u16 irq, unsigned bank_base) - { - u8 bank = irq / IRQ_PER_BANK; - -- return sunxi_irq_status_reg_from_bank(bank); -+ return sunxi_irq_status_reg_from_bank(bank, bank_base); - } - - static inline u32 sunxi_irq_status_offset(u16 irq) -diff --git a/drivers/platform/x86/dell-rbtn.c b/drivers/platform/x86/dell-rbtn.c -index cd410e392550..d33e9ad3218f 100644 ---- a/drivers/platform/x86/dell-rbtn.c -+++ b/drivers/platform/x86/dell-rbtn.c -@@ -28,6 +28,7 @@ struct rbtn_data { - enum rbtn_type type; - struct rfkill *rfkill; - struct input_dev *input_dev; -+ bool suspended; - }; - - -@@ -220,9 +221,55 @@ static const struct acpi_device_id rbtn_ids[] = { - { "", 0 }, - }; - -+#ifdef CONFIG_PM_SLEEP -+static void ACPI_SYSTEM_XFACE rbtn_clear_suspended_flag(void *context) -+{ -+ struct rbtn_data *rbtn_data = context; -+ -+ rbtn_data->suspended = false; -+} -+ -+static int rbtn_suspend(struct device *dev) -+{ -+ struct acpi_device *device = to_acpi_device(dev); -+ struct rbtn_data *rbtn_data = acpi_driver_data(device); -+ -+ rbtn_data->suspended = true; -+ -+ return 0; -+} -+ -+static int rbtn_resume(struct device *dev) -+{ -+ struct acpi_device *device = to_acpi_device(dev); -+ struct rbtn_data *rbtn_data = acpi_driver_data(device); -+ acpi_status status; -+ -+ /* -+ * Upon resume, some BIOSes send an ACPI notification thet triggers -+ * an unwanted input event. In order to ignore it, we use a flag -+ * that we set at suspend and clear once we have received the extra -+ * ACPI notification. Since ACPI notifications are delivered -+ * asynchronously to drivers, we clear the flag from the workqueue -+ * used to deliver the notifications. This should be enough -+ * to have the flag cleared only after we received the extra -+ * notification, if any. -+ */ -+ status = acpi_os_execute(OSL_NOTIFY_HANDLER, -+ rbtn_clear_suspended_flag, rbtn_data); -+ if (ACPI_FAILURE(status)) -+ rbtn_clear_suspended_flag(rbtn_data); -+ -+ return 0; -+} -+#endif -+ -+static SIMPLE_DEV_PM_OPS(rbtn_pm_ops, rbtn_suspend, rbtn_resume); -+ - static struct acpi_driver rbtn_driver = { - .name = "dell-rbtn", - .ids = rbtn_ids, -+ .drv.pm = &rbtn_pm_ops, - .ops = { - .add = rbtn_add, - .remove = rbtn_remove, -@@ -384,6 +431,15 @@ static void rbtn_notify(struct acpi_device *device, u32 event) - { - struct rbtn_data *rbtn_data = device->driver_data; - -+ /* -+ * Some BIOSes send a notification at resume. -+ * Ignore it to prevent unwanted input events. -+ */ -+ if (rbtn_data->suspended) { -+ dev_dbg(&device->dev, "ACPI notification ignored\n"); -+ return; -+ } -+ - if (event != 0x80) { - dev_info(&device->dev, "Received unknown event (0x%x)\n", - event); -diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c -index d78ee151c9e4..be3bc2f4edd4 100644 ---- a/drivers/platform/x86/ideapad-laptop.c -+++ b/drivers/platform/x86/ideapad-laptop.c -@@ -865,6 +865,20 @@ static const struct dmi_system_id no_hw_rfkill_list[] = { - }, - }, - { -+ .ident = "Lenovo ideapad Y700-15ISK", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad Y700-15ISK"), -+ }, -+ }, -+ { -+ .ident = "Lenovo ideapad Y700 Touch-15ISK", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad Y700 Touch-15ISK"), -+ }, -+ }, -+ { - .ident = "Lenovo ideapad Y700-17ISK", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c -index 73833079bac8..d6baea6a7544 100644 ---- a/drivers/platform/x86/toshiba_acpi.c -+++ b/drivers/platform/x86/toshiba_acpi.c -@@ -133,7 +133,7 @@ MODULE_LICENSE("GPL"); - /* Field definitions */ - #define HCI_ACCEL_MASK 0x7fff - #define HCI_HOTKEY_DISABLE 0x0b --#define HCI_HOTKEY_ENABLE 0x01 -+#define HCI_HOTKEY_ENABLE 0x09 - #define HCI_HOTKEY_SPECIAL_FUNCTIONS 0x10 - #define HCI_LCD_BRIGHTNESS_BITS 3 - #define HCI_LCD_BRIGHTNESS_SHIFT (16-HCI_LCD_BRIGHTNESS_BITS) -diff --git a/drivers/pwm/pwm-brcmstb.c b/drivers/pwm/pwm-brcmstb.c -index 423ce087cd9c..5d5adee16886 100644 ---- a/drivers/pwm/pwm-brcmstb.c -+++ b/drivers/pwm/pwm-brcmstb.c -@@ -274,8 +274,8 @@ static int brcmstb_pwm_probe(struct platform_device *pdev) - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - p->base = devm_ioremap_resource(&pdev->dev, res); -- if (!p->base) { -- ret = -ENOMEM; -+ if (IS_ERR(p->base)) { -+ ret = PTR_ERR(p->base); - goto out_clk; - } - -diff --git a/drivers/pwm/pwm-omap-dmtimer.c b/drivers/pwm/pwm-omap-dmtimer.c -index 826634ec0d5c..e0679eb399f6 100644 ---- a/drivers/pwm/pwm-omap-dmtimer.c -+++ b/drivers/pwm/pwm-omap-dmtimer.c -@@ -31,6 +31,7 @@ - #include - - #define DM_TIMER_LOAD_MIN 0xfffffffe -+#define DM_TIMER_MAX 0xffffffff - - struct pwm_omap_dmtimer_chip { - struct pwm_chip chip; -@@ -46,13 +47,9 @@ to_pwm_omap_dmtimer_chip(struct pwm_chip *chip) - return container_of(chip, struct pwm_omap_dmtimer_chip, chip); - } - --static int pwm_omap_dmtimer_calc_value(unsigned long clk_rate, int ns) -+static u32 pwm_omap_dmtimer_get_clock_cycles(unsigned long clk_rate, int ns) - { -- u64 c = (u64)clk_rate * ns; -- -- do_div(c, NSEC_PER_SEC); -- -- return DM_TIMER_LOAD_MIN - c; -+ return DIV_ROUND_CLOSEST_ULL((u64)clk_rate * ns, NSEC_PER_SEC); - } - - static void pwm_omap_dmtimer_start(struct pwm_omap_dmtimer_chip *omap) -@@ -99,7 +96,8 @@ static int pwm_omap_dmtimer_config(struct pwm_chip *chip, - int duty_ns, int period_ns) - { - struct pwm_omap_dmtimer_chip *omap = to_pwm_omap_dmtimer_chip(chip); -- int load_value, match_value; -+ u32 period_cycles, duty_cycles; -+ u32 load_value, match_value; - struct clk *fclk; - unsigned long clk_rate; - bool timer_active; -@@ -117,15 +115,13 @@ static int pwm_omap_dmtimer_config(struct pwm_chip *chip, - fclk = omap->pdata->get_fclk(omap->dm_timer); - if (!fclk) { - dev_err(chip->dev, "invalid pmtimer fclk\n"); -- mutex_unlock(&omap->mutex); -- return -EINVAL; -+ goto err_einval; - } - - clk_rate = clk_get_rate(fclk); - if (!clk_rate) { - dev_err(chip->dev, "invalid pmtimer fclk rate\n"); -- mutex_unlock(&omap->mutex); -- return -EINVAL; -+ goto err_einval; - } - - dev_dbg(chip->dev, "clk rate: %luHz\n", clk_rate); -@@ -133,11 +129,45 @@ static int pwm_omap_dmtimer_config(struct pwm_chip *chip, - /* - * Calculate the appropriate load and match values based on the - * specified period and duty cycle. The load value determines the -- * cycle time and the match value determines the duty cycle. -+ * period time and the match value determines the duty time. -+ * -+ * The period lasts for (DM_TIMER_MAX-load_value+1) clock cycles. -+ * Similarly, the active time lasts (match_value-load_value+1) cycles. -+ * The non-active time is the remainder: (DM_TIMER_MAX-match_value) -+ * clock cycles. -+ * -+ * NOTE: It is required that: load_value <= match_value < DM_TIMER_MAX -+ * -+ * References: -+ * OMAP4430/60/70 TRM sections 22.2.4.10 and 22.2.4.11 -+ * AM335x Sitara TRM sections 20.1.3.5 and 20.1.3.6 - */ -- load_value = pwm_omap_dmtimer_calc_value(clk_rate, period_ns); -- match_value = pwm_omap_dmtimer_calc_value(clk_rate, -- period_ns - duty_ns); -+ period_cycles = pwm_omap_dmtimer_get_clock_cycles(clk_rate, period_ns); -+ duty_cycles = pwm_omap_dmtimer_get_clock_cycles(clk_rate, duty_ns); -+ -+ if (period_cycles < 2) { -+ dev_info(chip->dev, -+ "period %d ns too short for clock rate %lu Hz\n", -+ period_ns, clk_rate); -+ goto err_einval; -+ } -+ -+ if (duty_cycles < 1) { -+ dev_dbg(chip->dev, -+ "duty cycle %d ns is too short for clock rate %lu Hz\n", -+ duty_ns, clk_rate); -+ dev_dbg(chip->dev, "using minimum of 1 clock cycle\n"); -+ duty_cycles = 1; -+ } else if (duty_cycles >= period_cycles) { -+ dev_dbg(chip->dev, -+ "duty cycle %d ns is too long for period %d ns at clock rate %lu Hz\n", -+ duty_ns, period_ns, clk_rate); -+ dev_dbg(chip->dev, "using maximum of 1 clock cycle less than period\n"); -+ duty_cycles = period_cycles - 1; -+ } -+ -+ load_value = (DM_TIMER_MAX - period_cycles) + 1; -+ match_value = load_value + duty_cycles - 1; - - /* - * We MUST stop the associated dual-mode timer before attempting to -@@ -166,6 +196,11 @@ static int pwm_omap_dmtimer_config(struct pwm_chip *chip, - mutex_unlock(&omap->mutex); - - return 0; -+ -+err_einval: -+ mutex_unlock(&omap->mutex); -+ -+ return -EINVAL; - } - - static int pwm_omap_dmtimer_set_polarity(struct pwm_chip *chip, -diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c -index f2e1a39ce0f3..5cf4a97e0304 100644 ---- a/drivers/regulator/axp20x-regulator.c -+++ b/drivers/regulator/axp20x-regulator.c -@@ -221,10 +221,10 @@ static const struct regulator_desc axp22x_regulators[] = { - AXP22X_ELDO2_V_OUT, 0x1f, AXP22X_PWR_OUT_CTRL2, BIT(1)), - AXP_DESC(AXP22X, ELDO3, "eldo3", "eldoin", 700, 3300, 100, - AXP22X_ELDO3_V_OUT, 0x1f, AXP22X_PWR_OUT_CTRL2, BIT(2)), -- AXP_DESC_IO(AXP22X, LDO_IO0, "ldo_io0", "ips", 1800, 3300, 100, -+ AXP_DESC_IO(AXP22X, LDO_IO0, "ldo_io0", "ips", 700, 3300, 100, - AXP22X_LDO_IO0_V_OUT, 0x1f, AXP20X_GPIO0_CTRL, 0x07, - AXP22X_IO_ENABLED, AXP22X_IO_DISABLED), -- AXP_DESC_IO(AXP22X, LDO_IO1, "ldo_io1", "ips", 1800, 3300, 100, -+ AXP_DESC_IO(AXP22X, LDO_IO1, "ldo_io1", "ips", 700, 3300, 100, - AXP22X_LDO_IO1_V_OUT, 0x1f, AXP20X_GPIO1_CTRL, 0x07, - AXP22X_IO_ENABLED, AXP22X_IO_DISABLED), - AXP_DESC_FIXED(AXP22X, RTC_LDO, "rtc_ldo", "ips", 3000), -diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c -index 3242ffc0cb25..09dce49609c1 100644 ---- a/drivers/regulator/s2mps11.c -+++ b/drivers/regulator/s2mps11.c -@@ -306,7 +306,7 @@ static struct regulator_ops s2mps11_buck_ops = { - .enable_mask = S2MPS11_ENABLE_MASK \ - } - --#define regulator_desc_s2mps11_buck6_10(num, min, step) { \ -+#define regulator_desc_s2mps11_buck67810(num, min, step) { \ - .name = "BUCK"#num, \ - .id = S2MPS11_BUCK##num, \ - .ops = &s2mps11_buck_ops, \ -@@ -322,6 +322,22 @@ static struct regulator_ops s2mps11_buck_ops = { - .enable_mask = S2MPS11_ENABLE_MASK \ - } - -+#define regulator_desc_s2mps11_buck9 { \ -+ .name = "BUCK9", \ -+ .id = S2MPS11_BUCK9, \ -+ .ops = &s2mps11_buck_ops, \ -+ .type = REGULATOR_VOLTAGE, \ -+ .owner = THIS_MODULE, \ -+ .min_uV = MIN_3000_MV, \ -+ .uV_step = STEP_25_MV, \ -+ .n_voltages = S2MPS11_BUCK9_N_VOLTAGES, \ -+ .ramp_delay = S2MPS11_RAMP_DELAY, \ -+ .vsel_reg = S2MPS11_REG_B9CTRL2, \ -+ .vsel_mask = S2MPS11_BUCK9_VSEL_MASK, \ -+ .enable_reg = S2MPS11_REG_B9CTRL1, \ -+ .enable_mask = S2MPS11_ENABLE_MASK \ -+} -+ - static const struct regulator_desc s2mps11_regulators[] = { - regulator_desc_s2mps11_ldo(1, STEP_25_MV), - regulator_desc_s2mps11_ldo(2, STEP_50_MV), -@@ -366,11 +382,11 @@ static const struct regulator_desc s2mps11_regulators[] = { - regulator_desc_s2mps11_buck1_4(3), - regulator_desc_s2mps11_buck1_4(4), - regulator_desc_s2mps11_buck5, -- regulator_desc_s2mps11_buck6_10(6, MIN_600_MV, STEP_6_25_MV), -- regulator_desc_s2mps11_buck6_10(7, MIN_600_MV, STEP_6_25_MV), -- regulator_desc_s2mps11_buck6_10(8, MIN_600_MV, STEP_6_25_MV), -- regulator_desc_s2mps11_buck6_10(9, MIN_3000_MV, STEP_25_MV), -- regulator_desc_s2mps11_buck6_10(10, MIN_750_MV, STEP_12_5_MV), -+ regulator_desc_s2mps11_buck67810(6, MIN_600_MV, STEP_6_25_MV), -+ regulator_desc_s2mps11_buck67810(7, MIN_600_MV, STEP_6_25_MV), -+ regulator_desc_s2mps11_buck67810(8, MIN_600_MV, STEP_6_25_MV), -+ regulator_desc_s2mps11_buck9, -+ regulator_desc_s2mps11_buck67810(10, MIN_750_MV, STEP_12_5_MV), - }; - - static struct regulator_ops s2mps14_reg_ops; -diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c -index 58f5d3b8e981..27343e1c43ef 100644 ---- a/drivers/regulator/s5m8767.c -+++ b/drivers/regulator/s5m8767.c -@@ -202,9 +202,10 @@ static int s5m8767_get_register(struct s5m8767_info *s5m8767, int reg_id, - } - } - -- if (i < s5m8767->num_regulators) -- *enable_ctrl = -- s5m8767_opmode_reg[reg_id][mode] << S5M8767_ENCTRL_SHIFT; -+ if (i >= s5m8767->num_regulators) -+ return -EINVAL; -+ -+ *enable_ctrl = s5m8767_opmode_reg[reg_id][mode] << S5M8767_ENCTRL_SHIFT; - - return 0; - } -@@ -937,8 +938,12 @@ static int s5m8767_pmic_probe(struct platform_device *pdev) - else - regulators[id].vsel_mask = 0xff; - -- s5m8767_get_register(s5m8767, id, &enable_reg, -+ ret = s5m8767_get_register(s5m8767, id, &enable_reg, - &enable_val); -+ if (ret) { -+ dev_err(s5m8767->dev, "error reading registers\n"); -+ return ret; -+ } - regulators[id].enable_reg = enable_reg; - regulators[id].enable_mask = S5M8767_ENCTRL_MASK; - regulators[id].enable_val = enable_val; -diff --git a/drivers/rtc/rtc-ds1685.c b/drivers/rtc/rtc-ds1685.c -index 535050fc5e9f..08e0ff8c786a 100644 ---- a/drivers/rtc/rtc-ds1685.c -+++ b/drivers/rtc/rtc-ds1685.c -@@ -187,9 +187,9 @@ ds1685_rtc_end_data_access(struct ds1685_priv *rtc) - * Only use this where you are certain another lock will not be held. - */ - static inline void --ds1685_rtc_begin_ctrl_access(struct ds1685_priv *rtc, unsigned long flags) -+ds1685_rtc_begin_ctrl_access(struct ds1685_priv *rtc, unsigned long *flags) - { -- spin_lock_irqsave(&rtc->lock, flags); -+ spin_lock_irqsave(&rtc->lock, *flags); - ds1685_rtc_switch_to_bank1(rtc); - } - -@@ -1300,7 +1300,7 @@ ds1685_rtc_sysfs_ctrl_regs_store(struct device *dev, - { - struct ds1685_priv *rtc = dev_get_drvdata(dev); - u8 reg = 0, bit = 0, tmp; -- unsigned long flags = 0; -+ unsigned long flags; - long int val = 0; - const struct ds1685_rtc_ctrl_regs *reg_info = - ds1685_rtc_sysfs_ctrl_regs_lookup(attr->attr.name); -@@ -1321,7 +1321,7 @@ ds1685_rtc_sysfs_ctrl_regs_store(struct device *dev, - bit = reg_info->bit; - - /* Safe to spinlock during a write. */ -- ds1685_rtc_begin_ctrl_access(rtc, flags); -+ ds1685_rtc_begin_ctrl_access(rtc, &flags); - tmp = rtc->read(rtc, reg); - rtc->write(rtc, reg, (val ? (tmp | bit) : (tmp & ~(bit)))); - ds1685_rtc_end_ctrl_access(rtc, flags); -diff --git a/drivers/rtc/rtc-hym8563.c b/drivers/rtc/rtc-hym8563.c -index 097325d96db5..b1b4746a0eab 100644 ---- a/drivers/rtc/rtc-hym8563.c -+++ b/drivers/rtc/rtc-hym8563.c -@@ -144,7 +144,7 @@ static int hym8563_rtc_set_time(struct device *dev, struct rtc_time *tm) - * it does not seem to carry it over a subsequent write/read. - * So we'll limit ourself to 100 years, starting at 2000 for now. - */ -- buf[6] = tm->tm_year - 100; -+ buf[6] = bin2bcd(tm->tm_year - 100); - - /* - * CTL1 only contains TEST-mode bits apart from stop, -diff --git a/drivers/rtc/rtc-max77686.c b/drivers/rtc/rtc-max77686.c -index 7184a0eda793..725dccae24e7 100644 ---- a/drivers/rtc/rtc-max77686.c -+++ b/drivers/rtc/rtc-max77686.c -@@ -465,7 +465,7 @@ static int max77686_rtc_probe(struct platform_device *pdev) - - info->virq = regmap_irq_get_virq(max77686->rtc_irq_data, - MAX77686_RTCIRQ_RTCA1); -- if (!info->virq) { -+ if (info->virq <= 0) { - ret = -ENXIO; - goto err_rtc; - } -diff --git a/drivers/rtc/rtc-rx8025.c b/drivers/rtc/rtc-rx8025.c -index bd911bafb809..17341feadad1 100644 ---- a/drivers/rtc/rtc-rx8025.c -+++ b/drivers/rtc/rtc-rx8025.c -@@ -65,7 +65,6 @@ - - static const struct i2c_device_id rx8025_id[] = { - { "rx8025", 0 }, -- { "rv8803", 1 }, - { } - }; - MODULE_DEVICE_TABLE(i2c, rx8025_id); -diff --git a/drivers/rtc/rtc-vr41xx.c b/drivers/rtc/rtc-vr41xx.c -index f64c282275b3..e1b86bb01062 100644 ---- a/drivers/rtc/rtc-vr41xx.c -+++ b/drivers/rtc/rtc-vr41xx.c -@@ -272,12 +272,13 @@ static irqreturn_t rtclong1_interrupt(int irq, void *dev_id) - } - - static const struct rtc_class_ops vr41xx_rtc_ops = { -- .release = vr41xx_rtc_release, -- .ioctl = vr41xx_rtc_ioctl, -- .read_time = vr41xx_rtc_read_time, -- .set_time = vr41xx_rtc_set_time, -- .read_alarm = vr41xx_rtc_read_alarm, -- .set_alarm = vr41xx_rtc_set_alarm, -+ .release = vr41xx_rtc_release, -+ .ioctl = vr41xx_rtc_ioctl, -+ .read_time = vr41xx_rtc_read_time, -+ .set_time = vr41xx_rtc_set_time, -+ .read_alarm = vr41xx_rtc_read_alarm, -+ .set_alarm = vr41xx_rtc_set_alarm, -+ .alarm_irq_enable = vr41xx_rtc_alarm_irq_enable, - }; - - static int rtc_probe(struct platform_device *pdev) -diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c -index d72867257346..3eff2a69fe08 100644 ---- a/drivers/scsi/NCR5380.c -+++ b/drivers/scsi/NCR5380.c -@@ -760,7 +760,7 @@ static struct scsi_cmnd *dequeue_next_cmd(struct Scsi_Host *instance) - struct NCR5380_cmd *ncmd; - struct scsi_cmnd *cmd; - -- if (list_empty(&hostdata->autosense)) { -+ if (hostdata->sensing || list_empty(&hostdata->autosense)) { - list_for_each_entry(ncmd, &hostdata->unissued, list) { - cmd = NCR5380_to_scmd(ncmd); - dsprintk(NDEBUG_QUEUES, instance, "dequeue: cmd=%p target=%d busy=0x%02x lun=%llu\n", -@@ -793,7 +793,7 @@ static void requeue_cmd(struct Scsi_Host *instance, struct scsi_cmnd *cmd) - struct NCR5380_hostdata *hostdata = shost_priv(instance); - struct NCR5380_cmd *ncmd = scsi_cmd_priv(cmd); - -- if (hostdata->sensing) { -+ if (hostdata->sensing == cmd) { - scsi_eh_restore_cmnd(cmd, &hostdata->ses); - list_add(&ncmd->list, &hostdata->autosense); - hostdata->sensing = NULL; -@@ -815,15 +815,17 @@ static void NCR5380_main(struct work_struct *work) - struct NCR5380_hostdata *hostdata = - container_of(work, struct NCR5380_hostdata, main_task); - struct Scsi_Host *instance = hostdata->host; -- struct scsi_cmnd *cmd; - int done; - - do { - done = 1; - - spin_lock_irq(&hostdata->lock); -- while (!hostdata->connected && -- (cmd = dequeue_next_cmd(instance))) { -+ while (!hostdata->connected && !hostdata->selecting) { -+ struct scsi_cmnd *cmd = dequeue_next_cmd(instance); -+ -+ if (!cmd) -+ break; - - dsprintk(NDEBUG_MAIN, instance, "main: dequeued %p\n", cmd); - -@@ -840,8 +842,7 @@ static void NCR5380_main(struct work_struct *work) - * entire unit. - */ - -- cmd = NCR5380_select(instance, cmd); -- if (!cmd) { -+ if (!NCR5380_select(instance, cmd)) { - dsprintk(NDEBUG_MAIN, instance, "main: select complete\n"); - } else { - dsprintk(NDEBUG_MAIN | NDEBUG_QUEUES, instance, -@@ -1056,6 +1057,11 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance, - /* Reselection interrupt */ - goto out; - } -+ if (!hostdata->selecting) { -+ /* Command was aborted */ -+ NCR5380_write(MODE_REG, MR_BASE); -+ goto out; -+ } - if (err < 0) { - NCR5380_write(MODE_REG, MR_BASE); - shost_printk(KERN_ERR, instance, -@@ -1759,9 +1765,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) - unsigned char msgout = NOP; - int sink = 0; - int len; --#if defined(PSEUDO_DMA) || defined(REAL_DMA_POLL) - int transfersize; --#endif - unsigned char *data; - unsigned char phase, tmp, extended_msg[10], old_phase = 0xff; - struct scsi_cmnd *cmd; -@@ -1798,6 +1802,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) - do_abort(instance); - cmd->result = DID_ERROR << 16; - complete_cmd(instance, cmd); -+ hostdata->connected = NULL; - return; - #endif - case PHASE_DATAIN: -@@ -1847,20 +1852,23 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) - sink = 1; - do_abort(instance); - cmd->result = DID_ERROR << 16; -- complete_cmd(instance, cmd); - /* XXX - need to source or sink data here, as appropriate */ - } else - cmd->SCp.this_residual -= transfersize - len; - } else - #endif /* defined(PSEUDO_DMA) || defined(REAL_DMA_POLL) */ - { -- spin_unlock_irq(&hostdata->lock); -- NCR5380_transfer_pio(instance, &phase, -- (int *)&cmd->SCp.this_residual, -+ /* Break up transfer into 3 ms chunks, -+ * presuming 6 accesses per handshake. -+ */ -+ transfersize = min((unsigned long)cmd->SCp.this_residual, -+ hostdata->accesses_per_ms / 2); -+ len = transfersize; -+ NCR5380_transfer_pio(instance, &phase, &len, - (unsigned char **)&cmd->SCp.ptr); -- spin_lock_irq(&hostdata->lock); -+ cmd->SCp.this_residual -= transfersize - len; - } -- break; -+ return; - case PHASE_MSGIN: - len = 1; - data = &tmp; -@@ -2292,14 +2300,17 @@ static bool list_del_cmd(struct list_head *haystack, - * [disconnected -> connected ->]... - * [autosense -> connected ->] done - * -- * If cmd is unissued then just remove it. -- * If cmd is disconnected, try to select the target. -- * If cmd is connected, try to send an abort message. -- * If cmd is waiting for autosense, give it a chance to complete but check -- * that it isn't left connected. - * If cmd was not found at all then presumably it has already been completed, - * in which case return SUCCESS to try to avoid further EH measures. -+ * - * If the command has not completed yet, we must not fail to find it. -+ * We have no option but to forget the aborted command (even if it still -+ * lacks sense data). The mid-layer may re-issue a command that is in error -+ * recovery (see scsi_send_eh_cmnd), but the logic and data structures in -+ * this driver are such that a command can appear on one queue only. -+ * -+ * The lock protects driver data structures, but EH handlers also use it -+ * to serialize their own execution and prevent their own re-entry. - */ - - static int NCR5380_abort(struct scsi_cmnd *cmd) -@@ -2322,6 +2333,7 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) - "abort: removed %p from issue queue\n", cmd); - cmd->result = DID_ABORT << 16; - cmd->scsi_done(cmd); /* No tag or busy flag to worry about */ -+ goto out; - } - - if (hostdata->selecting == cmd) { -@@ -2336,58 +2348,21 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) - if (list_del_cmd(&hostdata->disconnected, cmd)) { - dsprintk(NDEBUG_ABORT, instance, - "abort: removed %p from disconnected list\n", cmd); -- cmd->result = DID_ERROR << 16; -- if (!hostdata->connected) -- NCR5380_select(instance, cmd); -- if (hostdata->connected != cmd) { -- complete_cmd(instance, cmd); -- result = FAILED; -- goto out; -- } -+ /* Can't call NCR5380_select() and send ABORT because that -+ * means releasing the lock. Need a bus reset. -+ */ -+ set_host_byte(cmd, DID_ERROR); -+ complete_cmd(instance, cmd); -+ result = FAILED; -+ goto out; - } - - if (hostdata->connected == cmd) { - dsprintk(NDEBUG_ABORT, instance, "abort: cmd %p is connected\n", cmd); - hostdata->connected = NULL; -- if (do_abort(instance)) { -- set_host_byte(cmd, DID_ERROR); -- complete_cmd(instance, cmd); -- result = FAILED; -- goto out; -- } -- set_host_byte(cmd, DID_ABORT); - #ifdef REAL_DMA - hostdata->dma_len = 0; - #endif -- if (cmd->cmnd[0] == REQUEST_SENSE) -- complete_cmd(instance, cmd); -- else { -- struct NCR5380_cmd *ncmd = scsi_cmd_priv(cmd); -- -- /* Perform autosense for this command */ -- list_add(&ncmd->list, &hostdata->autosense); -- } -- } -- -- if (list_find_cmd(&hostdata->autosense, cmd)) { -- dsprintk(NDEBUG_ABORT, instance, -- "abort: found %p on sense queue\n", cmd); -- spin_unlock_irqrestore(&hostdata->lock, flags); -- queue_work(hostdata->work_q, &hostdata->main_task); -- msleep(1000); -- spin_lock_irqsave(&hostdata->lock, flags); -- if (list_del_cmd(&hostdata->autosense, cmd)) { -- dsprintk(NDEBUG_ABORT, instance, -- "abort: removed %p from sense queue\n", cmd); -- set_host_byte(cmd, DID_ABORT); -- complete_cmd(instance, cmd); -- goto out; -- } -- } -- -- if (hostdata->connected == cmd) { -- dsprintk(NDEBUG_ABORT, instance, "abort: cmd %p is connected\n", cmd); -- hostdata->connected = NULL; - if (do_abort(instance)) { - set_host_byte(cmd, DID_ERROR); - complete_cmd(instance, cmd); -@@ -2395,9 +2370,14 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) - goto out; - } - set_host_byte(cmd, DID_ABORT); --#ifdef REAL_DMA -- hostdata->dma_len = 0; --#endif -+ complete_cmd(instance, cmd); -+ goto out; -+ } -+ -+ if (list_del_cmd(&hostdata->autosense, cmd)) { -+ dsprintk(NDEBUG_ABORT, instance, -+ "abort: removed %p from sense queue\n", cmd); -+ set_host_byte(cmd, DID_ERROR); - complete_cmd(instance, cmd); - } - -@@ -2450,7 +2430,16 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) - * commands! - */ - -- hostdata->selecting = NULL; -+ if (list_del_cmd(&hostdata->unissued, cmd)) { -+ cmd->result = DID_RESET << 16; -+ cmd->scsi_done(cmd); -+ } -+ -+ if (hostdata->selecting) { -+ hostdata->selecting->result = DID_RESET << 16; -+ complete_cmd(instance, hostdata->selecting); -+ hostdata->selecting = NULL; -+ } - - list_for_each_entry(ncmd, &hostdata->disconnected, list) { - struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd); -@@ -2458,6 +2447,7 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) - set_host_byte(cmd, DID_RESET); - cmd->scsi_done(cmd); - } -+ INIT_LIST_HEAD(&hostdata->disconnected); - - list_for_each_entry(ncmd, &hostdata->autosense, list) { - struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd); -@@ -2465,6 +2455,7 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) - set_host_byte(cmd, DID_RESET); - cmd->scsi_done(cmd); - } -+ INIT_LIST_HEAD(&hostdata->autosense); - - if (hostdata->connected) { - set_host_byte(hostdata->connected, DID_RESET); -@@ -2472,12 +2463,6 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) - hostdata->connected = NULL; - } - -- if (hostdata->sensing) { -- set_host_byte(hostdata->connected, DID_RESET); -- complete_cmd(instance, hostdata->sensing); -- hostdata->sensing = NULL; -- } -- - for (i = 0; i < 8; ++i) - hostdata->busy[i] = 0; - #ifdef REAL_DMA -diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h -index 074878b55a0b..d044f3f273be 100644 ---- a/drivers/scsi/aacraid/aacraid.h -+++ b/drivers/scsi/aacraid/aacraid.h -@@ -944,6 +944,7 @@ struct fib { - */ - struct list_head fiblink; - void *data; -+ u32 vector_no; - struct hw_fib *hw_fib_va; /* Actual shared object */ - dma_addr_t hw_fib_pa; /* physical address of hw_fib*/ - }; -@@ -2113,6 +2114,7 @@ static inline unsigned int cap_to_cyls(sector_t capacity, unsigned divisor) - int aac_acquire_irq(struct aac_dev *dev); - void aac_free_irq(struct aac_dev *dev); - const char *aac_driverinfo(struct Scsi_Host *); -+void aac_fib_vector_assign(struct aac_dev *dev); - struct fib *aac_fib_alloc(struct aac_dev *dev); - int aac_fib_setup(struct aac_dev *dev); - void aac_fib_map_free(struct aac_dev *dev); -diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c -index a1f90fe849c9..4cbf54928640 100644 ---- a/drivers/scsi/aacraid/commsup.c -+++ b/drivers/scsi/aacraid/commsup.c -@@ -83,13 +83,38 @@ static int fib_map_alloc(struct aac_dev *dev) - - void aac_fib_map_free(struct aac_dev *dev) - { -- pci_free_consistent(dev->pdev, -- dev->max_fib_size * (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB), -- dev->hw_fib_va, dev->hw_fib_pa); -+ if (dev->hw_fib_va && dev->max_fib_size) { -+ pci_free_consistent(dev->pdev, -+ (dev->max_fib_size * -+ (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB)), -+ dev->hw_fib_va, dev->hw_fib_pa); -+ } - dev->hw_fib_va = NULL; - dev->hw_fib_pa = 0; - } - -+void aac_fib_vector_assign(struct aac_dev *dev) -+{ -+ u32 i = 0; -+ u32 vector = 1; -+ struct fib *fibptr = NULL; -+ -+ for (i = 0, fibptr = &dev->fibs[i]; -+ i < (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB); -+ i++, fibptr++) { -+ if ((dev->max_msix == 1) || -+ (i > ((dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB - 1) -+ - dev->vector_cap))) { -+ fibptr->vector_no = 0; -+ } else { -+ fibptr->vector_no = vector; -+ vector++; -+ if (vector == dev->max_msix) -+ vector = 1; -+ } -+ } -+} -+ - /** - * aac_fib_setup - setup the fibs - * @dev: Adapter to set up -@@ -151,6 +176,12 @@ int aac_fib_setup(struct aac_dev * dev) - hw_fib_pa = hw_fib_pa + - dev->max_fib_size + sizeof(struct aac_fib_xporthdr); - } -+ -+ /* -+ *Assign vector numbers to fibs -+ */ -+ aac_fib_vector_assign(dev); -+ - /* - * Add the fib chain to the free list - */ -diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c -index 76eaa38ffd6e..8a8e84548d64 100644 ---- a/drivers/scsi/aacraid/linit.c -+++ b/drivers/scsi/aacraid/linit.c -@@ -1404,8 +1404,18 @@ static int aac_acquire_resources(struct aac_dev *dev) - - aac_adapter_enable_int(dev); - -- if (!dev->sync_mode) -+ /*max msix may change after EEH -+ * Re-assign vectors to fibs -+ */ -+ aac_fib_vector_assign(dev); -+ -+ if (!dev->sync_mode) { -+ /* After EEH recovery or suspend resume, max_msix count -+ * may change, therfore updating in init as well. -+ */ - aac_adapter_start(dev); -+ dev->init->Sa_MSIXVectors = cpu_to_le32(dev->max_msix); -+ } - return 0; - - error_iounmap: -diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c -index 2aa34ea8ceb1..bc0203f3d243 100644 ---- a/drivers/scsi/aacraid/src.c -+++ b/drivers/scsi/aacraid/src.c -@@ -156,8 +156,8 @@ static irqreturn_t aac_src_intr_message(int irq, void *dev_id) - break; - if (dev->msi_enabled && dev->max_msix > 1) - atomic_dec(&dev->rrq_outstanding[vector_no]); -- aac_intr_normal(dev, handle-1, 0, isFastResponse, NULL); - dev->host_rrq[index++] = 0; -+ aac_intr_normal(dev, handle-1, 0, isFastResponse, NULL); - if (index == (vector_no + 1) * dev->vector_cap) - index = vector_no * dev->vector_cap; - dev->host_rrq_idx[vector_no] = index; -@@ -452,36 +452,20 @@ static int aac_src_deliver_message(struct fib *fib) - #endif - - u16 hdr_size = le16_to_cpu(fib->hw_fib_va->header.Size); -+ u16 vector_no; - - atomic_inc(&q->numpending); - - if (dev->msi_enabled && fib->hw_fib_va->header.Command != AifRequest && - dev->max_msix > 1) { -- u_int16_t vector_no, first_choice = 0xffff; -- -- vector_no = dev->fibs_pushed_no % dev->max_msix; -- do { -- vector_no += 1; -- if (vector_no == dev->max_msix) -- vector_no = 1; -- if (atomic_read(&dev->rrq_outstanding[vector_no]) < -- dev->vector_cap) -- break; -- if (0xffff == first_choice) -- first_choice = vector_no; -- else if (vector_no == first_choice) -- break; -- } while (1); -- if (vector_no == first_choice) -- vector_no = 0; -- atomic_inc(&dev->rrq_outstanding[vector_no]); -- if (dev->fibs_pushed_no == 0xffffffff) -- dev->fibs_pushed_no = 0; -- else -- dev->fibs_pushed_no++; -+ vector_no = fib->vector_no; - fib->hw_fib_va->header.Handle += (vector_no << 16); -+ } else { -+ vector_no = 0; - } - -+ atomic_inc(&dev->rrq_outstanding[vector_no]); -+ - if (dev->comm_interface == AAC_COMM_MESSAGE_TYPE2) { - /* Calculate the amount to the fibsize bits */ - fibsize = (hdr_size + 127) / 128 - 1; -diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c -index b846a4683562..fc6a83188c1e 100644 ---- a/drivers/scsi/aic7xxx/aic7xxx_osm.c -+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c -@@ -1336,6 +1336,7 @@ ahc_platform_set_tags(struct ahc_softc *ahc, struct scsi_device *sdev, - case AHC_DEV_Q_TAGGED: - scsi_change_queue_depth(sdev, - dev->openings + dev->active); -+ break; - default: - /* - * We allow the OS to queue 2 untagged transactions to -diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c -index e65478651ca9..389825ba5d96 100644 ---- a/drivers/scsi/atari_NCR5380.c -+++ b/drivers/scsi/atari_NCR5380.c -@@ -862,7 +862,7 @@ static struct scsi_cmnd *dequeue_next_cmd(struct Scsi_Host *instance) - struct NCR5380_cmd *ncmd; - struct scsi_cmnd *cmd; - -- if (list_empty(&hostdata->autosense)) { -+ if (hostdata->sensing || list_empty(&hostdata->autosense)) { - list_for_each_entry(ncmd, &hostdata->unissued, list) { - cmd = NCR5380_to_scmd(ncmd); - dsprintk(NDEBUG_QUEUES, instance, "dequeue: cmd=%p target=%d busy=0x%02x lun=%llu\n", -@@ -901,7 +901,7 @@ static void requeue_cmd(struct Scsi_Host *instance, struct scsi_cmnd *cmd) - struct NCR5380_hostdata *hostdata = shost_priv(instance); - struct NCR5380_cmd *ncmd = scsi_cmd_priv(cmd); - -- if (hostdata->sensing) { -+ if (hostdata->sensing == cmd) { - scsi_eh_restore_cmnd(cmd, &hostdata->ses); - list_add(&ncmd->list, &hostdata->autosense); - hostdata->sensing = NULL; -@@ -923,7 +923,6 @@ static void NCR5380_main(struct work_struct *work) - struct NCR5380_hostdata *hostdata = - container_of(work, struct NCR5380_hostdata, main_task); - struct Scsi_Host *instance = hostdata->host; -- struct scsi_cmnd *cmd; - int done; - - /* -@@ -936,8 +935,11 @@ static void NCR5380_main(struct work_struct *work) - done = 1; - - spin_lock_irq(&hostdata->lock); -- while (!hostdata->connected && -- (cmd = dequeue_next_cmd(instance))) { -+ while (!hostdata->connected && !hostdata->selecting) { -+ struct scsi_cmnd *cmd = dequeue_next_cmd(instance); -+ -+ if (!cmd) -+ break; - - dsprintk(NDEBUG_MAIN, instance, "main: dequeued %p\n", cmd); - -@@ -960,8 +962,7 @@ static void NCR5380_main(struct work_struct *work) - #ifdef SUPPORT_TAGS - cmd_get_tag(cmd, cmd->cmnd[0] != REQUEST_SENSE); - #endif -- cmd = NCR5380_select(instance, cmd); -- if (!cmd) { -+ if (!NCR5380_select(instance, cmd)) { - dsprintk(NDEBUG_MAIN, instance, "main: select complete\n"); - maybe_release_dma_irq(instance); - } else { -@@ -1257,6 +1258,11 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance, - /* Reselection interrupt */ - goto out; - } -+ if (!hostdata->selecting) { -+ /* Command was aborted */ -+ NCR5380_write(MODE_REG, MR_BASE); -+ goto out; -+ } - if (err < 0) { - NCR5380_write(MODE_REG, MR_BASE); - shost_printk(KERN_ERR, instance, -@@ -1838,9 +1844,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) - unsigned char msgout = NOP; - int sink = 0; - int len; --#if defined(REAL_DMA) - int transfersize; --#endif - unsigned char *data; - unsigned char phase, tmp, extended_msg[10], old_phase = 0xff; - struct scsi_cmnd *cmd; -@@ -1909,6 +1913,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) - do_abort(instance); - cmd->result = DID_ERROR << 16; - complete_cmd(instance, cmd); -+ hostdata->connected = NULL; - return; - #endif - case PHASE_DATAIN: -@@ -1966,7 +1971,6 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) - sink = 1; - do_abort(instance); - cmd->result = DID_ERROR << 16; -- complete_cmd(instance, cmd); - /* XXX - need to source or sink data here, as appropriate */ - } else { - #ifdef REAL_DMA -@@ -1983,18 +1987,22 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) - } else - #endif /* defined(REAL_DMA) */ - { -- spin_unlock_irq(&hostdata->lock); -- NCR5380_transfer_pio(instance, &phase, -- (int *)&cmd->SCp.this_residual, -+ /* Break up transfer into 3 ms chunks, -+ * presuming 6 accesses per handshake. -+ */ -+ transfersize = min((unsigned long)cmd->SCp.this_residual, -+ hostdata->accesses_per_ms / 2); -+ len = transfersize; -+ NCR5380_transfer_pio(instance, &phase, &len, - (unsigned char **)&cmd->SCp.ptr); -- spin_lock_irq(&hostdata->lock); -+ cmd->SCp.this_residual -= transfersize - len; - } - #if defined(CONFIG_SUN3) && defined(REAL_DMA) - /* if we had intended to dma that command clear it */ - if (sun3_dma_setup_done == cmd) - sun3_dma_setup_done = NULL; - #endif -- break; -+ return; - case PHASE_MSGIN: - len = 1; - data = &tmp; -@@ -2487,14 +2495,17 @@ static bool list_del_cmd(struct list_head *haystack, - * [disconnected -> connected ->]... - * [autosense -> connected ->] done - * -- * If cmd is unissued then just remove it. -- * If cmd is disconnected, try to select the target. -- * If cmd is connected, try to send an abort message. -- * If cmd is waiting for autosense, give it a chance to complete but check -- * that it isn't left connected. - * If cmd was not found at all then presumably it has already been completed, - * in which case return SUCCESS to try to avoid further EH measures. -+ * - * If the command has not completed yet, we must not fail to find it. -+ * We have no option but to forget the aborted command (even if it still -+ * lacks sense data). The mid-layer may re-issue a command that is in error -+ * recovery (see scsi_send_eh_cmnd), but the logic and data structures in -+ * this driver are such that a command can appear on one queue only. -+ * -+ * The lock protects driver data structures, but EH handlers also use it -+ * to serialize their own execution and prevent their own re-entry. - */ - - static int NCR5380_abort(struct scsi_cmnd *cmd) -@@ -2517,6 +2528,7 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) - "abort: removed %p from issue queue\n", cmd); - cmd->result = DID_ABORT << 16; - cmd->scsi_done(cmd); /* No tag or busy flag to worry about */ -+ goto out; - } - - if (hostdata->selecting == cmd) { -@@ -2531,58 +2543,21 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) - if (list_del_cmd(&hostdata->disconnected, cmd)) { - dsprintk(NDEBUG_ABORT, instance, - "abort: removed %p from disconnected list\n", cmd); -- cmd->result = DID_ERROR << 16; -- if (!hostdata->connected) -- NCR5380_select(instance, cmd); -- if (hostdata->connected != cmd) { -- complete_cmd(instance, cmd); -- result = FAILED; -- goto out; -- } -+ /* Can't call NCR5380_select() and send ABORT because that -+ * means releasing the lock. Need a bus reset. -+ */ -+ set_host_byte(cmd, DID_ERROR); -+ complete_cmd(instance, cmd); -+ result = FAILED; -+ goto out; - } - - if (hostdata->connected == cmd) { - dsprintk(NDEBUG_ABORT, instance, "abort: cmd %p is connected\n", cmd); - hostdata->connected = NULL; -- if (do_abort(instance)) { -- set_host_byte(cmd, DID_ERROR); -- complete_cmd(instance, cmd); -- result = FAILED; -- goto out; -- } -- set_host_byte(cmd, DID_ABORT); - #ifdef REAL_DMA - hostdata->dma_len = 0; - #endif -- if (cmd->cmnd[0] == REQUEST_SENSE) -- complete_cmd(instance, cmd); -- else { -- struct NCR5380_cmd *ncmd = scsi_cmd_priv(cmd); -- -- /* Perform autosense for this command */ -- list_add(&ncmd->list, &hostdata->autosense); -- } -- } -- -- if (list_find_cmd(&hostdata->autosense, cmd)) { -- dsprintk(NDEBUG_ABORT, instance, -- "abort: found %p on sense queue\n", cmd); -- spin_unlock_irqrestore(&hostdata->lock, flags); -- queue_work(hostdata->work_q, &hostdata->main_task); -- msleep(1000); -- spin_lock_irqsave(&hostdata->lock, flags); -- if (list_del_cmd(&hostdata->autosense, cmd)) { -- dsprintk(NDEBUG_ABORT, instance, -- "abort: removed %p from sense queue\n", cmd); -- set_host_byte(cmd, DID_ABORT); -- complete_cmd(instance, cmd); -- goto out; -- } -- } -- -- if (hostdata->connected == cmd) { -- dsprintk(NDEBUG_ABORT, instance, "abort: cmd %p is connected\n", cmd); -- hostdata->connected = NULL; - if (do_abort(instance)) { - set_host_byte(cmd, DID_ERROR); - complete_cmd(instance, cmd); -@@ -2590,9 +2565,14 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) - goto out; - } - set_host_byte(cmd, DID_ABORT); --#ifdef REAL_DMA -- hostdata->dma_len = 0; --#endif -+ complete_cmd(instance, cmd); -+ goto out; -+ } -+ -+ if (list_del_cmd(&hostdata->autosense, cmd)) { -+ dsprintk(NDEBUG_ABORT, instance, -+ "abort: removed %p from sense queue\n", cmd); -+ set_host_byte(cmd, DID_ERROR); - complete_cmd(instance, cmd); - } - -@@ -2646,7 +2626,16 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) - * commands! - */ - -- hostdata->selecting = NULL; -+ if (list_del_cmd(&hostdata->unissued, cmd)) { -+ cmd->result = DID_RESET << 16; -+ cmd->scsi_done(cmd); -+ } -+ -+ if (hostdata->selecting) { -+ hostdata->selecting->result = DID_RESET << 16; -+ complete_cmd(instance, hostdata->selecting); -+ hostdata->selecting = NULL; -+ } - - list_for_each_entry(ncmd, &hostdata->disconnected, list) { - struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd); -@@ -2654,6 +2643,7 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) - set_host_byte(cmd, DID_RESET); - cmd->scsi_done(cmd); - } -+ INIT_LIST_HEAD(&hostdata->disconnected); - - list_for_each_entry(ncmd, &hostdata->autosense, list) { - struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd); -@@ -2661,6 +2651,7 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) - set_host_byte(cmd, DID_RESET); - cmd->scsi_done(cmd); - } -+ INIT_LIST_HEAD(&hostdata->autosense); - - if (hostdata->connected) { - set_host_byte(hostdata->connected, DID_RESET); -@@ -2668,12 +2659,6 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) - hostdata->connected = NULL; - } - -- if (hostdata->sensing) { -- set_host_byte(hostdata->connected, DID_RESET); -- complete_cmd(instance, hostdata->sensing); -- hostdata->sensing = NULL; -- } -- - #ifdef SUPPORT_TAGS - free_all_tags(hostdata); - #endif -diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c -index cb9072a841be..069e5c50abd0 100644 ---- a/drivers/scsi/be2iscsi/be_main.c -+++ b/drivers/scsi/be2iscsi/be_main.c -@@ -4468,6 +4468,7 @@ put_shost: - scsi_host_put(phba->shost); - free_kset: - iscsi_boot_destroy_kset(phba->boot_kset); -+ phba->boot_kset = NULL; - return -ENOMEM; - } - -diff --git a/drivers/scsi/device_handler/Kconfig b/drivers/scsi/device_handler/Kconfig -index e5647d59224f..0b331c9c0a8f 100644 ---- a/drivers/scsi/device_handler/Kconfig -+++ b/drivers/scsi/device_handler/Kconfig -@@ -13,13 +13,13 @@ menuconfig SCSI_DH - - config SCSI_DH_RDAC - tristate "LSI RDAC Device Handler" -- depends on SCSI_DH -+ depends on SCSI_DH && SCSI - help - If you have a LSI RDAC select y. Otherwise, say N. - - config SCSI_DH_HP_SW - tristate "HP/COMPAQ MSA Device Handler" -- depends on SCSI_DH -+ depends on SCSI_DH && SCSI - help - If you have a HP/COMPAQ MSA device that requires START_STOP to - be sent to start it and cannot upgrade the firmware then select y. -@@ -27,13 +27,13 @@ config SCSI_DH_HP_SW - - config SCSI_DH_EMC - tristate "EMC CLARiiON Device Handler" -- depends on SCSI_DH -+ depends on SCSI_DH && SCSI - help - If you have a EMC CLARiiON select y. Otherwise, say N. - - config SCSI_DH_ALUA - tristate "SPC-3 ALUA Device Handler" -- depends on SCSI_DH -+ depends on SCSI_DH && SCSI - help - SCSI Device handler for generic SPC-3 Asymmetric Logical Unit - Access (ALUA). -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index a544366a367e..f57d02c3b6cf 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -2860,7 +2860,7 @@ lpfc_online(struct lpfc_hba *phba) - } - - vports = lpfc_create_vport_work_array(phba); -- if (vports != NULL) -+ if (vports != NULL) { - for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++) { - struct Scsi_Host *shost; - shost = lpfc_shost_from_vport(vports[i]); -@@ -2877,7 +2877,8 @@ lpfc_online(struct lpfc_hba *phba) - } - spin_unlock_irq(shost->host_lock); - } -- lpfc_destroy_vport_work_array(phba, vports); -+ } -+ lpfc_destroy_vport_work_array(phba, vports); - - lpfc_unblock_mgmt_io(phba); - return 0; -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index 97a1c1c33b05..00ce3e269a43 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -6282,12 +6282,13 @@ out: - } - - for (i = 0; i < ioc->sge_count; i++) { -- if (kbuff_arr[i]) -+ if (kbuff_arr[i]) { - dma_free_coherent(&instance->pdev->dev, - le32_to_cpu(kern_sge32[i].length), - kbuff_arr[i], - le32_to_cpu(kern_sge32[i].phys_addr)); - kbuff_arr[i] = NULL; -+ } - } - - megasas_return_cmd(instance, cmd); -diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c -index 5d0ec42a9317..634254a52301 100644 ---- a/drivers/scsi/qla1280.c -+++ b/drivers/scsi/qla1280.c -@@ -4214,7 +4214,7 @@ static struct scsi_host_template qla1280_driver_template = { - .eh_bus_reset_handler = qla1280_eh_bus_reset, - .eh_host_reset_handler = qla1280_eh_adapter_reset, - .bios_param = qla1280_biosparam, -- .can_queue = 0xfffff, -+ .can_queue = MAX_OUTSTANDING_COMMANDS, - .this_id = -1, - .sg_tablesize = SG_ALL, - .use_clustering = ENABLE_CLUSTERING, -diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c -index b1bf42b93fcc..1deb6adc411f 100644 ---- a/drivers/scsi/scsi.c -+++ b/drivers/scsi/scsi.c -@@ -784,8 +784,9 @@ void scsi_attach_vpd(struct scsi_device *sdev) - int pg83_supported = 0; - unsigned char __rcu *vpd_buf, *orig_vpd_buf = NULL; - -- if (sdev->skip_vpd_pages) -+ if (!scsi_device_supports_vpd(sdev)) - return; -+ - retry_pg0: - vpd_buf = kmalloc(vpd_len, GFP_KERNEL); - if (!vpd_buf) -diff --git a/drivers/scsi/scsi_common.c b/drivers/scsi/scsi_common.c -index c126966130ab..ce79de822e46 100644 ---- a/drivers/scsi/scsi_common.c -+++ b/drivers/scsi/scsi_common.c -@@ -278,8 +278,16 @@ int scsi_set_sense_information(u8 *buf, int buf_len, u64 info) - ucp[3] = 0; - put_unaligned_be64(info, &ucp[4]); - } else if ((buf[0] & 0x7f) == 0x70) { -- buf[0] |= 0x80; -- put_unaligned_be64(info, &buf[3]); -+ /* -+ * Only set the 'VALID' bit if we can represent the value -+ * correctly; otherwise just fill out the lower bytes and -+ * clear the 'VALID' flag. -+ */ -+ if (info <= 0xffffffffUL) -+ buf[0] |= 0x80; -+ else -+ buf[0] &= 0x7f; -+ put_unaligned_be32((u32)info, &buf[3]); - } - - return 0; -diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c -index 6a820668d442..b7cc6027cb7b 100644 ---- a/drivers/scsi/scsi_scan.c -+++ b/drivers/scsi/scsi_scan.c -@@ -315,6 +315,7 @@ static void scsi_target_destroy(struct scsi_target *starget) - struct Scsi_Host *shost = dev_to_shost(dev->parent); - unsigned long flags; - -+ BUG_ON(starget->state == STARGET_DEL); - starget->state = STARGET_DEL; - transport_destroy_device(dev); - spin_lock_irqsave(shost->host_lock, flags); -diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c -index 00bc7218a7f8..9e5f893aa3ad 100644 ---- a/drivers/scsi/scsi_sysfs.c -+++ b/drivers/scsi/scsi_sysfs.c -@@ -1272,18 +1272,18 @@ static void __scsi_remove_target(struct scsi_target *starget) - void scsi_remove_target(struct device *dev) - { - struct Scsi_Host *shost = dev_to_shost(dev->parent); -- struct scsi_target *starget, *last_target = NULL; -+ struct scsi_target *starget; - unsigned long flags; - - restart: - spin_lock_irqsave(shost->host_lock, flags); - list_for_each_entry(starget, &shost->__targets, siblings) { - if (starget->state == STARGET_DEL || -- starget == last_target) -+ starget->state == STARGET_REMOVE) - continue; - if (starget->dev.parent == dev || &starget->dev == dev) { - kref_get(&starget->reap_ref); -- last_target = starget; -+ starget->state = STARGET_REMOVE; - spin_unlock_irqrestore(shost->host_lock, flags); - __scsi_remove_target(starget); - scsi_target_reap(starget); -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index d749da765df1..974ca5b45f8d 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -648,7 +648,7 @@ static void sd_config_discard(struct scsi_disk *sdkp, unsigned int mode) - */ - if (sdkp->lbprz) { - q->limits.discard_alignment = 0; -- q->limits.discard_granularity = 1; -+ q->limits.discard_granularity = logical_block_size; - } else { - q->limits.discard_alignment = sdkp->unmap_alignment * - logical_block_size; -@@ -1275,18 +1275,19 @@ static int sd_getgeo(struct block_device *bdev, struct hd_geometry *geo) - struct scsi_disk *sdkp = scsi_disk(bdev->bd_disk); - struct scsi_device *sdp = sdkp->device; - struct Scsi_Host *host = sdp->host; -+ sector_t capacity = logical_to_sectors(sdp, sdkp->capacity); - int diskinfo[4]; - - /* default to most commonly used values */ -- diskinfo[0] = 0x40; /* 1 << 6 */ -- diskinfo[1] = 0x20; /* 1 << 5 */ -- diskinfo[2] = sdkp->capacity >> 11; -- -+ diskinfo[0] = 0x40; /* 1 << 6 */ -+ diskinfo[1] = 0x20; /* 1 << 5 */ -+ diskinfo[2] = capacity >> 11; -+ - /* override with calculated, extended default, or driver values */ - if (host->hostt->bios_param) -- host->hostt->bios_param(sdp, bdev, sdkp->capacity, diskinfo); -+ host->hostt->bios_param(sdp, bdev, capacity, diskinfo); - else -- scsicam_bios_param(bdev, sdkp->capacity, diskinfo); -+ scsicam_bios_param(bdev, capacity, diskinfo); - - geo->heads = diskinfo[0]; - geo->sectors = diskinfo[1]; -@@ -2337,14 +2338,6 @@ got_data: - if (sdkp->capacity > 0xffffffff) - sdp->use_16_for_rw = 1; - -- /* Rescale capacity to 512-byte units */ -- if (sector_size == 4096) -- sdkp->capacity <<= 3; -- else if (sector_size == 2048) -- sdkp->capacity <<= 2; -- else if (sector_size == 1024) -- sdkp->capacity <<= 1; -- - blk_queue_physical_block_size(sdp->request_queue, - sdkp->physical_block_size); - sdkp->device->sector_size = sector_size; -@@ -2795,28 +2788,6 @@ static void sd_read_write_same(struct scsi_disk *sdkp, unsigned char *buffer) - sdkp->ws10 = 1; - } - --static int sd_try_extended_inquiry(struct scsi_device *sdp) --{ -- /* Attempt VPD inquiry if the device blacklist explicitly calls -- * for it. -- */ -- if (sdp->try_vpd_pages) -- return 1; -- /* -- * Although VPD inquiries can go to SCSI-2 type devices, -- * some USB ones crash on receiving them, and the pages -- * we currently ask for are for SPC-3 and beyond -- */ -- if (sdp->scsi_level > SCSI_SPC_2 && !sdp->skip_vpd_pages) -- return 1; -- return 0; --} -- --static inline u32 logical_to_sectors(struct scsi_device *sdev, u32 blocks) --{ -- return blocks << (ilog2(sdev->sector_size) - 9); --} -- - /** - * sd_revalidate_disk - called the first time a new disk is seen, - * performs disk spin up, read_capacity, etc. -@@ -2856,7 +2827,7 @@ static int sd_revalidate_disk(struct gendisk *disk) - if (sdkp->media_present) { - sd_read_capacity(sdkp, buffer); - -- if (sd_try_extended_inquiry(sdp)) { -+ if (scsi_device_supports_vpd(sdp)) { - sd_read_block_provisioning(sdkp); - sd_read_block_limits(sdkp); - sd_read_block_characteristics(sdkp); -@@ -2900,7 +2871,7 @@ static int sd_revalidate_disk(struct gendisk *disk) - /* Combine with controller limits */ - q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q)); - -- set_capacity(disk, sdkp->capacity); -+ set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity)); - sd_config_write_same(sdkp); - kfree(buffer); - -diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h -index 5f2a84aff29f..654630bb7d0e 100644 ---- a/drivers/scsi/sd.h -+++ b/drivers/scsi/sd.h -@@ -65,7 +65,7 @@ struct scsi_disk { - struct device dev; - struct gendisk *disk; - atomic_t openers; -- sector_t capacity; /* size in 512-byte sectors */ -+ sector_t capacity; /* size in logical blocks */ - u32 max_xfer_blocks; - u32 opt_xfer_blocks; - u32 max_ws_blocks; -@@ -146,6 +146,11 @@ static inline int scsi_medium_access_command(struct scsi_cmnd *scmd) - return 0; - } - -+static inline sector_t logical_to_sectors(struct scsi_device *sdev, sector_t blocks) -+{ -+ return blocks << (ilog2(sdev->sector_size) - 9); -+} -+ - /* - * A DIF-capable target device can be formatted with different - * protection schemes. Currently 0 through 3 are defined: -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index 5e820674432c..ae7d9bdf409c 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -652,7 +652,8 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) - else - hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE; - hp->dxfer_len = mxsize; -- if (hp->dxfer_direction == SG_DXFER_TO_DEV) -+ if ((hp->dxfer_direction == SG_DXFER_TO_DEV) || -+ (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV)) - hp->dxferp = (char __user *)buf + cmd_size; - else - hp->dxferp = NULL; -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index 292c04eec9ad..3ddcabb790a8 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -914,8 +914,9 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, - do_work = true; - process_err_fn = storvsc_remove_lun; - break; -- case (SRB_STATUS_ABORTED | SRB_STATUS_AUTOSENSE_VALID): -- if ((asc == 0x2a) && (ascq == 0x9)) { -+ case SRB_STATUS_ABORTED: -+ if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID && -+ (asc == 0x2a) && (ascq == 0x9)) { - do_work = true; - process_err_fn = storvsc_device_scan; - /* -diff --git a/drivers/soc/rockchip/pm_domains.c b/drivers/soc/rockchip/pm_domains.c -index 534c58937a56..4a65c5bda146 100644 ---- a/drivers/soc/rockchip/pm_domains.c -+++ b/drivers/soc/rockchip/pm_domains.c -@@ -419,6 +419,7 @@ static int rockchip_pm_domain_probe(struct platform_device *pdev) - if (error) { - dev_err(dev, "failed to handle node %s: %d\n", - node->name, error); -+ of_node_put(node); - goto err_out; - } - } -diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c -index ab9914ad8365..64232ecbb821 100644 ---- a/drivers/spi/spi-pxa2xx.c -+++ b/drivers/spi/spi-pxa2xx.c -@@ -111,7 +111,7 @@ static const struct lpss_config lpss_platforms[] = { - .reg_general = -1, - .reg_ssp = 0x20, - .reg_cs_ctrl = 0x24, -- .reg_capabilities = 0xfc, -+ .reg_capabilities = -1, - .rx_threshold = 1, - .tx_threshold_lo = 32, - .tx_threshold_hi = 56, -diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c -index 7cb1b2d710c1..475fb44c1883 100644 ---- a/drivers/spi/spi-rockchip.c -+++ b/drivers/spi/spi-rockchip.c -@@ -265,7 +265,10 @@ static inline u32 rx_max(struct rockchip_spi *rs) - static void rockchip_spi_set_cs(struct spi_device *spi, bool enable) - { - u32 ser; -- struct rockchip_spi *rs = spi_master_get_devdata(spi->master); -+ struct spi_master *master = spi->master; -+ struct rockchip_spi *rs = spi_master_get_devdata(master); -+ -+ pm_runtime_get_sync(rs->dev); - - ser = readl_relaxed(rs->regs + ROCKCHIP_SPI_SER) & SER_MASK; - -@@ -290,6 +293,8 @@ static void rockchip_spi_set_cs(struct spi_device *spi, bool enable) - ser &= ~(1 << spi->chip_select); - - writel_relaxed(ser, rs->regs + ROCKCHIP_SPI_SER); -+ -+ pm_runtime_put_sync(rs->dev); - } - - static int rockchip_spi_prepare_message(struct spi_master *master, -diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c -index 64318fcfacf2..5044c6198332 100644 ---- a/drivers/spi/spi-ti-qspi.c -+++ b/drivers/spi/spi-ti-qspi.c -@@ -94,6 +94,7 @@ struct ti_qspi { - #define QSPI_FLEN(n) ((n - 1) << 0) - #define QSPI_WLEN_MAX_BITS 128 - #define QSPI_WLEN_MAX_BYTES 16 -+#define QSPI_WLEN_MASK QSPI_WLEN(QSPI_WLEN_MAX_BITS) - - /* STATUS REGISTER */ - #define BUSY 0x01 -@@ -224,16 +225,16 @@ static inline int ti_qspi_poll_wc(struct ti_qspi *qspi) - return -ETIMEDOUT; - } - --static int qspi_write_msg(struct ti_qspi *qspi, struct spi_transfer *t) -+static int qspi_write_msg(struct ti_qspi *qspi, struct spi_transfer *t, -+ int count) - { -- int wlen, count, xfer_len; -+ int wlen, xfer_len; - unsigned int cmd; - const u8 *txbuf; - u32 data; - - txbuf = t->tx_buf; - cmd = qspi->cmd | QSPI_WR_SNGL; -- count = t->len; - wlen = t->bits_per_word >> 3; /* in bytes */ - xfer_len = wlen; - -@@ -293,9 +294,10 @@ static int qspi_write_msg(struct ti_qspi *qspi, struct spi_transfer *t) - return 0; - } - --static int qspi_read_msg(struct ti_qspi *qspi, struct spi_transfer *t) -+static int qspi_read_msg(struct ti_qspi *qspi, struct spi_transfer *t, -+ int count) - { -- int wlen, count; -+ int wlen; - unsigned int cmd; - u8 *rxbuf; - -@@ -312,7 +314,6 @@ static int qspi_read_msg(struct ti_qspi *qspi, struct spi_transfer *t) - cmd |= QSPI_RD_SNGL; - break; - } -- count = t->len; - wlen = t->bits_per_word >> 3; /* in bytes */ - - while (count) { -@@ -343,12 +344,13 @@ static int qspi_read_msg(struct ti_qspi *qspi, struct spi_transfer *t) - return 0; - } - --static int qspi_transfer_msg(struct ti_qspi *qspi, struct spi_transfer *t) -+static int qspi_transfer_msg(struct ti_qspi *qspi, struct spi_transfer *t, -+ int count) - { - int ret; - - if (t->tx_buf) { -- ret = qspi_write_msg(qspi, t); -+ ret = qspi_write_msg(qspi, t, count); - if (ret) { - dev_dbg(qspi->dev, "Error while writing\n"); - return ret; -@@ -356,7 +358,7 @@ static int qspi_transfer_msg(struct ti_qspi *qspi, struct spi_transfer *t) - } - - if (t->rx_buf) { -- ret = qspi_read_msg(qspi, t); -+ ret = qspi_read_msg(qspi, t, count); - if (ret) { - dev_dbg(qspi->dev, "Error while reading\n"); - return ret; -@@ -373,7 +375,8 @@ static int ti_qspi_start_transfer_one(struct spi_master *master, - struct spi_device *spi = m->spi; - struct spi_transfer *t; - int status = 0, ret; -- int frame_length; -+ unsigned int frame_len_words, transfer_len_words; -+ int wlen; - - /* setup device control reg */ - qspi->dc = 0; -@@ -385,30 +388,38 @@ static int ti_qspi_start_transfer_one(struct spi_master *master, - if (spi->mode & SPI_CS_HIGH) - qspi->dc |= QSPI_CSPOL(spi->chip_select); - -- frame_length = (m->frame_length << 3) / spi->bits_per_word; -- -- frame_length = clamp(frame_length, 0, QSPI_FRAME); -+ frame_len_words = 0; -+ list_for_each_entry(t, &m->transfers, transfer_list) -+ frame_len_words += t->len / (t->bits_per_word >> 3); -+ frame_len_words = min_t(unsigned int, frame_len_words, QSPI_FRAME); - - /* setup command reg */ - qspi->cmd = 0; - qspi->cmd |= QSPI_EN_CS(spi->chip_select); -- qspi->cmd |= QSPI_FLEN(frame_length); -+ qspi->cmd |= QSPI_FLEN(frame_len_words); - - ti_qspi_write(qspi, qspi->dc, QSPI_SPI_DC_REG); - - mutex_lock(&qspi->list_lock); - - list_for_each_entry(t, &m->transfers, transfer_list) { -- qspi->cmd |= QSPI_WLEN(t->bits_per_word); -+ qspi->cmd = ((qspi->cmd & ~QSPI_WLEN_MASK) | -+ QSPI_WLEN(t->bits_per_word)); -+ -+ wlen = t->bits_per_word >> 3; -+ transfer_len_words = min(t->len / wlen, frame_len_words); - -- ret = qspi_transfer_msg(qspi, t); -+ ret = qspi_transfer_msg(qspi, t, transfer_len_words * wlen); - if (ret) { - dev_dbg(qspi->dev, "transfer message failed\n"); - mutex_unlock(&qspi->list_lock); - return -EINVAL; - } - -- m->actual_length += t->len; -+ m->actual_length += transfer_len_words * wlen; -+ frame_len_words -= transfer_len_words; -+ if (frame_len_words == 0) -+ break; - } - - mutex_unlock(&qspi->list_lock); -diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c -index e237e9f3312d..df560216d702 100644 ---- a/drivers/staging/android/ion/ion.c -+++ b/drivers/staging/android/ion/ion.c -@@ -251,8 +251,10 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap, - * memory coming from the heaps is ready for dma, ie if it has a - * cached mapping that mapping has been invalidated - */ -- for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) -+ for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) { - sg_dma_address(sg) = sg_phys(sg); -+ sg_dma_len(sg) = sg->length; -+ } - mutex_lock(&dev->buffer_lock); - ion_buffer_add(dev, buffer); - mutex_unlock(&dev->buffer_lock); -diff --git a/drivers/staging/android/ion/ion_test.c b/drivers/staging/android/ion/ion_test.c -index b8dcf5a26cc4..58d46893e5ff 100644 ---- a/drivers/staging/android/ion/ion_test.c -+++ b/drivers/staging/android/ion/ion_test.c -@@ -285,8 +285,8 @@ static int __init ion_test_init(void) - { - ion_test_pdev = platform_device_register_simple("ion-test", - -1, NULL, 0); -- if (!ion_test_pdev) -- return -ENODEV; -+ if (IS_ERR(ion_test_pdev)) -+ return PTR_ERR(ion_test_pdev); - - return platform_driver_probe(&ion_test_platform_driver, ion_test_probe); - } -diff --git a/drivers/staging/comedi/drivers/das1800.c b/drivers/staging/comedi/drivers/das1800.c -index 940781183fac..3be10963f98b 100644 ---- a/drivers/staging/comedi/drivers/das1800.c -+++ b/drivers/staging/comedi/drivers/das1800.c -@@ -567,14 +567,17 @@ static int das1800_cancel(struct comedi_device *dev, struct comedi_subdevice *s) - struct comedi_isadma_desc *desc; - int i; - -- outb(0x0, dev->iobase + DAS1800_STATUS); /* disable conversions */ -- outb(0x0, dev->iobase + DAS1800_CONTROL_B); /* disable interrupts and dma */ -- outb(0x0, dev->iobase + DAS1800_CONTROL_A); /* disable and clear fifo and stop triggering */ -- -- for (i = 0; i < 2; i++) { -- desc = &dma->desc[i]; -- if (desc->chan) -- comedi_isadma_disable(desc->chan); -+ /* disable and stop conversions */ -+ outb(0x0, dev->iobase + DAS1800_STATUS); -+ outb(0x0, dev->iobase + DAS1800_CONTROL_B); -+ outb(0x0, dev->iobase + DAS1800_CONTROL_A); -+ -+ if (dma) { -+ for (i = 0; i < 2; i++) { -+ desc = &dma->desc[i]; -+ if (desc->chan) -+ comedi_isadma_disable(desc->chan); -+ } - } - - return 0; -@@ -934,13 +937,14 @@ static void das1800_ai_setup_dma(struct comedi_device *dev, - { - struct das1800_private *devpriv = dev->private; - struct comedi_isadma *dma = devpriv->dma; -- struct comedi_isadma_desc *desc = &dma->desc[0]; -+ struct comedi_isadma_desc *desc; - unsigned int bytes; - - if ((devpriv->irq_dma_bits & DMA_ENABLED) == 0) - return; - - dma->cur_dma = 0; -+ desc = &dma->desc[0]; - - /* determine a dma transfer size to fill buffer in 0.3 sec */ - bytes = das1800_ai_transfer_size(dev, s, desc->maxsize, 300000000); -diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c -index 5e8130a7d670..0e9f77924e26 100644 ---- a/drivers/staging/comedi/drivers/ni_mio_common.c -+++ b/drivers/staging/comedi/drivers/ni_mio_common.c -@@ -246,24 +246,24 @@ static void ni_writel(struct comedi_device *dev, uint32_t data, int reg) - { - if (dev->mmio) - writel(data, dev->mmio + reg); -- -- outl(data, dev->iobase + reg); -+ else -+ outl(data, dev->iobase + reg); - } - - static void ni_writew(struct comedi_device *dev, uint16_t data, int reg) - { - if (dev->mmio) - writew(data, dev->mmio + reg); -- -- outw(data, dev->iobase + reg); -+ else -+ outw(data, dev->iobase + reg); - } - - static void ni_writeb(struct comedi_device *dev, uint8_t data, int reg) - { - if (dev->mmio) - writeb(data, dev->mmio + reg); -- -- outb(data, dev->iobase + reg); -+ else -+ outb(data, dev->iobase + reg); - } - - static uint32_t ni_readl(struct comedi_device *dev, int reg) -diff --git a/drivers/staging/comedi/drivers/ni_tiocmd.c b/drivers/staging/comedi/drivers/ni_tiocmd.c -index 437f723bb34d..823e47910004 100644 ---- a/drivers/staging/comedi/drivers/ni_tiocmd.c -+++ b/drivers/staging/comedi/drivers/ni_tiocmd.c -@@ -92,7 +92,7 @@ static int ni_tio_input_inttrig(struct comedi_device *dev, - unsigned long flags; - int ret = 0; - -- if (trig_num != cmd->start_src) -+ if (trig_num != cmd->start_arg) - return -EINVAL; - - spin_lock_irqsave(&counter->lock, flags); -diff --git a/drivers/staging/rdma/hfi1/TODO b/drivers/staging/rdma/hfi1/TODO -index 05de0dad8762..4c6f1d7d2eaf 100644 ---- a/drivers/staging/rdma/hfi1/TODO -+++ b/drivers/staging/rdma/hfi1/TODO -@@ -3,4 +3,4 @@ July, 2015 - - Remove unneeded file entries in sysfs - - Remove software processing of IB protocol and place in library for use - by qib, ipath (if still present), hfi1, and eventually soft-roce -- -+- Replace incorrect uAPI -diff --git a/drivers/staging/rdma/hfi1/file_ops.c b/drivers/staging/rdma/hfi1/file_ops.c -index d57d549052c8..29ae777556d2 100644 ---- a/drivers/staging/rdma/hfi1/file_ops.c -+++ b/drivers/staging/rdma/hfi1/file_ops.c -@@ -52,6 +52,8 @@ - #include - #include - -+#include -+ - #include "hfi.h" - #include "pio.h" - #include "device.h" -@@ -194,6 +196,10 @@ static ssize_t hfi1_file_write(struct file *fp, const char __user *data, - int uctxt_required = 1; - int must_be_root = 0; - -+ /* FIXME: This interface cannot continue out of staging */ -+ if (WARN_ON_ONCE(!ib_safe_file_access(fp))) -+ return -EACCES; -+ - if (count < sizeof(cmd)) { - ret = -EINVAL; - goto bail; -diff --git a/drivers/staging/wilc1000/wilc_spi.c b/drivers/staging/wilc1000/wilc_spi.c -index 86de50c9f7f5..b3d6541b3896 100644 ---- a/drivers/staging/wilc1000/wilc_spi.c -+++ b/drivers/staging/wilc1000/wilc_spi.c -@@ -120,8 +120,6 @@ static u8 crc7(u8 crc, const u8 *buffer, u32 len) - - #define USE_SPI_DMA 0 - --static const struct wilc1000_ops wilc1000_spi_ops; -- - static int wilc_bus_probe(struct spi_device *spi) - { - int ret, gpio; -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 867bc6d0a68a..43d8b42c0f22 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -2596,8 +2596,6 @@ void target_wait_for_sess_cmds(struct se_session *se_sess) - - list_for_each_entry_safe(se_cmd, tmp_cmd, - &se_sess->sess_wait_list, se_cmd_list) { -- list_del_init(&se_cmd->se_cmd_list); -- - pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:" - " %d\n", se_cmd, se_cmd->t_state, - se_cmd->se_tfo->get_cmd_state(se_cmd)); -diff --git a/drivers/thermal/rockchip_thermal.c b/drivers/thermal/rockchip_thermal.c -index b58e3fb9b311..433085a97626 100644 ---- a/drivers/thermal/rockchip_thermal.c -+++ b/drivers/thermal/rockchip_thermal.c -@@ -693,15 +693,14 @@ static int rockchip_configure_from_dt(struct device *dev, - thermal->chip->tshut_temp); - thermal->tshut_temp = thermal->chip->tshut_temp; - } else { -+ if (shut_temp > INT_MAX) { -+ dev_err(dev, "Invalid tshut temperature specified: %d\n", -+ shut_temp); -+ return -ERANGE; -+ } - thermal->tshut_temp = shut_temp; - } - -- if (thermal->tshut_temp > INT_MAX) { -- dev_err(dev, "Invalid tshut temperature specified: %d\n", -- thermal->tshut_temp); -- return -ERANGE; -- } -- - if (of_property_read_u32(np, "rockchip,hw-tshut-mode", &tshut_mode)) { - dev_warn(dev, - "Missing tshut mode property, using default (%s)\n", -diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c -index a0a8fd1235e2..d4b54653ecf8 100644 ---- a/drivers/thermal/thermal_core.c -+++ b/drivers/thermal/thermal_core.c -@@ -454,6 +454,10 @@ static void handle_thermal_trip(struct thermal_zone_device *tz, int trip) - { - enum thermal_trip_type type; - -+ /* Ignore disabled trip points */ -+ if (test_bit(trip, &tz->trips_disabled)) -+ return; -+ - tz->ops->get_trip_type(tz, trip, &type); - - if (type == THERMAL_TRIP_CRITICAL || type == THERMAL_TRIP_HOT) -@@ -1800,6 +1804,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type, - { - struct thermal_zone_device *tz; - enum thermal_trip_type trip_type; -+ int trip_temp; - int result; - int count; - int passive = 0; -@@ -1871,9 +1876,15 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type, - goto unregister; - - for (count = 0; count < trips; count++) { -- tz->ops->get_trip_type(tz, count, &trip_type); -+ if (tz->ops->get_trip_type(tz, count, &trip_type)) -+ set_bit(count, &tz->trips_disabled); - if (trip_type == THERMAL_TRIP_PASSIVE) - passive = 1; -+ if (tz->ops->get_trip_temp(tz, count, &trip_temp)) -+ set_bit(count, &tz->trips_disabled); -+ /* Check for bogus trip points */ -+ if (trip_temp == 0) -+ set_bit(count, &tz->trips_disabled); - } - - if (!passive) { -diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c -index 0dde34e3a7c5..545c60c826a1 100644 ---- a/drivers/thunderbolt/eeprom.c -+++ b/drivers/thunderbolt/eeprom.c -@@ -444,6 +444,7 @@ int tb_drom_read(struct tb_switch *sw) - return tb_drom_parse_entries(sw); - err: - kfree(sw->drom); -+ sw->drom = NULL; - return -EIO; - - } -diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c -index c3fe026d3168..9aff37186246 100644 ---- a/drivers/tty/n_gsm.c -+++ b/drivers/tty/n_gsm.c -@@ -2045,7 +2045,9 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm) - } - } - spin_unlock(&gsm_mux_lock); -- WARN_ON(i == MAX_MUX); -+ /* open failed before registering => nothing to do */ -+ if (i == MAX_MUX) -+ return; - - /* In theory disconnecting DLCI 0 is sufficient but for some - modems this is apparently not the case. */ -diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c -index bbc4ce66c2c1..644ddb841d9f 100644 ---- a/drivers/tty/n_hdlc.c -+++ b/drivers/tty/n_hdlc.c -@@ -600,7 +600,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file, - add_wait_queue(&tty->read_wait, &wait); - - for (;;) { -- if (test_bit(TTY_OTHER_DONE, &tty->flags)) { -+ if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) { - ret = -EIO; - break; - } -@@ -828,7 +828,7 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp, - /* set bits for operations that won't block */ - if (n_hdlc->rx_buf_list.head) - mask |= POLLIN | POLLRDNORM; /* readable */ -- if (test_bit(TTY_OTHER_DONE, &tty->flags)) -+ if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) - mask |= POLLHUP; - if (tty_hung_up_p(filp)) - mask |= POLLHUP; -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index b280abaad91b..c12def71ed37 100644 ---- a/drivers/tty/n_tty.c -+++ b/drivers/tty/n_tty.c -@@ -1963,18 +1963,6 @@ static inline int input_available_p(struct tty_struct *tty, int poll) - return ldata->commit_head - ldata->read_tail >= amt; - } - --static inline int check_other_done(struct tty_struct *tty) --{ -- int done = test_bit(TTY_OTHER_DONE, &tty->flags); -- if (done) { -- /* paired with cmpxchg() in check_other_closed(); ensures -- * read buffer head index is not stale -- */ -- smp_mb__after_atomic(); -- } -- return done; --} -- - /** - * copy_from_read_buf - copy read data directly - * @tty: terminal device -@@ -2170,7 +2158,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, - struct n_tty_data *ldata = tty->disc_data; - unsigned char __user *b = buf; - DEFINE_WAIT_FUNC(wait, woken_wake_function); -- int c, done; -+ int c; - int minimum, time; - ssize_t retval = 0; - long timeout; -@@ -2238,32 +2226,35 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, - ((minimum - (b - buf)) >= 1)) - ldata->minimum_to_wake = (minimum - (b - buf)); - -- done = check_other_done(tty); -- - if (!input_available_p(tty, 0)) { -- if (done) { -- retval = -EIO; -- break; -- } -- if (tty_hung_up_p(file)) -- break; -- if (!timeout) -- break; -- if (file->f_flags & O_NONBLOCK) { -- retval = -EAGAIN; -- break; -- } -- if (signal_pending(current)) { -- retval = -ERESTARTSYS; -- break; -- } - up_read(&tty->termios_rwsem); -+ tty_buffer_flush_work(tty->port); -+ down_read(&tty->termios_rwsem); -+ if (!input_available_p(tty, 0)) { -+ if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) { -+ retval = -EIO; -+ break; -+ } -+ if (tty_hung_up_p(file)) -+ break; -+ if (!timeout) -+ break; -+ if (file->f_flags & O_NONBLOCK) { -+ retval = -EAGAIN; -+ break; -+ } -+ if (signal_pending(current)) { -+ retval = -ERESTARTSYS; -+ break; -+ } -+ up_read(&tty->termios_rwsem); - -- timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, -- timeout); -+ timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, -+ timeout); - -- down_read(&tty->termios_rwsem); -- continue; -+ down_read(&tty->termios_rwsem); -+ continue; -+ } - } - - if (ldata->icanon && !L_EXTPROC(tty)) { -@@ -2445,12 +2436,17 @@ static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file, - - poll_wait(file, &tty->read_wait, wait); - poll_wait(file, &tty->write_wait, wait); -- if (check_other_done(tty)) -- mask |= POLLHUP; - if (input_available_p(tty, 1)) - mask |= POLLIN | POLLRDNORM; -+ else { -+ tty_buffer_flush_work(tty->port); -+ if (input_available_p(tty, 1)) -+ mask |= POLLIN | POLLRDNORM; -+ } - if (tty->packet && tty->link->ctrl_status) - mask |= POLLPRI | POLLIN | POLLRDNORM; -+ if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) -+ mask |= POLLHUP; - if (tty_hung_up_p(file)) - mask |= POLLHUP; - if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) { -diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c -index 2348fa613707..6427a39bd360 100644 ---- a/drivers/tty/pty.c -+++ b/drivers/tty/pty.c -@@ -59,7 +59,7 @@ static void pty_close(struct tty_struct *tty, struct file *filp) - if (!tty->link) - return; - set_bit(TTY_OTHER_CLOSED, &tty->link->flags); -- tty_flip_buffer_push(tty->link->port); -+ wake_up_interruptible(&tty->link->read_wait); - wake_up_interruptible(&tty->link->write_wait); - if (tty->driver->subtype == PTY_TYPE_MASTER) { - set_bit(TTY_OTHER_CLOSED, &tty->flags); -@@ -247,9 +247,7 @@ static int pty_open(struct tty_struct *tty, struct file *filp) - goto out; - - clear_bit(TTY_IO_ERROR, &tty->flags); -- /* TTY_OTHER_CLOSED must be cleared before TTY_OTHER_DONE */ - clear_bit(TTY_OTHER_CLOSED, &tty->link->flags); -- clear_bit(TTY_OTHER_DONE, &tty->link->flags); - set_bit(TTY_THROTTLED, &tty->flags); - return 0; - -diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c -index 88531a36b69c..ed489880e62b 100644 ---- a/drivers/tty/serial/8250/8250_mid.c -+++ b/drivers/tty/serial/8250/8250_mid.c -@@ -14,6 +14,7 @@ - #include - - #include -+#include - - #include "8250.h" - -@@ -24,6 +25,7 @@ - #define PCI_DEVICE_ID_INTEL_DNV_UART 0x19d8 - - /* Intel MID Specific registers */ -+#define INTEL_MID_UART_DNV_FISR 0x08 - #define INTEL_MID_UART_PS 0x30 - #define INTEL_MID_UART_MUL 0x34 - #define INTEL_MID_UART_DIV 0x38 -@@ -31,6 +33,7 @@ - struct mid8250; - - struct mid8250_board { -+ unsigned int flags; - unsigned long freq; - unsigned int base_baud; - int (*setup)(struct mid8250 *, struct uart_port *p); -@@ -88,16 +91,16 @@ static int tng_setup(struct mid8250 *mid, struct uart_port *p) - static int dnv_handle_irq(struct uart_port *p) - { - struct mid8250 *mid = p->private_data; -- int ret; -- -- ret = hsu_dma_irq(&mid->dma_chip, 0); -- ret |= hsu_dma_irq(&mid->dma_chip, 1); -- -- /* For now, letting the HW generate separate interrupt for the UART */ -- if (ret) -- return ret; -- -- return serial8250_handle_irq(p, serial_port_in(p, UART_IIR)); -+ unsigned int fisr = serial_port_in(p, INTEL_MID_UART_DNV_FISR); -+ int ret = IRQ_NONE; -+ -+ if (fisr & BIT(2)) -+ ret |= hsu_dma_irq(&mid->dma_chip, 1); -+ if (fisr & BIT(1)) -+ ret |= hsu_dma_irq(&mid->dma_chip, 0); -+ if (fisr & BIT(0)) -+ ret |= serial8250_handle_irq(p, serial_port_in(p, UART_IIR)); -+ return ret; - } - - #define DNV_DMA_CHAN_OFFSET 0x80 -@@ -106,12 +109,13 @@ static int dnv_setup(struct mid8250 *mid, struct uart_port *p) - { - struct hsu_dma_chip *chip = &mid->dma_chip; - struct pci_dev *pdev = to_pci_dev(p->dev); -+ unsigned int bar = FL_GET_BASE(mid->board->flags); - int ret; - - chip->dev = &pdev->dev; - chip->irq = pdev->irq; - chip->regs = p->membase; -- chip->length = pci_resource_len(pdev, 0); -+ chip->length = pci_resource_len(pdev, bar); - chip->offset = DNV_DMA_CHAN_OFFSET; - - /* Falling back to PIO mode if DMA probing fails */ -@@ -217,6 +221,7 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id) - { - struct uart_8250_port uart; - struct mid8250 *mid; -+ unsigned int bar; - int ret; - - ret = pcim_enable_device(pdev); -@@ -230,6 +235,7 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id) - return -ENOMEM; - - mid->board = (struct mid8250_board *)id->driver_data; -+ bar = FL_GET_BASE(mid->board->flags); - - memset(&uart, 0, sizeof(struct uart_8250_port)); - -@@ -242,8 +248,8 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id) - uart.port.flags = UPF_SHARE_IRQ | UPF_FIXED_PORT | UPF_FIXED_TYPE; - uart.port.set_termios = mid8250_set_termios; - -- uart.port.mapbase = pci_resource_start(pdev, 0); -- uart.port.membase = pcim_iomap(pdev, 0, 0); -+ uart.port.mapbase = pci_resource_start(pdev, bar); -+ uart.port.membase = pcim_iomap(pdev, bar, 0); - if (!uart.port.membase) - return -ENOMEM; - -@@ -282,18 +288,21 @@ static void mid8250_remove(struct pci_dev *pdev) - } - - static const struct mid8250_board pnw_board = { -+ .flags = FL_BASE0, - .freq = 50000000, - .base_baud = 115200, - .setup = pnw_setup, - }; - - static const struct mid8250_board tng_board = { -+ .flags = FL_BASE0, - .freq = 38400000, - .base_baud = 1843200, - .setup = tng_setup, - }; - - static const struct mid8250_board dnv_board = { -+ .flags = FL_BASE1, - .freq = 133333333, - .base_baud = 115200, - .setup = dnv_setup, -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index 7cd6f9a90542..c1d4a8fa9be8 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -1401,6 +1401,9 @@ byt_set_termios(struct uart_port *p, struct ktermios *termios, - unsigned long m, n; - u32 reg; - -+ /* Gracefully handle the B0 case: fall back to B9600 */ -+ fuart = fuart ? fuart : 9600 * 16; -+ - /* Get Fuart closer to Fref */ - fuart *= rounddown_pow_of_two(fref / fuart); - -diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c -index 8d262bce97e4..720b9465b12e 100644 ---- a/drivers/tty/serial/8250/8250_port.c -+++ b/drivers/tty/serial/8250/8250_port.c -@@ -731,22 +731,16 @@ static int size_fifo(struct uart_8250_port *up) - */ - static unsigned int autoconfig_read_divisor_id(struct uart_8250_port *p) - { -- unsigned char old_dll, old_dlm, old_lcr; -- unsigned int id; -+ unsigned char old_lcr; -+ unsigned int id, old_dl; - - old_lcr = serial_in(p, UART_LCR); - serial_out(p, UART_LCR, UART_LCR_CONF_MODE_A); -+ old_dl = serial_dl_read(p); -+ serial_dl_write(p, 0); -+ id = serial_dl_read(p); -+ serial_dl_write(p, old_dl); - -- old_dll = serial_in(p, UART_DLL); -- old_dlm = serial_in(p, UART_DLM); -- -- serial_out(p, UART_DLL, 0); -- serial_out(p, UART_DLM, 0); -- -- id = serial_in(p, UART_DLL) | serial_in(p, UART_DLM) << 8; -- -- serial_out(p, UART_DLL, old_dll); -- serial_out(p, UART_DLM, old_dlm); - serial_out(p, UART_LCR, old_lcr); - - return id; -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index 1c0884d8ef32..172a8ccb0b63 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -273,6 +273,13 @@ static bool atmel_use_dma_rx(struct uart_port *port) - return atmel_port->use_dma_rx; - } - -+static bool atmel_use_fifo(struct uart_port *port) -+{ -+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); -+ -+ return atmel_port->fifo_size; -+} -+ - static unsigned int atmel_get_lines_status(struct uart_port *port) - { - struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); -@@ -2082,7 +2089,12 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, - mode |= ATMEL_US_USMODE_RS485; - } else if (termios->c_cflag & CRTSCTS) { - /* RS232 with hardware handshake (RTS/CTS) */ -- mode |= ATMEL_US_USMODE_HWHS; -+ if (atmel_use_dma_rx(port) && !atmel_use_fifo(port)) { -+ dev_info(port->dev, "not enabling hardware flow control because DMA is used"); -+ termios->c_cflag &= ~CRTSCTS; -+ } else { -+ mode |= ATMEL_US_USMODE_HWHS; -+ } - } else { - /* RS232 without hadware handshake */ - mode |= ATMEL_US_USMODE_NORMAL; -diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c -index d72cd736bdc6..8320173af846 100644 ---- a/drivers/tty/serial/samsung.c -+++ b/drivers/tty/serial/samsung.c -@@ -1263,6 +1263,8 @@ static void s3c24xx_serial_set_termios(struct uart_port *port, - /* check to see if we need to change clock source */ - - if (ourport->baudclk != clk) { -+ clk_prepare_enable(clk); -+ - s3c24xx_serial_setsource(port, clk_sel); - - if (!IS_ERR(ourport->baudclk)) { -@@ -1270,8 +1272,6 @@ static void s3c24xx_serial_set_termios(struct uart_port *port, - ourport->baudclk = ERR_PTR(-EINVAL); - } - -- clk_prepare_enable(clk); -- - ourport->baudclk = clk; - ourport->baudclk_rate = clk ? clk_get_rate(clk) : 0; - } -diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c -index 3cd31e0d4bd9..fb31eecb708d 100644 ---- a/drivers/tty/tty_buffer.c -+++ b/drivers/tty/tty_buffer.c -@@ -37,29 +37,6 @@ - - #define TTY_BUFFER_PAGE (((PAGE_SIZE - sizeof(struct tty_buffer)) / 2) & ~0xFF) - --/* -- * If all tty flip buffers have been processed by flush_to_ldisc() or -- * dropped by tty_buffer_flush(), check if the linked pty has been closed. -- * If so, wake the reader/poll to process -- */ --static inline void check_other_closed(struct tty_struct *tty) --{ -- unsigned long flags, old; -- -- /* transition from TTY_OTHER_CLOSED => TTY_OTHER_DONE must be atomic */ -- for (flags = ACCESS_ONCE(tty->flags); -- test_bit(TTY_OTHER_CLOSED, &flags); -- ) { -- old = flags; -- __set_bit(TTY_OTHER_DONE, &flags); -- flags = cmpxchg(&tty->flags, old, flags); -- if (old == flags) { -- wake_up_interruptible(&tty->read_wait); -- break; -- } -- } --} -- - /** - * tty_buffer_lock_exclusive - gain exclusive access to buffer - * tty_buffer_unlock_exclusive - release exclusive access -@@ -254,8 +231,6 @@ void tty_buffer_flush(struct tty_struct *tty, struct tty_ldisc *ld) - if (ld && ld->ops->flush_buffer) - ld->ops->flush_buffer(tty); - -- check_other_closed(tty); -- - atomic_dec(&buf->priority); - mutex_unlock(&buf->lock); - } -@@ -505,10 +480,8 @@ static void flush_to_ldisc(struct work_struct *work) - */ - count = smp_load_acquire(&head->commit) - head->read; - if (!count) { -- if (next == NULL) { -- check_other_closed(tty); -+ if (next == NULL) - break; -- } - buf->head = next; - tty_buffer_free(port, head); - continue; -@@ -597,3 +570,8 @@ bool tty_buffer_cancel_work(struct tty_port *port) - { - return cancel_work_sync(&port->buf.work); - } -+ -+void tty_buffer_flush_work(struct tty_port *port) -+{ -+ flush_work(&port->buf.work); -+} -diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index bd51bdd0a7bf..2b5382ea4842 100644 ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -3583,9 +3583,10 @@ static int do_register_con_driver(const struct consw *csw, int first, int last) - goto err; - - desc = csw->con_startup(); -- -- if (!desc) -+ if (!desc) { -+ retval = -ENODEV; - goto err; -+ } - - retval = -EINVAL; - -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index fa4e23930614..d37fdcc3143c 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1114,6 +1114,9 @@ static int acm_probe(struct usb_interface *intf, - if (quirks == NO_UNION_NORMAL) { - data_interface = usb_ifnum_to_if(usb_dev, 1); - control_interface = usb_ifnum_to_if(usb_dev, 0); -+ /* we would crash */ -+ if (!data_interface || !control_interface) -+ return -ENODEV; - goto skip_normal_probe; - } - -diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c -index 56593a9a8726..dadd1e8dfe09 100644 ---- a/drivers/usb/core/driver.c -+++ b/drivers/usb/core/driver.c -@@ -284,7 +284,7 @@ static int usb_probe_interface(struct device *dev) - struct usb_device *udev = interface_to_usbdev(intf); - const struct usb_device_id *id; - int error = -ENODEV; -- int lpm_disable_error; -+ int lpm_disable_error = -ENODEV; - - dev_dbg(dev, "%s\n", __func__); - -@@ -336,12 +336,14 @@ static int usb_probe_interface(struct device *dev) - * setting during probe, that should also be fine. usb_set_interface() - * will attempt to disable LPM, and fail if it can't disable it. - */ -- lpm_disable_error = usb_unlocked_disable_lpm(udev); -- if (lpm_disable_error && driver->disable_hub_initiated_lpm) { -- dev_err(&intf->dev, "%s Failed to disable LPM for driver %s\n.", -- __func__, driver->name); -- error = lpm_disable_error; -- goto err; -+ if (driver->disable_hub_initiated_lpm) { -+ lpm_disable_error = usb_unlocked_disable_lpm(udev); -+ if (lpm_disable_error) { -+ dev_err(&intf->dev, "%s Failed to disable LPM for driver %s\n.", -+ __func__, driver->name); -+ error = lpm_disable_error; -+ goto err; -+ } - } - - /* Carry out a deferred switch to altsetting 0 */ -@@ -391,7 +393,8 @@ static int usb_unbind_interface(struct device *dev) - struct usb_interface *intf = to_usb_interface(dev); - struct usb_host_endpoint *ep, **eps = NULL; - struct usb_device *udev; -- int i, j, error, r, lpm_disable_error; -+ int i, j, error, r; -+ int lpm_disable_error = -ENODEV; - - intf->condition = USB_INTERFACE_UNBINDING; - -@@ -399,12 +402,13 @@ static int usb_unbind_interface(struct device *dev) - udev = interface_to_usbdev(intf); - error = usb_autoresume_device(udev); - -- /* Hub-initiated LPM policy may change, so attempt to disable LPM until -+ /* If hub-initiated LPM policy may change, attempt to disable LPM until - * the driver is unbound. If LPM isn't disabled, that's fine because it - * wouldn't be enabled unless all the bound interfaces supported - * hub-initiated LPM. - */ -- lpm_disable_error = usb_unlocked_disable_lpm(udev); -+ if (driver->disable_hub_initiated_lpm) -+ lpm_disable_error = usb_unlocked_disable_lpm(udev); - - /* - * Terminate all URBs for this interface unless the driver -@@ -502,11 +506,15 @@ static int usb_unbind_interface(struct device *dev) - int usb_driver_claim_interface(struct usb_driver *driver, - struct usb_interface *iface, void *priv) - { -- struct device *dev = &iface->dev; -+ struct device *dev; - struct usb_device *udev; - int retval = 0; -- int lpm_disable_error; -+ int lpm_disable_error = -ENODEV; - -+ if (!iface) -+ return -ENODEV; -+ -+ dev = &iface->dev; - if (dev->driver) - return -EBUSY; - -@@ -522,12 +530,14 @@ int usb_driver_claim_interface(struct usb_driver *driver, - - iface->condition = USB_INTERFACE_BOUND; - -- /* Disable LPM until this driver is bound. */ -- lpm_disable_error = usb_unlocked_disable_lpm(udev); -- if (lpm_disable_error && driver->disable_hub_initiated_lpm) { -- dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.", -- __func__, driver->name); -- return -ENOMEM; -+ /* See the comment about disabling LPM in usb_probe_interface(). */ -+ if (driver->disable_hub_initiated_lpm) { -+ lpm_disable_error = usb_unlocked_disable_lpm(udev); -+ if (lpm_disable_error) { -+ dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.", -+ __func__, driver->name); -+ return -ENOMEM; -+ } - } - - /* Claimed interfaces are initially inactive (suspended) and -diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c -index 9eb1cff28bd4..b8b580e5ae6e 100644 ---- a/drivers/usb/core/hcd-pci.c -+++ b/drivers/usb/core/hcd-pci.c -@@ -74,6 +74,15 @@ static void for_each_companion(struct pci_dev *pdev, struct usb_hcd *hcd, - if (companion->bus != pdev->bus || - PCI_SLOT(companion->devfn) != slot) - continue; -+ -+ /* -+ * Companion device should be either UHCI,OHCI or EHCI host -+ * controller, otherwise skip. -+ */ -+ if (companion->class != CL_UHCI && companion->class != CL_OHCI && -+ companion->class != CL_EHCI) -+ continue; -+ - companion_hcd = pci_get_drvdata(companion); - if (!companion_hcd || !companion_hcd->self.root_hub) - continue; -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 51b436918f78..84f65743f29a 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -4292,7 +4292,7 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, - { - struct usb_device *hdev = hub->hdev; - struct usb_hcd *hcd = bus_to_hcd(hdev->bus); -- int i, j, retval; -+ int retries, operations, retval, i; - unsigned delay = HUB_SHORT_RESET_TIME; - enum usb_device_speed oldspeed = udev->speed; - const char *speed; -@@ -4394,7 +4394,7 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, - * first 8 bytes of the device descriptor to get the ep0 maxpacket - * value. - */ -- for (i = 0; i < GET_DESCRIPTOR_TRIES; (++i, msleep(100))) { -+ for (retries = 0; retries < GET_DESCRIPTOR_TRIES; (++retries, msleep(100))) { - bool did_new_scheme = false; - - if (use_new_scheme(udev, retry_counter)) { -@@ -4421,7 +4421,7 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, - * 255 is for WUSB devices, we actually need to use - * 512 (WUSB1.0[4.8.1]). - */ -- for (j = 0; j < 3; ++j) { -+ for (operations = 0; operations < 3; ++operations) { - buf->bMaxPacketSize0 = 0; - r = usb_control_msg(udev, usb_rcvaddr0pipe(), - USB_REQ_GET_DESCRIPTOR, USB_DIR_IN, -@@ -4441,7 +4441,13 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, - r = -EPROTO; - break; - } -- if (r == 0) -+ /* -+ * Some devices time out if they are powered on -+ * when already connected. They need a second -+ * reset. But only on the first attempt, -+ * lest we get into a time out/reset loop -+ */ -+ if (r == 0 || (r == -ETIMEDOUT && retries == 0)) - break; - } - udev->descriptor.bMaxPacketSize0 = -@@ -4473,7 +4479,7 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, - * authorization will assign the final address. - */ - if (udev->wusb == 0) { -- for (j = 0; j < SET_ADDRESS_TRIES; ++j) { -+ for (operations = 0; operations < SET_ADDRESS_TRIES; ++operations) { - retval = hub_set_address(udev, devnum); - if (retval >= 0) - break; -diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c -index 14718a9ffcfb..460c855be0d0 100644 ---- a/drivers/usb/core/port.c -+++ b/drivers/usb/core/port.c -@@ -249,18 +249,12 @@ static int usb_port_runtime_suspend(struct device *dev) - - return retval; - } -- --static int usb_port_prepare(struct device *dev) --{ -- return 1; --} - #endif - - static const struct dev_pm_ops usb_port_pm_ops = { - #ifdef CONFIG_PM - .runtime_suspend = usb_port_runtime_suspend, - .runtime_resume = usb_port_runtime_resume, -- .prepare = usb_port_prepare, - #endif - }; - -diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c -index ebb29caa3fe4..77e4c9bc0ab1 100644 ---- a/drivers/usb/core/usb.c -+++ b/drivers/usb/core/usb.c -@@ -311,13 +311,7 @@ static int usb_dev_uevent(struct device *dev, struct kobj_uevent_env *env) - - static int usb_dev_prepare(struct device *dev) - { -- struct usb_device *udev = to_usb_device(dev); -- -- /* Return 0 if the current wakeup setting is wrong, otherwise 1 */ -- if (udev->do_remote_wakeup != device_may_wakeup(dev)) -- return 0; -- -- return 1; -+ return 0; /* Implement eventually? */ - } - - static void usb_dev_complete(struct device *dev) -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index cf43e9e18368..97ef75af9632 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -646,24 +646,23 @@ static void ffs_user_copy_worker(struct work_struct *work) - work); - int ret = io_data->req->status ? io_data->req->status : - io_data->req->actual; -+ bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD; - - if (io_data->read && ret > 0) { - use_mm(io_data->mm); - ret = copy_to_iter(io_data->buf, ret, &io_data->data); -- if (iov_iter_count(&io_data->data)) -+ if (ret != io_data->req->actual && iov_iter_count(&io_data->data)) - ret = -EFAULT; - unuse_mm(io_data->mm); - } - - io_data->kiocb->ki_complete(io_data->kiocb, ret, ret); - -- if (io_data->ffs->ffs_eventfd && -- !(io_data->kiocb->ki_flags & IOCB_EVENTFD)) -+ if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd) - eventfd_signal(io_data->ffs->ffs_eventfd, 1); - - usb_ep_free_request(io_data->ep, io_data->req); - -- io_data->kiocb->private = NULL; - if (io_data->read) - kfree(io_data->to_free); - kfree(io_data->buf); -diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c -index 223ccf89d226..a4f664062e0c 100644 ---- a/drivers/usb/gadget/function/f_mass_storage.c -+++ b/drivers/usb/gadget/function/f_mass_storage.c -@@ -2977,25 +2977,6 @@ void fsg_common_set_inquiry_string(struct fsg_common *common, const char *vn, - } - EXPORT_SYMBOL_GPL(fsg_common_set_inquiry_string); - --int fsg_common_run_thread(struct fsg_common *common) --{ -- common->state = FSG_STATE_IDLE; -- /* Tell the thread to start working */ -- common->thread_task = -- kthread_create(fsg_main_thread, common, "file-storage"); -- if (IS_ERR(common->thread_task)) { -- common->state = FSG_STATE_TERMINATED; -- return PTR_ERR(common->thread_task); -- } -- -- DBG(common, "I/O thread pid: %d\n", task_pid_nr(common->thread_task)); -- -- wake_up_process(common->thread_task); -- -- return 0; --} --EXPORT_SYMBOL_GPL(fsg_common_run_thread); -- - static void fsg_common_release(struct kref *ref) - { - struct fsg_common *common = container_of(ref, struct fsg_common, ref); -@@ -3005,6 +2986,7 @@ static void fsg_common_release(struct kref *ref) - if (common->state != FSG_STATE_TERMINATED) { - raise_exception(common, FSG_STATE_EXIT); - wait_for_completion(&common->thread_notifier); -+ common->thread_task = NULL; - } - - for (i = 0; i < ARRAY_SIZE(common->luns); ++i) { -@@ -3050,9 +3032,21 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f) - if (ret) - return ret; - fsg_common_set_inquiry_string(fsg->common, NULL, NULL); -- ret = fsg_common_run_thread(fsg->common); -- if (ret) -+ } -+ -+ if (!common->thread_task) { -+ common->state = FSG_STATE_IDLE; -+ common->thread_task = -+ kthread_create(fsg_main_thread, common, "file-storage"); -+ if (IS_ERR(common->thread_task)) { -+ int ret = PTR_ERR(common->thread_task); -+ common->thread_task = NULL; -+ common->state = FSG_STATE_TERMINATED; - return ret; -+ } -+ DBG(common, "I/O thread pid: %d\n", -+ task_pid_nr(common->thread_task)); -+ wake_up_process(common->thread_task); - } - - fsg->gadget = gadget; -diff --git a/drivers/usb/gadget/function/f_mass_storage.h b/drivers/usb/gadget/function/f_mass_storage.h -index 445df6775609..b6a9918eaefb 100644 ---- a/drivers/usb/gadget/function/f_mass_storage.h -+++ b/drivers/usb/gadget/function/f_mass_storage.h -@@ -153,8 +153,6 @@ int fsg_common_create_luns(struct fsg_common *common, struct fsg_config *cfg); - void fsg_common_set_inquiry_string(struct fsg_common *common, const char *vn, - const char *pn); - --int fsg_common_run_thread(struct fsg_common *common); -- - void fsg_config_from_params(struct fsg_config *cfg, - const struct fsg_module_parameters *params, - unsigned int fsg_num_buffers); -diff --git a/drivers/usb/gadget/legacy/acm_ms.c b/drivers/usb/gadget/legacy/acm_ms.c -index c16089efc322..c39de65a448b 100644 ---- a/drivers/usb/gadget/legacy/acm_ms.c -+++ b/drivers/usb/gadget/legacy/acm_ms.c -@@ -133,10 +133,6 @@ static int acm_ms_do_config(struct usb_configuration *c) - if (status < 0) - goto put_msg; - -- status = fsg_common_run_thread(opts->common); -- if (status) -- goto remove_acm; -- - status = usb_add_function(c, f_msg); - if (status) - goto remove_acm; -diff --git a/drivers/usb/gadget/legacy/mass_storage.c b/drivers/usb/gadget/legacy/mass_storage.c -index e61af53c7d2b..125974f32f50 100644 ---- a/drivers/usb/gadget/legacy/mass_storage.c -+++ b/drivers/usb/gadget/legacy/mass_storage.c -@@ -132,10 +132,6 @@ static int msg_do_config(struct usb_configuration *c) - if (IS_ERR(f_msg)) - return PTR_ERR(f_msg); - -- ret = fsg_common_run_thread(opts->common); -- if (ret) -- goto put_func; -- - ret = usb_add_function(c, f_msg); - if (ret) - goto put_func; -diff --git a/drivers/usb/gadget/legacy/multi.c b/drivers/usb/gadget/legacy/multi.c -index 229d704a620b..a70a406580ea 100644 ---- a/drivers/usb/gadget/legacy/multi.c -+++ b/drivers/usb/gadget/legacy/multi.c -@@ -137,7 +137,6 @@ static struct usb_function *f_msg_rndis; - - static int rndis_do_config(struct usb_configuration *c) - { -- struct fsg_opts *fsg_opts; - int ret; - - if (gadget_is_otg(c->cdev->gadget)) { -@@ -169,11 +168,6 @@ static int rndis_do_config(struct usb_configuration *c) - goto err_fsg; - } - -- fsg_opts = fsg_opts_from_func_inst(fi_msg); -- ret = fsg_common_run_thread(fsg_opts->common); -- if (ret) -- goto err_run; -- - ret = usb_add_function(c, f_msg_rndis); - if (ret) - goto err_run; -@@ -225,7 +219,6 @@ static struct usb_function *f_msg_multi; - - static int cdc_do_config(struct usb_configuration *c) - { -- struct fsg_opts *fsg_opts; - int ret; - - if (gadget_is_otg(c->cdev->gadget)) { -@@ -258,11 +251,6 @@ static int cdc_do_config(struct usb_configuration *c) - goto err_fsg; - } - -- fsg_opts = fsg_opts_from_func_inst(fi_msg); -- ret = fsg_common_run_thread(fsg_opts->common); -- if (ret) -- goto err_run; -- - ret = usb_add_function(c, f_msg_multi); - if (ret) - goto err_run; -diff --git a/drivers/usb/gadget/legacy/nokia.c b/drivers/usb/gadget/legacy/nokia.c -index 09975046c694..b1e535f4022e 100644 ---- a/drivers/usb/gadget/legacy/nokia.c -+++ b/drivers/usb/gadget/legacy/nokia.c -@@ -152,7 +152,6 @@ static int nokia_bind_config(struct usb_configuration *c) - struct usb_function *f_ecm; - struct usb_function *f_obex2 = NULL; - struct usb_function *f_msg; -- struct fsg_opts *fsg_opts; - int status = 0; - int obex1_stat = -1; - int obex2_stat = -1; -@@ -222,12 +221,6 @@ static int nokia_bind_config(struct usb_configuration *c) - goto err_ecm; - } - -- fsg_opts = fsg_opts_from_func_inst(fi_msg); -- -- status = fsg_common_run_thread(fsg_opts->common); -- if (status) -- goto err_msg; -- - status = usb_add_function(c, f_msg); - if (status) - goto err_msg; -diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c -index b86a6f03592e..e272b3ba1d14 100644 ---- a/drivers/usb/gadget/udc/udc-core.c -+++ b/drivers/usb/gadget/udc/udc-core.c -@@ -75,7 +75,7 @@ int usb_gadget_map_request(struct usb_gadget *gadget, - mapped = dma_map_sg(dev, req->sg, req->num_sgs, - is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE); - if (mapped == 0) { -- dev_err(&gadget->dev, "failed to map SGs\n"); -+ dev_err(dev, "failed to map SGs\n"); - return -EFAULT; - } - -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 5cd080e0a685..743d9a20e248 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -1873,6 +1873,12 @@ no_bw: - kfree(xhci->rh_bw); - kfree(xhci->ext_caps); - -+ xhci->usb2_ports = NULL; -+ xhci->usb3_ports = NULL; -+ xhci->port_array = NULL; -+ xhci->rh_bw = NULL; -+ xhci->ext_caps = NULL; -+ - xhci->page_size = 0; - xhci->page_shift = 0; - xhci->bus_state[0].bus_suspended = 0; -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index f0640b7a1c42..48672fac7ff3 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -48,6 +48,7 @@ - #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f - #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f - #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8 -+#define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8 - - static const char hcd_name[] = "xhci_hcd"; - -@@ -155,7 +156,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || - pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI || - pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || -- pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI)) { -+ pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI || -+ pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI)) { - xhci->quirks |= XHCI_PME_STUCK_QUIRK; - } - if (pdev->vendor == PCI_VENDOR_ID_INTEL && -@@ -302,6 +304,7 @@ static void xhci_pci_remove(struct pci_dev *dev) - struct xhci_hcd *xhci; - - xhci = hcd_to_xhci(pci_get_drvdata(dev)); -+ xhci->xhc_state |= XHCI_STATE_REMOVING; - if (xhci->shared_hcd) { - usb_remove_hcd(xhci->shared_hcd); - usb_put_hcd(xhci->shared_hcd); -diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c -index d39d6bf1d090..d4962208be30 100644 ---- a/drivers/usb/host/xhci-plat.c -+++ b/drivers/usb/host/xhci-plat.c -@@ -39,12 +39,25 @@ static const struct xhci_driver_overrides xhci_plat_overrides __initconst = { - - static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci) - { -+ struct usb_hcd *hcd = xhci_to_hcd(xhci); -+ - /* - * As of now platform drivers don't provide MSI support so we ensure - * here that the generic code does not try to make a pci_dev from our - * dev struct in order to setup MSI - */ - xhci->quirks |= XHCI_PLAT; -+ -+ /* -+ * On R-Car Gen2 and Gen3, the AC64 bit (bit 0) of HCCPARAMS1 is set -+ * to 1. However, these SoCs don't support 64-bit address memory -+ * pointers. So, this driver clears the AC64 bit of xhci->hcc_params -+ * to call dma_set_coherent_mask(dev, DMA_BIT_MASK(32)) in -+ * xhci_gen_setup(). -+ */ -+ if (xhci_plat_type_is(hcd, XHCI_PLAT_TYPE_RENESAS_RCAR_GEN2) || -+ xhci_plat_type_is(hcd, XHCI_PLAT_TYPE_RENESAS_RCAR_GEN3)) -+ xhci->quirks |= XHCI_NO_64BIT_SUPPORT; - } - - /* called during probe() after chip reset completes */ -diff --git a/drivers/usb/host/xhci-plat.h b/drivers/usb/host/xhci-plat.h -index 5a2e2e3936c4..529c3c40f901 100644 ---- a/drivers/usb/host/xhci-plat.h -+++ b/drivers/usb/host/xhci-plat.h -@@ -14,7 +14,7 @@ - #include "xhci.h" /* for hcd_to_xhci() */ - - enum xhci_plat_type { -- XHCI_PLAT_TYPE_MARVELL_ARMADA, -+ XHCI_PLAT_TYPE_MARVELL_ARMADA = 1, - XHCI_PLAT_TYPE_RENESAS_RCAR_GEN2, - XHCI_PLAT_TYPE_RENESAS_RCAR_GEN3, - }; -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 3915657e6078..a85a1c993d61 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -4014,7 +4014,8 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd, - int reserved_trbs = xhci->cmd_ring_reserved_trbs; - int ret; - -- if (xhci->xhc_state) { -+ if ((xhci->xhc_state & XHCI_STATE_DYING) || -+ (xhci->xhc_state & XHCI_STATE_HALTED)) { - xhci_dbg(xhci, "xHCI dying or halted, can't queue_command\n"); - return -ESHUTDOWN; - } -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 0c8087d3c313..8e713cca58ed 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -147,7 +147,8 @@ static int xhci_start(struct xhci_hcd *xhci) - "waited %u microseconds.\n", - XHCI_MAX_HALT_USEC); - if (!ret) -- xhci->xhc_state &= ~(XHCI_STATE_HALTED | XHCI_STATE_DYING); -+ /* clear state flags. Including dying, halted or removing */ -+ xhci->xhc_state = 0; - - return ret; - } -@@ -1108,8 +1109,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) - /* Resume root hubs only when have pending events. */ - status = readl(&xhci->op_regs->status); - if (status & STS_EINT) { -- usb_hcd_resume_root_hub(hcd); - usb_hcd_resume_root_hub(xhci->shared_hcd); -+ usb_hcd_resume_root_hub(hcd); - } - } - -@@ -1124,10 +1125,10 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) - - /* Re-enable port polling. */ - xhci_dbg(xhci, "%s: starting port polling.\n", __func__); -- set_bit(HCD_FLAG_POLL_RH, &hcd->flags); -- usb_hcd_poll_rh_status(hcd); - set_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); - usb_hcd_poll_rh_status(xhci->shared_hcd); -+ set_bit(HCD_FLAG_POLL_RH, &hcd->flags); -+ usb_hcd_poll_rh_status(hcd); - - return retval; - } -@@ -2770,7 +2771,8 @@ int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev) - if (ret <= 0) - return ret; - xhci = hcd_to_xhci(hcd); -- if (xhci->xhc_state & XHCI_STATE_DYING) -+ if ((xhci->xhc_state & XHCI_STATE_DYING) || -+ (xhci->xhc_state & XHCI_STATE_REMOVING)) - return -ENODEV; - - xhci_dbg(xhci, "%s called for udev %p\n", __func__, udev); -@@ -3817,7 +3819,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, - - mutex_lock(&xhci->mutex); - -- if (xhci->xhc_state) /* dying or halted */ -+ if (xhci->xhc_state) /* dying, removing or halted */ - goto out; - - if (!udev->slot_id) { -@@ -4944,6 +4946,16 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) - return retval; - xhci_dbg(xhci, "Reset complete\n"); - -+ /* -+ * On some xHCI controllers (e.g. R-Car SoCs), the AC64 bit (bit 0) -+ * of HCCPARAMS1 is set to 1. However, the xHCs don't support 64-bit -+ * address memory pointers actually. So, this driver clears the AC64 -+ * bit of xhci->hcc_params to call dma_set_coherent_mask(dev, -+ * DMA_BIT_MASK(32)) in this xhci_gen_setup(). -+ */ -+ if (xhci->quirks & XHCI_NO_64BIT_SUPPORT) -+ xhci->hcc_params &= ~BIT(0); -+ - /* Set dma_mask and coherent_dma_mask to 64-bits, - * if xHC supports 64-bit addressing */ - if (HCC_64BIT_ADDR(xhci->hcc_params) && -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index cc651383ce5a..1cdea4a8c895 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1596,6 +1596,7 @@ struct xhci_hcd { - */ - #define XHCI_STATE_DYING (1 << 0) - #define XHCI_STATE_HALTED (1 << 1) -+#define XHCI_STATE_REMOVING (1 << 2) - /* Statistics */ - int error_bitmask; - unsigned int quirks; -@@ -1632,6 +1633,7 @@ struct xhci_hcd { - #define XHCI_PME_STUCK_QUIRK (1 << 20) - #define XHCI_MTK_HOST (1 << 21) - #define XHCI_SSIC_PORT_UNUSED (1 << 22) -+#define XHCI_NO_64BIT_SUPPORT (1 << 23) - unsigned int num_active_eps; - unsigned int limit_active_eps; - /* There are two roothubs to keep track of bus suspend info for */ -diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c -index c6bfd13f6c92..1950e87b4219 100644 ---- a/drivers/usb/misc/iowarrior.c -+++ b/drivers/usb/misc/iowarrior.c -@@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_interface *interface, - iface_desc = interface->cur_altsetting; - dev->product_id = le16_to_cpu(udev->descriptor.idProduct); - -+ if (iface_desc->desc.bNumEndpoints < 1) { -+ dev_err(&interface->dev, "Invalid number of endpoints\n"); -+ retval = -EINVAL; -+ goto error; -+ } -+ - /* set up the endpoint information */ - for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { - endpoint = &iface_desc->endpoint[i].desc; -diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c -index 92fdb6e9faff..c78ff95a43be 100644 ---- a/drivers/usb/misc/usbtest.c -+++ b/drivers/usb/misc/usbtest.c -@@ -529,6 +529,7 @@ static struct scatterlist * - alloc_sglist(int nents, int max, int vary, struct usbtest_dev *dev, int pipe) - { - struct scatterlist *sg; -+ unsigned int n_size = 0; - unsigned i; - unsigned size = max; - unsigned maxpacket = -@@ -561,7 +562,8 @@ alloc_sglist(int nents, int max, int vary, struct usbtest_dev *dev, int pipe) - break; - case 1: - for (j = 0; j < size; j++) -- *buf++ = (u8) ((j % maxpacket) % 63); -+ *buf++ = (u8) (((j + n_size) % maxpacket) % 63); -+ n_size += size; - break; - } - -diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c -index c0f5c652d272..f1893e08e51a 100644 ---- a/drivers/usb/renesas_usbhs/fifo.c -+++ b/drivers/usb/renesas_usbhs/fifo.c -@@ -190,7 +190,8 @@ static int usbhsf_pkt_handler(struct usbhs_pipe *pipe, int type) - goto __usbhs_pkt_handler_end; - } - -- ret = func(pkt, &is_done); -+ if (likely(func)) -+ ret = func(pkt, &is_done); - - if (is_done) - __usbhsf_pkt_del(pkt); -@@ -889,6 +890,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done) - - pkt->trans = len; - -+ usbhsf_tx_irq_ctrl(pipe, 0); - INIT_WORK(&pkt->work, xfer_work); - schedule_work(&pkt->work); - -diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c -index 657f9672ceba..251053551866 100644 ---- a/drivers/usb/renesas_usbhs/mod_gadget.c -+++ b/drivers/usb/renesas_usbhs/mod_gadget.c -@@ -158,10 +158,14 @@ static void usbhsg_queue_done(struct usbhs_priv *priv, struct usbhs_pkt *pkt) - struct usbhs_pipe *pipe = pkt->pipe; - struct usbhsg_uep *uep = usbhsg_pipe_to_uep(pipe); - struct usbhsg_request *ureq = usbhsg_pkt_to_ureq(pkt); -+ unsigned long flags; - - ureq->req.actual = pkt->actual; - -- usbhsg_queue_pop(uep, ureq, 0); -+ usbhs_lock(priv, flags); -+ if (uep) -+ __usbhsg_queue_pop(uep, ureq, 0); -+ usbhs_unlock(priv, flags); - } - - static void usbhsg_queue_push(struct usbhsg_uep *uep, -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 73a366de5102..a543cdc0f88f 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -109,6 +109,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */ - { USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */ - { USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */ -+ { USB_DEVICE(0x10C4, 0x82F4) }, /* Starizona MicroTouch */ - { USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */ - { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */ - { USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */ -@@ -118,6 +119,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ - { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ - { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ -+ { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */ - { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ - { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */ - { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ -@@ -141,6 +143,8 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0xF004) }, /* Elan Digital Systems USBcount50 */ - { USB_DEVICE(0x10C5, 0xEA61) }, /* Silicon Labs MobiData GPRS USB Modem */ - { USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */ -+ { USB_DEVICE(0x12B8, 0xEC60) }, /* Link G4 ECU */ -+ { USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */ - { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */ - { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */ - { USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */ -@@ -165,6 +169,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ - { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ - { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ -+ { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */ - { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ - { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ - { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ -diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c -index 01bf53392819..244acb1299a9 100644 ---- a/drivers/usb/serial/cypress_m8.c -+++ b/drivers/usb/serial/cypress_m8.c -@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port) - struct usb_serial *serial = port->serial; - struct cypress_private *priv; - -+ if (!port->interrupt_out_urb || !port->interrupt_in_urb) { -+ dev_err(&port->dev, "required endpoint is missing\n"); -+ return -ENODEV; -+ } -+ - priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL); - if (!priv) - return -ENOMEM; -@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port) - cypress_set_termios(tty, port, &priv->tmp_termios); - - /* setup the port and start reading from the device */ -- if (!port->interrupt_in_urb) { -- dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n", -- __func__); -- return -1; -- } -- - usb_fill_int_urb(port->interrupt_in_urb, serial->dev, - usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress), - port->interrupt_in_urb->transfer_buffer, -diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c -index 12b0e67473ba..3df7b7ec178e 100644 ---- a/drivers/usb/serial/digi_acceleport.c -+++ b/drivers/usb/serial/digi_acceleport.c -@@ -1251,8 +1251,27 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num) - - static int digi_startup(struct usb_serial *serial) - { -+ struct device *dev = &serial->interface->dev; - struct digi_serial *serial_priv; - int ret; -+ int i; -+ -+ /* check whether the device has the expected number of endpoints */ -+ if (serial->num_port_pointers < serial->type->num_ports + 1) { -+ dev_err(dev, "OOB endpoints missing\n"); -+ return -ENODEV; -+ } -+ -+ for (i = 0; i < serial->type->num_ports + 1 ; i++) { -+ if (!serial->port[i]->read_urb) { -+ dev_err(dev, "bulk-in endpoint missing\n"); -+ return -ENODEV; -+ } -+ if (!serial->port[i]->write_urb) { -+ dev_err(dev, "bulk-out endpoint missing\n"); -+ return -ENODEV; -+ } -+ } - - serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL); - if (!serial_priv) -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 8c660ae401d8..b61f12160d37 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1004,6 +1004,10 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) }, - { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) }, - { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) }, -+ /* ICP DAS I-756xU devices */ -+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) }, -+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, -+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index a84df2513994..c5d6c1e73e8e 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -872,6 +872,14 @@ - #define NOVITUS_BONO_E_PID 0x6010 - - /* -+ * ICPDAS I-756*U devices -+ */ -+#define ICPDAS_VID 0x1b5c -+#define ICPDAS_I7560U_PID 0x0103 -+#define ICPDAS_I7561U_PID 0x0104 -+#define ICPDAS_I7563U_PID 0x0105 -+ -+/* - * RT Systems programming cables for various ham radios - */ - #define RTSYSTEMS_VID 0x2100 /* Vendor ID */ -diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c -index f49327d20ee8..0a935b1e5475 100644 ---- a/drivers/usb/serial/io_edgeport.c -+++ b/drivers/usb/serial/io_edgeport.c -@@ -2849,14 +2849,16 @@ static int edge_startup(struct usb_serial *serial) - /* not set up yet, so do it now */ - edge_serial->interrupt_read_urb = - usb_alloc_urb(0, GFP_KERNEL); -- if (!edge_serial->interrupt_read_urb) -- return -ENOMEM; -+ if (!edge_serial->interrupt_read_urb) { -+ response = -ENOMEM; -+ break; -+ } - - edge_serial->interrupt_in_buffer = - kmalloc(buffer_size, GFP_KERNEL); - if (!edge_serial->interrupt_in_buffer) { -- usb_free_urb(edge_serial->interrupt_read_urb); -- return -ENOMEM; -+ response = -ENOMEM; -+ break; - } - edge_serial->interrupt_in_endpoint = - endpoint->bEndpointAddress; -@@ -2884,14 +2886,16 @@ static int edge_startup(struct usb_serial *serial) - /* not set up yet, so do it now */ - edge_serial->read_urb = - usb_alloc_urb(0, GFP_KERNEL); -- if (!edge_serial->read_urb) -- return -ENOMEM; -+ if (!edge_serial->read_urb) { -+ response = -ENOMEM; -+ break; -+ } - - edge_serial->bulk_in_buffer = - kmalloc(buffer_size, GFP_KERNEL); - if (!edge_serial->bulk_in_buffer) { -- usb_free_urb(edge_serial->read_urb); -- return -ENOMEM; -+ response = -ENOMEM; -+ break; - } - edge_serial->bulk_in_endpoint = - endpoint->bEndpointAddress; -@@ -2917,9 +2921,22 @@ static int edge_startup(struct usb_serial *serial) - } - } - -- if (!interrupt_in_found || !bulk_in_found || !bulk_out_found) { -- dev_err(ddev, "Error - the proper endpoints were not found!\n"); -- return -ENODEV; -+ if (response || !interrupt_in_found || !bulk_in_found || -+ !bulk_out_found) { -+ if (!response) { -+ dev_err(ddev, "expected endpoints not found\n"); -+ response = -ENODEV; -+ } -+ -+ usb_free_urb(edge_serial->interrupt_read_urb); -+ kfree(edge_serial->interrupt_in_buffer); -+ -+ usb_free_urb(edge_serial->read_urb); -+ kfree(edge_serial->bulk_in_buffer); -+ -+ kfree(edge_serial); -+ -+ return response; - } - - /* start interrupt read for this edgeport this interrupt will -@@ -2942,16 +2959,9 @@ static void edge_disconnect(struct usb_serial *serial) - { - struct edgeport_serial *edge_serial = usb_get_serial_data(serial); - -- /* stop reads and writes on all ports */ -- /* free up our endpoint stuff */ - if (edge_serial->is_epic) { - usb_kill_urb(edge_serial->interrupt_read_urb); -- usb_free_urb(edge_serial->interrupt_read_urb); -- kfree(edge_serial->interrupt_in_buffer); -- - usb_kill_urb(edge_serial->read_urb); -- usb_free_urb(edge_serial->read_urb); -- kfree(edge_serial->bulk_in_buffer); - } - } - -@@ -2964,6 +2974,16 @@ static void edge_release(struct usb_serial *serial) - { - struct edgeport_serial *edge_serial = usb_get_serial_data(serial); - -+ if (edge_serial->is_epic) { -+ usb_kill_urb(edge_serial->interrupt_read_urb); -+ usb_free_urb(edge_serial->interrupt_read_urb); -+ kfree(edge_serial->interrupt_in_buffer); -+ -+ usb_kill_urb(edge_serial->read_urb); -+ usb_free_urb(edge_serial->read_urb); -+ kfree(edge_serial->bulk_in_buffer); -+ } -+ - kfree(edge_serial); - } - -diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c -index e07b15ed5814..7faa901ee47f 100644 ---- a/drivers/usb/serial/keyspan.c -+++ b/drivers/usb/serial/keyspan.c -@@ -2376,6 +2376,10 @@ static void keyspan_release(struct usb_serial *serial) - - s_priv = usb_get_serial_data(serial); - -+ /* Make sure to unlink the URBs submitted in attach. */ -+ usb_kill_urb(s_priv->instat_urb); -+ usb_kill_urb(s_priv->indat_urb); -+ - usb_free_urb(s_priv->instat_urb); - usb_free_urb(s_priv->indat_urb); - usb_free_urb(s_priv->glocont_urb); -diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c -index fd707d6a10e2..89726f702202 100644 ---- a/drivers/usb/serial/mct_u232.c -+++ b/drivers/usb/serial/mct_u232.c -@@ -376,14 +376,21 @@ static void mct_u232_msr_to_state(struct usb_serial_port *port, - - static int mct_u232_port_probe(struct usb_serial_port *port) - { -+ struct usb_serial *serial = port->serial; - struct mct_u232_private *priv; - -+ /* check first to simplify error handling */ -+ if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) { -+ dev_err(&port->dev, "expected endpoint missing\n"); -+ return -ENODEV; -+ } -+ - priv = kzalloc(sizeof(*priv), GFP_KERNEL); - if (!priv) - return -ENOMEM; - - /* Use second interrupt-in endpoint for reading. */ -- priv->read_urb = port->serial->port[1]->interrupt_in_urb; -+ priv->read_urb = serial->port[1]->interrupt_in_urb; - priv->read_urb->context = port; - - spin_lock_init(&priv->lock); -diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c -index 31a8b47f1ac6..c6596cbcc4b6 100644 ---- a/drivers/usb/serial/mxuport.c -+++ b/drivers/usb/serial/mxuport.c -@@ -1259,6 +1259,15 @@ static int mxuport_attach(struct usb_serial *serial) - return 0; - } - -+static void mxuport_release(struct usb_serial *serial) -+{ -+ struct usb_serial_port *port0 = serial->port[0]; -+ struct usb_serial_port *port1 = serial->port[1]; -+ -+ usb_serial_generic_close(port1); -+ usb_serial_generic_close(port0); -+} -+ - static int mxuport_open(struct tty_struct *tty, struct usb_serial_port *port) - { - struct mxuport_port *mxport = usb_get_serial_port_data(port); -@@ -1361,6 +1370,7 @@ static struct usb_serial_driver mxuport_device = { - .probe = mxuport_probe, - .port_probe = mxuport_port_probe, - .attach = mxuport_attach, -+ .release = mxuport_release, - .calc_num_ports = mxuport_calc_num_ports, - .open = mxuport_open, - .close = mxuport_close, -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 348e19834b83..d96d423d00e6 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -375,18 +375,22 @@ static void option_instat_callback(struct urb *urb); - #define HAIER_PRODUCT_CE81B 0x10f8 - #define HAIER_PRODUCT_CE100 0x2009 - --/* Cinterion (formerly Siemens) products */ --#define SIEMENS_VENDOR_ID 0x0681 --#define CINTERION_VENDOR_ID 0x1e2d -+/* Gemalto's Cinterion products (formerly Siemens) */ -+#define SIEMENS_VENDOR_ID 0x0681 -+#define CINTERION_VENDOR_ID 0x1e2d -+#define CINTERION_PRODUCT_HC25_MDMNET 0x0040 - #define CINTERION_PRODUCT_HC25_MDM 0x0047 --#define CINTERION_PRODUCT_HC25_MDMNET 0x0040 -+#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */ - #define CINTERION_PRODUCT_HC28_MDM 0x004C --#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */ - #define CINTERION_PRODUCT_EU3_E 0x0051 - #define CINTERION_PRODUCT_EU3_P 0x0052 - #define CINTERION_PRODUCT_PH8 0x0053 - #define CINTERION_PRODUCT_AHXX 0x0055 - #define CINTERION_PRODUCT_PLXX 0x0060 -+#define CINTERION_PRODUCT_PH8_2RMNET 0x0082 -+#define CINTERION_PRODUCT_PH8_AUDIO 0x0083 -+#define CINTERION_PRODUCT_AHXX_2RMNET 0x0084 -+#define CINTERION_PRODUCT_AHXX_AUDIO 0x0085 - - /* Olivetti products */ - #define OLIVETTI_VENDOR_ID 0x0b3c -@@ -633,6 +637,10 @@ static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = { - .reserved = BIT(1) | BIT(2) | BIT(3), - }; - -+static const struct option_blacklist_info cinterion_rmnet2_blacklist = { -+ .reserved = BIT(4) | BIT(5), -+}; -+ - static const struct usb_device_id option_ids[] = { - { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, - { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, -@@ -1602,7 +1610,79 @@ static const struct usb_device_id option_ids[] = { - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, -- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff42, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff43, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff44, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff45, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff46, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff47, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff48, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff49, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4a, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4b, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4c, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4d, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4e, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4f, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff50, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff51, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff52, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff53, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff54, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff55, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff56, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff57, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff58, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff59, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5a, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5b, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5c, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5d, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5e, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5f, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff60, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff61, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff62, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff63, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff64, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff65, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff66, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff67, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff68, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff69, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6a, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6b, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6c, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6d, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6e, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6f, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff70, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff71, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff72, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff73, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff74, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff75, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff76, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff77, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff78, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff79, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7a, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7b, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7c, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7d, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7e, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7f, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff80, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff81, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff82, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff83, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff84, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff85, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff86, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff87, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff88, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff89, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8a, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) }, -@@ -1613,6 +1693,61 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff9f, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa0, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa1, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa2, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa3, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa4, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa5, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa6, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa7, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa8, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa9, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffaa, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffab, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffac, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffae, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffaf, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb0, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb1, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb2, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb3, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb4, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb5, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb6, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb7, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb8, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb9, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffba, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbb, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbc, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbd, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbe, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbf, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc0, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc1, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc2, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc3, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc4, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc5, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc6, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc7, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc8, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc9, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffca, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcb, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcc, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcd, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffce, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcf, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd0, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd1, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd2, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd3, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd4, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd5, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffec, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffee, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xfff6, 0xff, 0xff, 0xff) }, -@@ -1712,7 +1847,13 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) }, - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, -- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, -+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_2RMNET, 0xff), -+ .driver_info = (kernel_ulong_t)&cinterion_rmnet2_blacklist }, -+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_AUDIO, 0xff), -+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, -+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_2RMNET, 0xff) }, -+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) }, -+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, - { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) }, - { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) }, -@@ -1818,6 +1959,8 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) }, - { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) }, - { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ -+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ - { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ -diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c -index 504f5bff79c0..b18974cbd995 100644 ---- a/drivers/usb/serial/quatech2.c -+++ b/drivers/usb/serial/quatech2.c -@@ -141,6 +141,7 @@ static void qt2_release(struct usb_serial *serial) - - serial_priv = usb_get_serial_data(serial); - -+ usb_kill_urb(serial_priv->read_urb); - usb_free_urb(serial_priv->read_urb); - kfree(serial_priv->read_buffer); - kfree(serial_priv); -diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c -index 9ff9404f99d7..e4ade8d89eb5 100644 ---- a/drivers/usb/storage/uas.c -+++ b/drivers/usb/storage/uas.c -@@ -2,7 +2,7 @@ - * USB Attached SCSI - * Note that this is not the same as the USB Mass Storage driver - * -- * Copyright Hans de Goede for Red Hat, Inc. 2013 - 2014 -+ * Copyright Hans de Goede for Red Hat, Inc. 2013 - 2016 - * Copyright Matthew Wilcox for Intel Corp, 2010 - * Copyright Sarah Sharp for Intel Corp, 2010 - * -@@ -757,6 +757,17 @@ static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd) - return SUCCESS; - } - -+static int uas_target_alloc(struct scsi_target *starget) -+{ -+ struct uas_dev_info *devinfo = (struct uas_dev_info *) -+ dev_to_shost(starget->dev.parent)->hostdata; -+ -+ if (devinfo->flags & US_FL_NO_REPORT_LUNS) -+ starget->no_report_luns = 1; -+ -+ return 0; -+} -+ - static int uas_slave_alloc(struct scsi_device *sdev) - { - struct uas_dev_info *devinfo = -@@ -800,7 +811,6 @@ static int uas_slave_configure(struct scsi_device *sdev) - if (devinfo->flags & US_FL_BROKEN_FUA) - sdev->broken_fua = 1; - -- scsi_change_queue_depth(sdev, devinfo->qdepth - 2); - return 0; - } - -@@ -808,11 +818,12 @@ static struct scsi_host_template uas_host_template = { - .module = THIS_MODULE, - .name = "uas", - .queuecommand = uas_queuecommand, -+ .target_alloc = uas_target_alloc, - .slave_alloc = uas_slave_alloc, - .slave_configure = uas_slave_configure, - .eh_abort_handler = uas_eh_abort_handler, - .eh_bus_reset_handler = uas_eh_bus_reset_handler, -- .can_queue = 65536, /* Is there a limit on the _host_ ? */ -+ .can_queue = MAX_CMNDS, - .this_id = -1, - .sg_tablesize = SG_NONE, - .skip_settle_delay = 1, -@@ -932,6 +943,12 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id) - if (result) - goto set_alt0; - -+ /* -+ * 1 tag is reserved for untagged commands + -+ * 1 tag to avoid off by one errors in some bridge firmwares -+ */ -+ shost->can_queue = devinfo->qdepth - 2; -+ - usb_set_intfdata(intf, shost); - result = scsi_add_host(shost, &intf->dev); - if (result) -diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h -index ccc113e83d88..53341a77d89f 100644 ---- a/drivers/usb/storage/unusual_uas.h -+++ b/drivers/usb/storage/unusual_uas.h -@@ -64,6 +64,13 @@ UNUSUAL_DEV(0x0bc2, 0x3312, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_NO_ATA_1X), - -+/* Reported-by: David Webb */ -+UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999, -+ "Seagate", -+ "Expansion Desk", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_REPORT_LUNS), -+ - /* Reported-by: Hans de Goede */ - UNUSUAL_DEV(0x0bc2, 0x3320, 0x0000, 0x9999, - "Seagate", -diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c -index 43576ed31ccd..9de988a0f856 100644 ---- a/drivers/usb/storage/usb.c -+++ b/drivers/usb/storage/usb.c -@@ -482,7 +482,7 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags) - US_FL_NO_READ_DISC_INFO | US_FL_NO_READ_CAPACITY_16 | - US_FL_INITIAL_READ10 | US_FL_WRITE_CACHE | - US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES | -- US_FL_MAX_SECTORS_240); -+ US_FL_MAX_SECTORS_240 | US_FL_NO_REPORT_LUNS); - - p = quirks; - while (*p) { -@@ -532,6 +532,9 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags) - case 'i': - f |= US_FL_IGNORE_DEVICE; - break; -+ case 'j': -+ f |= US_FL_NO_REPORT_LUNS; -+ break; - case 'l': - f |= US_FL_NOT_LOCKABLE; - break; -diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c -index facaaf003f19..e40da7759a0e 100644 ---- a/drivers/usb/usbip/usbip_common.c -+++ b/drivers/usb/usbip/usbip_common.c -@@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) - if (!(size > 0)) - return 0; - -+ if (size > urb->transfer_buffer_length) { -+ /* should not happen, probably malicious packet */ -+ if (ud->side == USBIP_STUB) { -+ usbip_event_add(ud, SDEV_EVENT_ERROR_TCP); -+ return 0; -+ } else { -+ usbip_event_add(ud, VDEV_EVENT_ERROR_TCP); -+ return -EPIPE; -+ } -+ } -+ - ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size); - if (ret != size) { - dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret); -diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig -index 8ea45a5cd806..d889ef2048df 100644 ---- a/drivers/video/fbdev/Kconfig -+++ b/drivers/video/fbdev/Kconfig -@@ -2246,7 +2246,6 @@ config XEN_FBDEV_FRONTEND - select FB_SYS_IMAGEBLIT - select FB_SYS_FOPS - select FB_DEFERRED_IO -- select INPUT_XEN_KBDDEV_FRONTEND if INPUT_MISC - select XEN_XENBUS_FRONTEND - default y - help -diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c -index 9362424c2340..f9ef06d0cd48 100644 ---- a/drivers/video/fbdev/amba-clcd.c -+++ b/drivers/video/fbdev/amba-clcd.c -@@ -440,13 +440,14 @@ static int clcdfb_register(struct clcd_fb *fb) - fb->off_ienb = CLCD_PL111_IENB; - fb->off_cntl = CLCD_PL111_CNTL; - } else { --#ifdef CONFIG_ARCH_VERSATILE -- fb->off_ienb = CLCD_PL111_IENB; -- fb->off_cntl = CLCD_PL111_CNTL; --#else -- fb->off_ienb = CLCD_PL110_IENB; -- fb->off_cntl = CLCD_PL110_CNTL; --#endif -+ if (of_machine_is_compatible("arm,versatile-ab") || -+ of_machine_is_compatible("arm,versatile-pb")) { -+ fb->off_ienb = CLCD_PL111_IENB; -+ fb->off_cntl = CLCD_PL111_CNTL; -+ } else { -+ fb->off_ienb = CLCD_PL110_IENB; -+ fb->off_cntl = CLCD_PL110_CNTL; -+ } - } - - fb->clk = clk_get(&fb->dev->dev, NULL); -diff --git a/drivers/video/fbdev/da8xx-fb.c b/drivers/video/fbdev/da8xx-fb.c -index 6b2a06d09f2b..d8d583d32a37 100644 ---- a/drivers/video/fbdev/da8xx-fb.c -+++ b/drivers/video/fbdev/da8xx-fb.c -@@ -209,8 +209,7 @@ static struct fb_videomode known_lcd_panels[] = { - .lower_margin = 2, - .hsync_len = 0, - .vsync_len = 0, -- .sync = FB_SYNC_CLK_INVERT | -- FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, -+ .sync = FB_SYNC_CLK_INVERT, - }, - /* Sharp LK043T1DG01 */ - [1] = { -@@ -224,7 +223,7 @@ static struct fb_videomode known_lcd_panels[] = { - .lower_margin = 2, - .hsync_len = 41, - .vsync_len = 10, -- .sync = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, -+ .sync = 0, - .flag = 0, - }, - [2] = { -@@ -239,7 +238,7 @@ static struct fb_videomode known_lcd_panels[] = { - .lower_margin = 10, - .hsync_len = 10, - .vsync_len = 10, -- .sync = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, -+ .sync = 0, - .flag = 0, - }, - [3] = { -diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c -index 7760fc1a2218..1f413a2f70b6 100644 ---- a/drivers/virtio/virtio_pci_modern.c -+++ b/drivers/virtio/virtio_pci_modern.c -@@ -17,6 +17,7 @@ - * - */ - -+#include - #define VIRTIO_PCI_NO_LEGACY - #include "virtio_pci_common.h" - -@@ -271,9 +272,13 @@ static void vp_reset(struct virtio_device *vdev) - struct virtio_pci_device *vp_dev = to_vp_device(vdev); - /* 0 status means a reset. */ - vp_iowrite8(0, &vp_dev->common->device_status); -- /* Flush out the status write, and flush in device writes, -- * including MSI-X interrupts, if any. */ -- vp_ioread8(&vp_dev->common->device_status); -+ /* After writing 0 to device_status, the driver MUST wait for a read of -+ * device_status to return 0 before reinitializing the device. -+ * This will flush out the status write, and flush in device writes, -+ * including MSI-X interrupts, if any. -+ */ -+ while (vp_ioread8(&vp_dev->common->device_status)) -+ msleep(1); - /* Flush pending VQ/configuration callbacks. */ - vp_synchronize_vectors(vdev); - } -diff --git a/drivers/watchdog/rc32434_wdt.c b/drivers/watchdog/rc32434_wdt.c -index 71e78ef4b736..3a75f3b53452 100644 ---- a/drivers/watchdog/rc32434_wdt.c -+++ b/drivers/watchdog/rc32434_wdt.c -@@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct file *file, unsigned int cmd, - return -EINVAL; - /* Fall through */ - case WDIOC_GETTIMEOUT: -- return copy_to_user(argp, &timeout, sizeof(int)); -+ return copy_to_user(argp, &timeout, sizeof(int)) ? -EFAULT : 0; - default: - return -ENOTTY; - } -diff --git a/drivers/watchdog/sp5100_tco.c b/drivers/watchdog/sp5100_tco.c -index 6467b91f2245..028618c5eeba 100644 ---- a/drivers/watchdog/sp5100_tco.c -+++ b/drivers/watchdog/sp5100_tco.c -@@ -73,6 +73,13 @@ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started." - /* - * Some TCO specific functions - */ -+ -+static bool tco_has_sp5100_reg_layout(struct pci_dev *dev) -+{ -+ return dev->device == PCI_DEVICE_ID_ATI_SBX00_SMBUS && -+ dev->revision < 0x40; -+} -+ - static void tco_timer_start(void) - { - u32 val; -@@ -129,7 +136,7 @@ static void tco_timer_enable(void) - { - int val; - -- if (sp5100_tco_pci->revision >= 0x40) { -+ if (!tco_has_sp5100_reg_layout(sp5100_tco_pci)) { - /* For SB800 or later */ - /* Set the Watchdog timer resolution to 1 sec */ - outb(SB800_PM_WATCHDOG_CONFIG, SB800_IO_PM_INDEX_REG); -@@ -342,8 +349,7 @@ static unsigned char sp5100_tco_setupdevice(void) - /* - * Determine type of southbridge chipset. - */ -- if (sp5100_tco_pci->device == PCI_DEVICE_ID_ATI_SBX00_SMBUS && -- sp5100_tco_pci->revision < 0x40) { -+ if (tco_has_sp5100_reg_layout(sp5100_tco_pci)) { - dev_name = SP5100_DEVNAME; - index_reg = SP5100_IO_PM_INDEX_REG; - data_reg = SP5100_IO_PM_DATA_REG; -@@ -388,8 +394,7 @@ static unsigned char sp5100_tco_setupdevice(void) - * Secondly, Find the watchdog timer MMIO address - * from SBResource_MMIO register. - */ -- if (sp5100_tco_pci->device == PCI_DEVICE_ID_ATI_SBX00_SMBUS && -- sp5100_tco_pci->revision < 0x40) { -+ if (tco_has_sp5100_reg_layout(sp5100_tco_pci)) { - /* Read SBResource_MMIO from PCI config(PCI_Reg: 9Ch) */ - pci_read_config_dword(sp5100_tco_pci, - SP5100_SB_RESOURCE_MMIO_BASE, &val); -diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c -index 12eab503efd1..364bc44610c1 100644 ---- a/drivers/xen/balloon.c -+++ b/drivers/xen/balloon.c -@@ -152,6 +152,8 @@ static DECLARE_WAIT_QUEUE_HEAD(balloon_wq); - static void balloon_process(struct work_struct *work); - static DECLARE_DELAYED_WORK(balloon_worker, balloon_process); - -+static void release_memory_resource(struct resource *resource); -+ - /* When ballooning out (allocating memory to return to Xen) we don't really - want the kernel to try too hard since that can trigger the oom killer. */ - #define GFP_BALLOON \ -@@ -268,6 +270,20 @@ static struct resource *additional_memory_resource(phys_addr_t size) - return NULL; - } - -+#ifdef CONFIG_SPARSEMEM -+ { -+ unsigned long limit = 1UL << (MAX_PHYSMEM_BITS - PAGE_SHIFT); -+ unsigned long pfn = res->start >> PAGE_SHIFT; -+ -+ if (pfn > limit) { -+ pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n", -+ pfn, limit); -+ release_memory_resource(res); -+ return NULL; -+ } -+ } -+#endif -+ - return res; - } - -diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c -index 524c22146429..44367783f07a 100644 ---- a/drivers/xen/events/events_base.c -+++ b/drivers/xen/events/events_base.c -@@ -484,9 +484,19 @@ static void eoi_pirq(struct irq_data *data) - struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) }; - int rc = 0; - -- irq_move_irq(data); -+ if (!VALID_EVTCHN(evtchn)) -+ return; - -- if (VALID_EVTCHN(evtchn)) -+ if (unlikely(irqd_is_setaffinity_pending(data))) { -+ int masked = test_and_set_mask(evtchn); -+ -+ clear_evtchn(evtchn); -+ -+ irq_move_masked_irq(data); -+ -+ if (!masked) -+ unmask_evtchn(evtchn); -+ } else - clear_evtchn(evtchn); - - if (pirq_needs_eoi(data->irq)) { -@@ -1357,9 +1367,19 @@ static void ack_dynirq(struct irq_data *data) - { - int evtchn = evtchn_from_irq(data->irq); - -- irq_move_irq(data); -+ if (!VALID_EVTCHN(evtchn)) -+ return; - -- if (VALID_EVTCHN(evtchn)) -+ if (unlikely(irqd_is_setaffinity_pending(data))) { -+ int masked = test_and_set_mask(evtchn); -+ -+ clear_evtchn(evtchn); -+ -+ irq_move_masked_irq(data); -+ -+ if (!masked) -+ unmask_evtchn(evtchn); -+ } else - clear_evtchn(evtchn); - } - -diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c -index 38272ad24551..f4edd6df3df2 100644 ---- a/drivers/xen/evtchn.c -+++ b/drivers/xen/evtchn.c -@@ -316,7 +316,6 @@ static int evtchn_resize_ring(struct per_user_data *u) - { - unsigned int new_size; - evtchn_port_t *new_ring, *old_ring; -- unsigned int p, c; - - /* - * Ensure the ring is large enough to capture all possible -@@ -346,20 +345,17 @@ static int evtchn_resize_ring(struct per_user_data *u) - /* - * Copy the old ring contents to the new ring. - * -- * If the ring contents crosses the end of the current ring, -- * it needs to be copied in two chunks. -+ * To take care of wrapping, a full ring, and the new index -+ * pointing into the second half, simply copy the old contents -+ * twice. - * - * +---------+ +------------------+ -- * |34567 12| -> | 1234567 | -- * +-----p-c-+ +------------------+ -+ * |34567 12| -> |34567 1234567 12| -+ * +-----p-c-+ +-------c------p---+ - */ -- p = evtchn_ring_offset(u, u->ring_prod); -- c = evtchn_ring_offset(u, u->ring_cons); -- if (p < c) { -- memcpy(new_ring + c, u->ring + c, (u->ring_size - c) * sizeof(*u->ring)); -- memcpy(new_ring + u->ring_size, u->ring, p * sizeof(*u->ring)); -- } else -- memcpy(new_ring + c, u->ring + c, (p - c) * sizeof(*u->ring)); -+ memcpy(new_ring, old_ring, u->ring_size * sizeof(*u->ring)); -+ memcpy(new_ring + u->ring_size, old_ring, -+ u->ring_size * sizeof(*u->ring)); - - u->ring = new_ring; - u->ring_size = new_size; -diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index 769e0ff1b4ce..dea6486a7508 100644 ---- a/fs/btrfs/ctree.c -+++ b/fs/btrfs/ctree.c -@@ -19,6 +19,7 @@ - #include - #include - #include -+#include - #include "ctree.h" - #include "disk-io.h" - #include "transaction.h" -@@ -5361,10 +5362,13 @@ int btrfs_compare_trees(struct btrfs_root *left_root, - goto out; - } - -- tmp_buf = kmalloc(left_root->nodesize, GFP_NOFS); -+ tmp_buf = kmalloc(left_root->nodesize, GFP_KERNEL | __GFP_NOWARN); - if (!tmp_buf) { -- ret = -ENOMEM; -- goto out; -+ tmp_buf = vmalloc(left_root->nodesize); -+ if (!tmp_buf) { -+ ret = -ENOMEM; -+ goto out; -+ } - } - - left_path->search_commit_root = 1; -@@ -5565,7 +5569,7 @@ int btrfs_compare_trees(struct btrfs_root *left_root, - out: - btrfs_free_path(left_path); - btrfs_free_path(right_path); -- kfree(tmp_buf); -+ kvfree(tmp_buf); - return ret; - } - -diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h -index bfe4a337fb4d..6661ad8b4088 100644 ---- a/fs/btrfs/ctree.h -+++ b/fs/btrfs/ctree.h -@@ -2252,7 +2252,7 @@ struct btrfs_ioctl_defrag_range_args { - #define BTRFS_MOUNT_FREE_SPACE_TREE (1 << 26) - - #define BTRFS_DEFAULT_COMMIT_INTERVAL (30) --#define BTRFS_DEFAULT_MAX_INLINE (8192) -+#define BTRFS_DEFAULT_MAX_INLINE (2048) - - #define btrfs_clear_opt(o, opt) ((o) &= ~BTRFS_MOUNT_##opt) - #define btrfs_set_opt(o, opt) ((o) |= BTRFS_MOUNT_##opt) -diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c -index cbb7dbfb3fff..218f51a5dbab 100644 ---- a/fs/btrfs/dev-replace.c -+++ b/fs/btrfs/dev-replace.c -@@ -394,6 +394,8 @@ int btrfs_dev_replace_start(struct btrfs_root *root, - dev_replace->cursor_right = 0; - dev_replace->is_valid = 1; - dev_replace->item_needs_writeback = 1; -+ atomic64_set(&dev_replace->num_write_errors, 0); -+ atomic64_set(&dev_replace->num_uncorrectable_read_errors, 0); - args->result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NO_ERROR; - btrfs_dev_replace_unlock(dev_replace); - -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 4545e2e2ad45..ae6e3e36fdf0 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -303,7 +303,7 @@ static int csum_tree_block(struct btrfs_fs_info *fs_info, - err = map_private_extent_buffer(buf, offset, 32, - &kaddr, &map_start, &map_len); - if (err) -- return 1; -+ return err; - cur_len = min(len, map_len - (offset - map_start)); - crc = btrfs_csum_data(kaddr + offset - map_start, - crc, cur_len); -@@ -313,7 +313,7 @@ static int csum_tree_block(struct btrfs_fs_info *fs_info, - if (csum_size > sizeof(inline_result)) { - result = kzalloc(csum_size, GFP_NOFS); - if (!result) -- return 1; -+ return -ENOMEM; - } else { - result = (char *)&inline_result; - } -@@ -334,7 +334,7 @@ static int csum_tree_block(struct btrfs_fs_info *fs_info, - val, found, btrfs_header_level(buf)); - if (result != (char *)&inline_result) - kfree(result); -- return 1; -+ return -EUCLEAN; - } - } else { - write_extent_buffer(buf, result, 0, csum_size); -@@ -513,11 +513,21 @@ static int csum_dirty_buffer(struct btrfs_fs_info *fs_info, struct page *page) - eb = (struct extent_buffer *)page->private; - if (page != eb->pages[0]) - return 0; -+ - found_start = btrfs_header_bytenr(eb); -- if (WARN_ON(found_start != start || !PageUptodate(page))) -- return 0; -- csum_tree_block(fs_info, eb, 0); -- return 0; -+ /* -+ * Please do not consolidate these warnings into a single if. -+ * It is useful to know what went wrong. -+ */ -+ if (WARN_ON(found_start != start)) -+ return -EUCLEAN; -+ if (WARN_ON(!PageUptodate(page))) -+ return -EUCLEAN; -+ -+ ASSERT(memcmp_extent_buffer(eb, fs_info->fsid, -+ btrfs_header_fsid(), BTRFS_FSID_SIZE) == 0); -+ -+ return csum_tree_block(fs_info, eb, 0); - } - - static int check_tree_block_fsid(struct btrfs_fs_info *fs_info, -@@ -660,10 +670,8 @@ static int btree_readpage_end_io_hook(struct btrfs_io_bio *io_bio, - eb, found_level); - - ret = csum_tree_block(root->fs_info, eb, 1); -- if (ret) { -- ret = -EIO; -+ if (ret) - goto err; -- } - - /* - * If this is a leaf block and it is corrupt, set the corrupt bit so -@@ -1830,7 +1838,7 @@ static int cleaner_kthread(void *arg) - */ - btrfs_delete_unused_bgs(root->fs_info); - sleep: -- if (!try_to_freeze() && !again) { -+ if (!again) { - set_current_state(TASK_INTERRUPTIBLE); - if (!kthread_should_stop()) - schedule(); -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index 098bb8f690c9..5d956b869e03 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -1883,7 +1883,7 @@ static int start_ordered_ops(struct inode *inode, loff_t start, loff_t end) - */ - int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) - { -- struct dentry *dentry = file->f_path.dentry; -+ struct dentry *dentry = file_dentry(file); - struct inode *inode = d_inode(dentry); - struct btrfs_root *root = BTRFS_I(inode)->root; - struct btrfs_trans_handle *trans; -@@ -1996,10 +1996,11 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) - */ - smp_mb(); - if (btrfs_inode_in_log(inode, root->fs_info->generation) || -- (BTRFS_I(inode)->last_trans <= -- root->fs_info->last_trans_committed && -- (full_sync || -- !btrfs_have_ordered_extents_in_range(inode, start, len)))) { -+ (full_sync && BTRFS_I(inode)->last_trans <= -+ root->fs_info->last_trans_committed) || -+ (!btrfs_have_ordered_extents_in_range(inode, start, len) && -+ BTRFS_I(inode)->last_trans -+ <= root->fs_info->last_trans_committed)) { - /* - * We'v had everything committed since the last time we were - * modified so clear this flag in case it was set for whatever -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index d96f5cf38a2d..f407e487c687 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -4211,11 +4211,20 @@ static int truncate_space_check(struct btrfs_trans_handle *trans, - { - int ret; - -+ /* -+ * This is only used to apply pressure to the enospc system, we don't -+ * intend to use this reservation at all. -+ */ - bytes_deleted = btrfs_csum_bytes_to_leaves(root, bytes_deleted); -+ bytes_deleted *= root->nodesize; - ret = btrfs_block_rsv_add(root, &root->fs_info->trans_block_rsv, - bytes_deleted, BTRFS_RESERVE_NO_FLUSH); -- if (!ret) -+ if (!ret) { -+ trace_btrfs_space_reservation(root->fs_info, "transaction", -+ trans->transid, -+ bytes_deleted, 1); - trans->bytes_reserved += bytes_deleted; -+ } - return ret; - - } -@@ -7414,7 +7423,26 @@ static int lock_extent_direct(struct inode *inode, u64 lockstart, u64 lockend, - cached_state, GFP_NOFS); - - if (ordered) { -- btrfs_start_ordered_extent(inode, ordered, 1); -+ /* -+ * If we are doing a DIO read and the ordered extent we -+ * found is for a buffered write, we can not wait for it -+ * to complete and retry, because if we do so we can -+ * deadlock with concurrent buffered writes on page -+ * locks. This happens only if our DIO read covers more -+ * than one extent map, if at this point has already -+ * created an ordered extent for a previous extent map -+ * and locked its range in the inode's io tree, and a -+ * concurrent write against that previous extent map's -+ * range and this range started (we unlock the ranges -+ * in the io tree only when the bios complete and -+ * buffered writes always lock pages before attempting -+ * to lock range in the io tree). -+ */ -+ if (writing || -+ test_bit(BTRFS_ORDERED_DIRECT, &ordered->flags)) -+ btrfs_start_ordered_extent(inode, ordered, 1); -+ else -+ ret = -ENOTBLK; - btrfs_put_ordered_extent(ordered); - } else { - /* -@@ -7431,9 +7459,11 @@ static int lock_extent_direct(struct inode *inode, u64 lockstart, u64 lockend, - * that page. - */ - ret = -ENOTBLK; -- break; - } - -+ if (ret) -+ break; -+ - cond_resched(); - } - -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 48aee9846329..e3791f268489 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -59,6 +59,7 @@ - #include "props.h" - #include "sysfs.h" - #include "qgroup.h" -+#include "tree-log.h" - - #ifdef CONFIG_64BIT - /* If we have a 32-bit userspace and 64-bit kernel, then the UAPI -@@ -1656,7 +1657,7 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file, - - src_inode = file_inode(src.file); - if (src_inode->i_sb != file_inode(file)->i_sb) { -- btrfs_info(BTRFS_I(src_inode)->root->fs_info, -+ btrfs_info(BTRFS_I(file_inode(file))->root->fs_info, - "Snapshot src from another FS"); - ret = -EXDEV; - } else if (!inode_owner_or_capable(src_inode)) { -@@ -2097,8 +2098,6 @@ static noinline int search_ioctl(struct inode *inode, - key.offset = (u64)-1; - root = btrfs_read_fs_root_no_name(info, &key); - if (IS_ERR(root)) { -- btrfs_err(info, "could not find root %llu", -- sk->tree_id); - btrfs_free_path(path); - return -ENOENT; - } -@@ -2476,6 +2475,8 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file, - trans->block_rsv = &block_rsv; - trans->bytes_reserved = block_rsv.size; - -+ btrfs_record_snapshot_destroy(trans, dir); -+ - ret = btrfs_unlink_subvol(trans, root, dir, - dest->root_key.objectid, - dentry->d_name.name, -@@ -3068,6 +3069,9 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen, - ret = extent_same_check_offsets(src, loff, &len, olen); - if (ret) - goto out_unlock; -+ ret = extent_same_check_offsets(src, dst_loff, &len, olen); -+ if (ret) -+ goto out_unlock; - - /* - * Single inode case wants the same checks, except we -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index 5279fdae7142..7173360eea7a 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -1842,8 +1842,10 @@ out: - } - - /* -- * copy the acounting information between qgroups. This is necessary when a -- * snapshot or a subvolume is created -+ * Copy the acounting information between qgroups. This is necessary -+ * when a snapshot or a subvolume is created. Throwing an error will -+ * cause a transaction abort so we take extra care here to only error -+ * when a readonly fs is a reasonable outcome. - */ - int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, - struct btrfs_fs_info *fs_info, u64 srcid, u64 objectid, -@@ -1873,15 +1875,15 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, - 2 * inherit->num_excl_copies; - for (i = 0; i < nums; ++i) { - srcgroup = find_qgroup_rb(fs_info, *i_qgroups); -- if (!srcgroup) { -- ret = -EINVAL; -- goto out; -- } - -- if ((srcgroup->qgroupid >> 48) <= (objectid >> 48)) { -- ret = -EINVAL; -- goto out; -- } -+ /* -+ * Zero out invalid groups so we can ignore -+ * them later. -+ */ -+ if (!srcgroup || -+ ((srcgroup->qgroupid >> 48) <= (objectid >> 48))) -+ *i_qgroups = 0ULL; -+ - ++i_qgroups; - } - } -@@ -1916,17 +1918,19 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, - */ - if (inherit) { - i_qgroups = (u64 *)(inherit + 1); -- for (i = 0; i < inherit->num_qgroups; ++i) { -+ for (i = 0; i < inherit->num_qgroups; ++i, ++i_qgroups) { -+ if (*i_qgroups == 0) -+ continue; - ret = add_qgroup_relation_item(trans, quota_root, - objectid, *i_qgroups); -- if (ret) -+ if (ret && ret != -EEXIST) - goto out; - ret = add_qgroup_relation_item(trans, quota_root, - *i_qgroups, objectid); -- if (ret) -+ if (ret && ret != -EEXIST) - goto out; -- ++i_qgroups; - } -+ ret = 0; - } - - -@@ -1987,17 +1991,22 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, - - i_qgroups = (u64 *)(inherit + 1); - for (i = 0; i < inherit->num_qgroups; ++i) { -- ret = add_relation_rb(quota_root->fs_info, objectid, -- *i_qgroups); -- if (ret) -- goto unlock; -+ if (*i_qgroups) { -+ ret = add_relation_rb(quota_root->fs_info, objectid, -+ *i_qgroups); -+ if (ret) -+ goto unlock; -+ } - ++i_qgroups; - } - -- for (i = 0; i < inherit->num_ref_copies; ++i) { -+ for (i = 0; i < inherit->num_ref_copies; ++i, i_qgroups += 2) { - struct btrfs_qgroup *src; - struct btrfs_qgroup *dst; - -+ if (!i_qgroups[0] || !i_qgroups[1]) -+ continue; -+ - src = find_qgroup_rb(fs_info, i_qgroups[0]); - dst = find_qgroup_rb(fs_info, i_qgroups[1]); - -@@ -2008,12 +2017,14 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, - - dst->rfer = src->rfer - level_size; - dst->rfer_cmpr = src->rfer_cmpr - level_size; -- i_qgroups += 2; - } -- for (i = 0; i < inherit->num_excl_copies; ++i) { -+ for (i = 0; i < inherit->num_excl_copies; ++i, i_qgroups += 2) { - struct btrfs_qgroup *src; - struct btrfs_qgroup *dst; - -+ if (!i_qgroups[0] || !i_qgroups[1]) -+ continue; -+ - src = find_qgroup_rb(fs_info, i_qgroups[0]); - dst = find_qgroup_rb(fs_info, i_qgroups[1]); - -@@ -2024,7 +2035,6 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, - - dst->excl = src->excl + level_size; - dst->excl_cmpr = src->excl_cmpr + level_size; -- i_qgroups += 2; - } - - unlock: -diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c -index 619f92963e27..49b3fb73ffbf 100644 ---- a/fs/btrfs/reada.c -+++ b/fs/btrfs/reada.c -@@ -265,7 +265,7 @@ static struct reada_zone *reada_find_zone(struct btrfs_fs_info *fs_info, - spin_unlock(&fs_info->reada_lock); - - if (ret == 1) { -- if (logical >= zone->start && logical < zone->end) -+ if (logical >= zone->start && logical <= zone->end) - return zone; - spin_lock(&fs_info->reada_lock); - kref_put(&zone->refcnt, reada_zone_release); -@@ -679,7 +679,7 @@ static int reada_start_machine_dev(struct btrfs_fs_info *fs_info, - */ - ret = radix_tree_gang_lookup(&dev->reada_extents, (void **)&re, - dev->reada_next >> PAGE_CACHE_SHIFT, 1); -- if (ret == 0 || re->logical >= dev->reada_curr_zone->end) { -+ if (ret == 0 || re->logical > dev->reada_curr_zone->end) { - ret = reada_pick_zone(dev); - if (!ret) { - spin_unlock(&fs_info->reada_lock); -diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c -index 2bd0011450df..5c806f0d443d 100644 ---- a/fs/btrfs/relocation.c -+++ b/fs/btrfs/relocation.c -@@ -1850,6 +1850,7 @@ again: - eb = read_tree_block(dest, old_bytenr, old_ptr_gen); - if (IS_ERR(eb)) { - ret = PTR_ERR(eb); -+ break; - } else if (!extent_buffer_uptodate(eb)) { - ret = -EIO; - free_extent_buffer(eb); -diff --git a/fs/btrfs/tests/btrfs-tests.c b/fs/btrfs/tests/btrfs-tests.c -index 0e1e61a7ec23..d39f714dabeb 100644 ---- a/fs/btrfs/tests/btrfs-tests.c -+++ b/fs/btrfs/tests/btrfs-tests.c -@@ -189,12 +189,6 @@ btrfs_alloc_dummy_block_group(unsigned long length) - kfree(cache); - return NULL; - } -- cache->fs_info = btrfs_alloc_dummy_fs_info(); -- if (!cache->fs_info) { -- kfree(cache->free_space_ctl); -- kfree(cache); -- return NULL; -- } - - cache->key.objectid = 0; - cache->key.offset = length; -diff --git a/fs/btrfs/tests/free-space-tree-tests.c b/fs/btrfs/tests/free-space-tree-tests.c -index d05fe1ab4808..7cea4462acd5 100644 ---- a/fs/btrfs/tests/free-space-tree-tests.c -+++ b/fs/btrfs/tests/free-space-tree-tests.c -@@ -485,6 +485,7 @@ static int run_test(test_func_t test_func, int bitmaps) - cache->bitmap_low_thresh = 0; - cache->bitmap_high_thresh = (u32)-1; - cache->needs_free_space = 1; -+ cache->fs_info = root->fs_info; - - btrfs_init_dummy_trans(&trans); - -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 978c3a810893..58ae0a2ce65c 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -4414,6 +4414,127 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans, - return ret; - } - -+/* -+ * When we are logging a new inode X, check if it doesn't have a reference that -+ * matches the reference from some other inode Y created in a past transaction -+ * and that was renamed in the current transaction. If we don't do this, then at -+ * log replay time we can lose inode Y (and all its files if it's a directory): -+ * -+ * mkdir /mnt/x -+ * echo "hello world" > /mnt/x/foobar -+ * sync -+ * mv /mnt/x /mnt/y -+ * mkdir /mnt/x # or touch /mnt/x -+ * xfs_io -c fsync /mnt/x -+ * -+ * mount fs, trigger log replay -+ * -+ * After the log replay procedure, we would lose the first directory and all its -+ * files (file foobar). -+ * For the case where inode Y is not a directory we simply end up losing it: -+ * -+ * echo "123" > /mnt/foo -+ * sync -+ * mv /mnt/foo /mnt/bar -+ * echo "abc" > /mnt/foo -+ * xfs_io -c fsync /mnt/foo -+ * -+ * -+ * We also need this for cases where a snapshot entry is replaced by some other -+ * entry (file or directory) otherwise we end up with an unreplayable log due to -+ * attempts to delete the snapshot entry (entry of type BTRFS_ROOT_ITEM_KEY) as -+ * if it were a regular entry: -+ * -+ * mkdir /mnt/x -+ * btrfs subvolume snapshot /mnt /mnt/x/snap -+ * btrfs subvolume delete /mnt/x/snap -+ * rmdir /mnt/x -+ * mkdir /mnt/x -+ * fsync /mnt/x or fsync some new file inside it -+ * -+ * -+ * The snapshot delete, rmdir of x, mkdir of a new x and the fsync all happen in -+ * the same transaction. -+ */ -+static int btrfs_check_ref_name_override(struct extent_buffer *eb, -+ const int slot, -+ const struct btrfs_key *key, -+ struct inode *inode) -+{ -+ int ret; -+ struct btrfs_path *search_path; -+ char *name = NULL; -+ u32 name_len = 0; -+ u32 item_size = btrfs_item_size_nr(eb, slot); -+ u32 cur_offset = 0; -+ unsigned long ptr = btrfs_item_ptr_offset(eb, slot); -+ -+ search_path = btrfs_alloc_path(); -+ if (!search_path) -+ return -ENOMEM; -+ search_path->search_commit_root = 1; -+ search_path->skip_locking = 1; -+ -+ while (cur_offset < item_size) { -+ u64 parent; -+ u32 this_name_len; -+ u32 this_len; -+ unsigned long name_ptr; -+ struct btrfs_dir_item *di; -+ -+ if (key->type == BTRFS_INODE_REF_KEY) { -+ struct btrfs_inode_ref *iref; -+ -+ iref = (struct btrfs_inode_ref *)(ptr + cur_offset); -+ parent = key->offset; -+ this_name_len = btrfs_inode_ref_name_len(eb, iref); -+ name_ptr = (unsigned long)(iref + 1); -+ this_len = sizeof(*iref) + this_name_len; -+ } else { -+ struct btrfs_inode_extref *extref; -+ -+ extref = (struct btrfs_inode_extref *)(ptr + -+ cur_offset); -+ parent = btrfs_inode_extref_parent(eb, extref); -+ this_name_len = btrfs_inode_extref_name_len(eb, extref); -+ name_ptr = (unsigned long)&extref->name; -+ this_len = sizeof(*extref) + this_name_len; -+ } -+ -+ if (this_name_len > name_len) { -+ char *new_name; -+ -+ new_name = krealloc(name, this_name_len, GFP_NOFS); -+ if (!new_name) { -+ ret = -ENOMEM; -+ goto out; -+ } -+ name_len = this_name_len; -+ name = new_name; -+ } -+ -+ read_extent_buffer(eb, name, name_ptr, this_name_len); -+ di = btrfs_lookup_dir_item(NULL, BTRFS_I(inode)->root, -+ search_path, parent, -+ name, this_name_len, 0); -+ if (di && !IS_ERR(di)) { -+ ret = 1; -+ goto out; -+ } else if (IS_ERR(di)) { -+ ret = PTR_ERR(di); -+ goto out; -+ } -+ btrfs_release_path(search_path); -+ -+ cur_offset += this_len; -+ } -+ ret = 0; -+out: -+ btrfs_free_path(search_path); -+ kfree(name); -+ return ret; -+} -+ - /* log a single inode in the tree log. - * At least one parent directory for this inode must exist in the tree - * or be logged already. -@@ -4500,7 +4621,22 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans, - - mutex_lock(&BTRFS_I(inode)->log_mutex); - -- btrfs_get_logged_extents(inode, &logged_list, start, end); -+ /* -+ * Collect ordered extents only if we are logging data. This is to -+ * ensure a subsequent request to log this inode in LOG_INODE_ALL mode -+ * will process the ordered extents if they still exists at the time, -+ * because when we collect them we test and set for the flag -+ * BTRFS_ORDERED_LOGGED to prevent multiple log requests to process the -+ * same ordered extents. The consequence for the LOG_INODE_ALL log mode -+ * not processing the ordered extents is that we end up logging the -+ * corresponding file extent items, based on the extent maps in the -+ * inode's extent_map_tree's modified_list, without logging the -+ * respective checksums (since the may still be only attached to the -+ * ordered extents and have not been inserted in the csum tree by -+ * btrfs_finish_ordered_io() yet). -+ */ -+ if (inode_only == LOG_INODE_ALL) -+ btrfs_get_logged_extents(inode, &logged_list, start, end); - - /* - * a brute force approach to making sure we get the most uptodate -@@ -4586,6 +4722,22 @@ again: - if (min_key.type == BTRFS_INODE_ITEM_KEY) - need_log_inode_item = false; - -+ if ((min_key.type == BTRFS_INODE_REF_KEY || -+ min_key.type == BTRFS_INODE_EXTREF_KEY) && -+ BTRFS_I(inode)->generation == trans->transid) { -+ ret = btrfs_check_ref_name_override(path->nodes[0], -+ path->slots[0], -+ &min_key, inode); -+ if (ret < 0) { -+ err = ret; -+ goto out_unlock; -+ } else if (ret > 0) { -+ err = 1; -+ btrfs_set_log_full_commit(root->fs_info, trans); -+ goto out_unlock; -+ } -+ } -+ - /* Skip xattrs, we log them later with btrfs_log_all_xattrs() */ - if (min_key.type == BTRFS_XATTR_ITEM_KEY) { - if (ins_nr == 0) -@@ -4772,6 +4924,42 @@ out_unlock: - } - - /* -+ * Check if we must fallback to a transaction commit when logging an inode. -+ * This must be called after logging the inode and is used only in the context -+ * when fsyncing an inode requires the need to log some other inode - in which -+ * case we can't lock the i_mutex of each other inode we need to log as that -+ * can lead to deadlocks with concurrent fsync against other inodes (as we can -+ * log inodes up or down in the hierarchy) or rename operations for example. So -+ * we take the log_mutex of the inode after we have logged it and then check for -+ * its last_unlink_trans value - this is safe because any task setting -+ * last_unlink_trans must take the log_mutex and it must do this before it does -+ * the actual unlink operation, so if we do this check before a concurrent task -+ * sets last_unlink_trans it means we've logged a consistent version/state of -+ * all the inode items, otherwise we are not sure and must do a transaction -+ * commit (the concurrent task migth have only updated last_unlink_trans before -+ * we logged the inode or it might have also done the unlink). -+ */ -+static bool btrfs_must_commit_transaction(struct btrfs_trans_handle *trans, -+ struct inode *inode) -+{ -+ struct btrfs_fs_info *fs_info = BTRFS_I(inode)->root->fs_info; -+ bool ret = false; -+ -+ mutex_lock(&BTRFS_I(inode)->log_mutex); -+ if (BTRFS_I(inode)->last_unlink_trans > fs_info->last_trans_committed) { -+ /* -+ * Make sure any commits to the log are forced to be full -+ * commits. -+ */ -+ btrfs_set_log_full_commit(fs_info, trans); -+ ret = true; -+ } -+ mutex_unlock(&BTRFS_I(inode)->log_mutex); -+ -+ return ret; -+} -+ -+/* - * follow the dentry parent pointers up the chain and see if any - * of the directories in it require a full commit before they can - * be logged. Returns zero if nothing special needs to be done or 1 if -@@ -4784,7 +4972,6 @@ static noinline int check_parent_dirs_for_sync(struct btrfs_trans_handle *trans, - u64 last_committed) - { - int ret = 0; -- struct btrfs_root *root; - struct dentry *old_parent = NULL; - struct inode *orig_inode = inode; - -@@ -4816,14 +5003,7 @@ static noinline int check_parent_dirs_for_sync(struct btrfs_trans_handle *trans, - BTRFS_I(inode)->logged_trans = trans->transid; - smp_mb(); - -- if (BTRFS_I(inode)->last_unlink_trans > last_committed) { -- root = BTRFS_I(inode)->root; -- -- /* -- * make sure any commits to the log are forced -- * to be full commits -- */ -- btrfs_set_log_full_commit(root->fs_info, trans); -+ if (btrfs_must_commit_transaction(trans, inode)) { - ret = 1; - break; - } -@@ -4982,6 +5162,9 @@ process_leaf: - btrfs_release_path(path); - ret = btrfs_log_inode(trans, root, di_inode, - log_mode, 0, LLONG_MAX, ctx); -+ if (!ret && -+ btrfs_must_commit_transaction(trans, di_inode)) -+ ret = 1; - iput(di_inode); - if (ret) - goto next_dir_inode; -@@ -5096,6 +5279,9 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans, - - ret = btrfs_log_inode(trans, root, dir_inode, - LOG_INODE_ALL, 0, LLONG_MAX, ctx); -+ if (!ret && -+ btrfs_must_commit_transaction(trans, dir_inode)) -+ ret = 1; - iput(dir_inode); - if (ret) - goto out; -@@ -5447,6 +5633,9 @@ error: - * They revolve around files there were unlinked from the directory, and - * this function updates the parent directory so that a full commit is - * properly done if it is fsync'd later after the unlinks are done. -+ * -+ * Must be called before the unlink operations (updates to the subvolume tree, -+ * inodes, etc) are done. - */ - void btrfs_record_unlink_dir(struct btrfs_trans_handle *trans, - struct inode *dir, struct inode *inode, -@@ -5462,8 +5651,11 @@ void btrfs_record_unlink_dir(struct btrfs_trans_handle *trans, - * into the file. When the file is logged we check it and - * don't log the parents if the file is fully on disk. - */ -- if (S_ISREG(inode->i_mode)) -+ if (S_ISREG(inode->i_mode)) { -+ mutex_lock(&BTRFS_I(inode)->log_mutex); - BTRFS_I(inode)->last_unlink_trans = trans->transid; -+ mutex_unlock(&BTRFS_I(inode)->log_mutex); -+ } - - /* - * if this directory was already logged any new -@@ -5494,7 +5686,29 @@ void btrfs_record_unlink_dir(struct btrfs_trans_handle *trans, - return; - - record: -+ mutex_lock(&BTRFS_I(dir)->log_mutex); - BTRFS_I(dir)->last_unlink_trans = trans->transid; -+ mutex_unlock(&BTRFS_I(dir)->log_mutex); -+} -+ -+/* -+ * Make sure that if someone attempts to fsync the parent directory of a deleted -+ * snapshot, it ends up triggering a transaction commit. This is to guarantee -+ * that after replaying the log tree of the parent directory's root we will not -+ * see the snapshot anymore and at log replay time we will not see any log tree -+ * corresponding to the deleted snapshot's root, which could lead to replaying -+ * it after replaying the log tree of the parent directory (which would replay -+ * the snapshot delete operation). -+ * -+ * Must be called before the actual snapshot destroy operation (updates to the -+ * parent root and tree of tree roots trees, etc) are done. -+ */ -+void btrfs_record_snapshot_destroy(struct btrfs_trans_handle *trans, -+ struct inode *dir) -+{ -+ mutex_lock(&BTRFS_I(dir)->log_mutex); -+ BTRFS_I(dir)->last_unlink_trans = trans->transid; -+ mutex_unlock(&BTRFS_I(dir)->log_mutex); - } - - /* -diff --git a/fs/btrfs/tree-log.h b/fs/btrfs/tree-log.h -index 6916a781ea02..a9f1b75d080d 100644 ---- a/fs/btrfs/tree-log.h -+++ b/fs/btrfs/tree-log.h -@@ -79,6 +79,8 @@ int btrfs_pin_log_trans(struct btrfs_root *root); - void btrfs_record_unlink_dir(struct btrfs_trans_handle *trans, - struct inode *dir, struct inode *inode, - int for_rename); -+void btrfs_record_snapshot_destroy(struct btrfs_trans_handle *trans, -+ struct inode *dir); - int btrfs_log_new_name(struct btrfs_trans_handle *trans, - struct inode *inode, struct inode *old_dir, - struct dentry *parent); -diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c -index 59727e32ed0f..af0ec2d5ad0e 100644 ---- a/fs/cifs/sess.c -+++ b/fs/cifs/sess.c -@@ -400,19 +400,27 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer, - sec_blob->LmChallengeResponse.MaximumLength = 0; - - sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer); -- rc = setup_ntlmv2_rsp(ses, nls_cp); -- if (rc) { -- cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); -- goto setup_ntlmv2_ret; -+ if (ses->user_name != NULL) { -+ rc = setup_ntlmv2_rsp(ses, nls_cp); -+ if (rc) { -+ cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); -+ goto setup_ntlmv2_ret; -+ } -+ memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, -+ ses->auth_key.len - CIFS_SESS_KEY_SIZE); -+ tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; -+ -+ sec_blob->NtChallengeResponse.Length = -+ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); -+ sec_blob->NtChallengeResponse.MaximumLength = -+ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); -+ } else { -+ /* -+ * don't send an NT Response for anonymous access -+ */ -+ sec_blob->NtChallengeResponse.Length = 0; -+ sec_blob->NtChallengeResponse.MaximumLength = 0; - } -- memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, -- ses->auth_key.len - CIFS_SESS_KEY_SIZE); -- tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; -- -- sec_blob->NtChallengeResponse.Length = -- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); -- sec_blob->NtChallengeResponse.MaximumLength = -- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); - - if (ses->domainName == NULL) { - sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer); -@@ -670,20 +678,24 @@ sess_auth_lanman(struct sess_data *sess_data) - - pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE; - -- /* no capabilities flags in old lanman negotiation */ -- pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE); -- -- /* Calculate hash with password and copy into bcc_ptr. -- * Encryption Key (stored as in cryptkey) gets used if the -- * security mode bit in Negottiate Protocol response states -- * to use challenge/response method (i.e. Password bit is 1). -- */ -- rc = calc_lanman_hash(ses->password, ses->server->cryptkey, -- ses->server->sec_mode & SECMODE_PW_ENCRYPT ? -- true : false, lnm_session_key); -- -- memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE); -- bcc_ptr += CIFS_AUTH_RESP_SIZE; -+ if (ses->user_name != NULL) { -+ /* no capabilities flags in old lanman negotiation */ -+ pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE); -+ -+ /* Calculate hash with password and copy into bcc_ptr. -+ * Encryption Key (stored as in cryptkey) gets used if the -+ * security mode bit in Negottiate Protocol response states -+ * to use challenge/response method (i.e. Password bit is 1). -+ */ -+ rc = calc_lanman_hash(ses->password, ses->server->cryptkey, -+ ses->server->sec_mode & SECMODE_PW_ENCRYPT ? -+ true : false, lnm_session_key); -+ -+ memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE); -+ bcc_ptr += CIFS_AUTH_RESP_SIZE; -+ } else { -+ pSMB->old_req.PasswordLength = 0; -+ } - - /* - * can not sign if LANMAN negotiated so no need -@@ -769,26 +781,31 @@ sess_auth_ntlm(struct sess_data *sess_data) - capabilities = cifs_ssetup_hdr(ses, pSMB); - - pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities); -- pSMB->req_no_secext.CaseInsensitivePasswordLength = -- cpu_to_le16(CIFS_AUTH_RESP_SIZE); -- pSMB->req_no_secext.CaseSensitivePasswordLength = -- cpu_to_le16(CIFS_AUTH_RESP_SIZE); -- -- /* calculate ntlm response and session key */ -- rc = setup_ntlm_response(ses, sess_data->nls_cp); -- if (rc) { -- cifs_dbg(VFS, "Error %d during NTLM authentication\n", -- rc); -- goto out; -- } -+ if (ses->user_name != NULL) { -+ pSMB->req_no_secext.CaseInsensitivePasswordLength = -+ cpu_to_le16(CIFS_AUTH_RESP_SIZE); -+ pSMB->req_no_secext.CaseSensitivePasswordLength = -+ cpu_to_le16(CIFS_AUTH_RESP_SIZE); -+ -+ /* calculate ntlm response and session key */ -+ rc = setup_ntlm_response(ses, sess_data->nls_cp); -+ if (rc) { -+ cifs_dbg(VFS, "Error %d during NTLM authentication\n", -+ rc); -+ goto out; -+ } - -- /* copy ntlm response */ -- memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, -- CIFS_AUTH_RESP_SIZE); -- bcc_ptr += CIFS_AUTH_RESP_SIZE; -- memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, -- CIFS_AUTH_RESP_SIZE); -- bcc_ptr += CIFS_AUTH_RESP_SIZE; -+ /* copy ntlm response */ -+ memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, -+ CIFS_AUTH_RESP_SIZE); -+ bcc_ptr += CIFS_AUTH_RESP_SIZE; -+ memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, -+ CIFS_AUTH_RESP_SIZE); -+ bcc_ptr += CIFS_AUTH_RESP_SIZE; -+ } else { -+ pSMB->req_no_secext.CaseInsensitivePasswordLength = 0; -+ pSMB->req_no_secext.CaseSensitivePasswordLength = 0; -+ } - - if (ses->capabilities & CAP_UNICODE) { - /* unicode strings must be word aligned */ -@@ -878,22 +895,26 @@ sess_auth_ntlmv2(struct sess_data *sess_data) - /* LM2 password would be here if we supported it */ - pSMB->req_no_secext.CaseInsensitivePasswordLength = 0; - -- /* calculate nlmv2 response and session key */ -- rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp); -- if (rc) { -- cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc); -- goto out; -- } -+ if (ses->user_name != NULL) { -+ /* calculate nlmv2 response and session key */ -+ rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp); -+ if (rc) { -+ cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc); -+ goto out; -+ } - -- memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, -- ses->auth_key.len - CIFS_SESS_KEY_SIZE); -- bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE; -+ memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, -+ ses->auth_key.len - CIFS_SESS_KEY_SIZE); -+ bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE; - -- /* set case sensitive password length after tilen may get -- * assigned, tilen is 0 otherwise. -- */ -- pSMB->req_no_secext.CaseSensitivePasswordLength = -- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); -+ /* set case sensitive password length after tilen may get -+ * assigned, tilen is 0 otherwise. -+ */ -+ pSMB->req_no_secext.CaseSensitivePasswordLength = -+ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); -+ } else { -+ pSMB->req_no_secext.CaseSensitivePasswordLength = 0; -+ } - - if (ses->capabilities & CAP_UNICODE) { - if (sess_data->iov[0].iov_len % 2) { -diff --git a/fs/cifs/smb2glob.h b/fs/cifs/smb2glob.h -index bc0bb9c34f72..0ffa18094335 100644 ---- a/fs/cifs/smb2glob.h -+++ b/fs/cifs/smb2glob.h -@@ -44,6 +44,7 @@ - #define SMB2_OP_DELETE 7 - #define SMB2_OP_HARDLINK 8 - #define SMB2_OP_SET_EOF 9 -+#define SMB2_OP_RMDIR 10 - - /* Used when constructing chained read requests. */ - #define CHAINED_REQUEST 1 -diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c -index 899bbc86f73e..4f0231e685a9 100644 ---- a/fs/cifs/smb2inode.c -+++ b/fs/cifs/smb2inode.c -@@ -80,6 +80,10 @@ smb2_open_op_close(const unsigned int xid, struct cifs_tcon *tcon, - * SMB2_open() call. - */ - break; -+ case SMB2_OP_RMDIR: -+ tmprc = SMB2_rmdir(xid, tcon, fid.persistent_fid, -+ fid.volatile_fid); -+ break; - case SMB2_OP_RENAME: - tmprc = SMB2_rename(xid, tcon, fid.persistent_fid, - fid.volatile_fid, (__le16 *)data); -@@ -191,8 +195,8 @@ smb2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, const char *name, - struct cifs_sb_info *cifs_sb) - { - return smb2_open_op_close(xid, tcon, cifs_sb, name, DELETE, FILE_OPEN, -- CREATE_NOT_FILE | CREATE_DELETE_ON_CLOSE, -- NULL, SMB2_OP_DELETE); -+ CREATE_NOT_FILE, -+ NULL, SMB2_OP_RMDIR); - } - - int -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index 42e1f440eb1e..8f38e33d365b 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -2575,6 +2575,22 @@ SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon, - } - - int -+SMB2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, -+ u64 persistent_fid, u64 volatile_fid) -+{ -+ __u8 delete_pending = 1; -+ void *data; -+ unsigned int size; -+ -+ data = &delete_pending; -+ size = 1; /* sizeof __u8 */ -+ -+ return send_set_info(xid, tcon, persistent_fid, volatile_fid, -+ current->tgid, FILE_DISPOSITION_INFORMATION, 1, &data, -+ &size); -+} -+ -+int - SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon, - u64 persistent_fid, u64 volatile_fid, __le16 *target_file) - { -diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h -index 4f07dc93608d..eb2cde2f64ba 100644 ---- a/fs/cifs/smb2proto.h -+++ b/fs/cifs/smb2proto.h -@@ -141,6 +141,8 @@ extern int SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, - extern int SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon, - u64 persistent_fid, u64 volatile_fid, - __le16 *target_file); -+extern int SMB2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, -+ u64 persistent_fid, u64 volatile_fid); - extern int SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon, - u64 persistent_fid, u64 volatile_fid, - __le16 *target_file); -diff --git a/fs/coredump.c b/fs/coredump.c -index 9ea87e9fdccf..47c32c3bfa1d 100644 ---- a/fs/coredump.c -+++ b/fs/coredump.c -@@ -32,6 +32,9 @@ - #include - #include - #include -+#include -+#include -+#include - #include - - #include -@@ -649,6 +652,8 @@ void do_coredump(const siginfo_t *siginfo) - } - } else { - struct inode *inode; -+ int open_flags = O_CREAT | O_RDWR | O_NOFOLLOW | -+ O_LARGEFILE | O_EXCL; - - if (cprm.limit < binfmt->min_coredump) - goto fail_unlock; -@@ -687,10 +692,27 @@ void do_coredump(const siginfo_t *siginfo) - * what matters is that at least one of the two processes - * writes its coredump successfully, not which one. - */ -- cprm.file = filp_open(cn.corename, -- O_CREAT | 2 | O_NOFOLLOW | -- O_LARGEFILE | O_EXCL, -- 0600); -+ if (need_suid_safe) { -+ /* -+ * Using user namespaces, normal user tasks can change -+ * their current->fs->root to point to arbitrary -+ * directories. Since the intention of the "only dump -+ * with a fully qualified path" rule is to control where -+ * coredumps may be placed using root privileges, -+ * current->fs->root must not be used. Instead, use the -+ * root directory of init_task. -+ */ -+ struct path root; -+ -+ task_lock(&init_task); -+ get_fs_root(init_task.fs, &root); -+ task_unlock(&init_task); -+ cprm.file = file_open_root(root.dentry, root.mnt, -+ cn.corename, open_flags, 0600); -+ path_put(&root); -+ } else { -+ cprm.file = filp_open(cn.corename, open_flags, 0600); -+ } - if (IS_ERR(cprm.file)) - goto fail_unlock; - -diff --git a/fs/dcache.c b/fs/dcache.c -index 2398f9f94337..7566b2689609 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -1667,7 +1667,8 @@ void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op) - DCACHE_OP_REVALIDATE | - DCACHE_OP_WEAK_REVALIDATE | - DCACHE_OP_DELETE | -- DCACHE_OP_SELECT_INODE)); -+ DCACHE_OP_SELECT_INODE | -+ DCACHE_OP_REAL)); - dentry->d_op = op; - if (!op) - return; -@@ -1685,6 +1686,8 @@ void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op) - dentry->d_flags |= DCACHE_OP_PRUNE; - if (op->d_select_inode) - dentry->d_flags |= DCACHE_OP_SELECT_INODE; -+ if (op->d_real) -+ dentry->d_flags |= DCACHE_OP_REAL; - - } - EXPORT_SYMBOL(d_set_d_op); -diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c -index bece948b363d..8580831ed237 100644 ---- a/fs/debugfs/inode.c -+++ b/fs/debugfs/inode.c -@@ -457,7 +457,7 @@ struct dentry *debugfs_create_automount(const char *name, - if (unlikely(!inode)) - return failed_creating(dentry); - -- inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO; -+ make_empty_dir_inode(inode); - inode->i_flags |= S_AUTOMOUNT; - inode->i_private = data; - dentry->d_fsdata = (void *)f; -diff --git a/fs/ext4/crypto.c b/fs/ext4/crypto.c -index 38f7562489bb..25634c353191 100644 ---- a/fs/ext4/crypto.c -+++ b/fs/ext4/crypto.c -@@ -34,6 +34,7 @@ - #include - #include - #include -+#include - - #include "ext4_extents.h" - #include "xattr.h" -@@ -475,13 +476,19 @@ uint32_t ext4_validate_encryption_key_size(uint32_t mode, uint32_t size) - */ - static int ext4_d_revalidate(struct dentry *dentry, unsigned int flags) - { -- struct inode *dir = d_inode(dentry->d_parent); -- struct ext4_crypt_info *ci = EXT4_I(dir)->i_crypt_info; -+ struct dentry *dir; -+ struct ext4_crypt_info *ci; - int dir_has_key, cached_with_key; - -- if (!ext4_encrypted_inode(dir)) -- return 0; -+ if (flags & LOOKUP_RCU) -+ return -ECHILD; - -+ dir = dget_parent(dentry); -+ if (!ext4_encrypted_inode(d_inode(dir))) { -+ dput(dir); -+ return 0; -+ } -+ ci = EXT4_I(d_inode(dir))->i_crypt_info; - if (ci && ci->ci_keyring_key && - (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) | - (1 << KEY_FLAG_REVOKED) | -@@ -491,6 +498,7 @@ static int ext4_d_revalidate(struct dentry *dentry, unsigned int flags) - /* this should eventually be an flag in d_flags */ - cached_with_key = dentry->d_fsdata != NULL; - dir_has_key = (ci != NULL); -+ dput(dir); - - /* - * If the dentry was cached without the key, and it is a -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 157b458a69d4..b213449a5d1b 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -900,6 +900,29 @@ do { \ - #include "extents_status.h" - - /* -+ * Lock subclasses for i_data_sem in the ext4_inode_info structure. -+ * -+ * These are needed to avoid lockdep false positives when we need to -+ * allocate blocks to the quota inode during ext4_map_blocks(), while -+ * holding i_data_sem for a normal (non-quota) inode. Since we don't -+ * do quota tracking for the quota inode, this avoids deadlock (as -+ * well as infinite recursion, since it isn't turtles all the way -+ * down...) -+ * -+ * I_DATA_SEM_NORMAL - Used for most inodes -+ * I_DATA_SEM_OTHER - Used by move_inode.c for the second normal inode -+ * where the second inode has larger inode number -+ * than the first -+ * I_DATA_SEM_QUOTA - Used for quota inodes only -+ */ -+enum { -+ I_DATA_SEM_NORMAL = 0, -+ I_DATA_SEM_OTHER, -+ I_DATA_SEM_QUOTA, -+}; -+ -+ -+/* - * fourth extended file system inode data in memory - */ - struct ext4_inode_info { -diff --git a/fs/ext4/file.c b/fs/ext4/file.c -index 4cd318f31cbe..38847f38b34a 100644 ---- a/fs/ext4/file.c -+++ b/fs/ext4/file.c -@@ -335,7 +335,7 @@ static int ext4_file_open(struct inode * inode, struct file * filp) - struct super_block *sb = inode->i_sb; - struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); - struct vfsmount *mnt = filp->f_path.mnt; -- struct inode *dir = filp->f_path.dentry->d_parent->d_inode; -+ struct dentry *dir; - struct path path; - char buf[64], *cp; - int ret; -@@ -379,14 +379,18 @@ static int ext4_file_open(struct inode * inode, struct file * filp) - if (ext4_encryption_info(inode) == NULL) - return -ENOKEY; - } -- if (ext4_encrypted_inode(dir) && -- !ext4_is_child_context_consistent_with_parent(dir, inode)) { -+ -+ dir = dget_parent(file_dentry(filp)); -+ if (ext4_encrypted_inode(d_inode(dir)) && -+ !ext4_is_child_context_consistent_with_parent(d_inode(dir), inode)) { - ext4_warning(inode->i_sb, - "Inconsistent encryption contexts: %lu/%lu\n", -- (unsigned long) dir->i_ino, -+ (unsigned long) d_inode(dir)->i_ino, - (unsigned long) inode->i_ino); -+ dput(dir); - return -EPERM; - } -+ dput(dir); - /* - * Set up the jbd2_inode if we are opening the inode for - * writing and the journal is present -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index aee960b1af34..e6218cbc8332 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -5261,6 +5261,8 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode) - might_sleep(); - trace_ext4_mark_inode_dirty(inode, _RET_IP_); - err = ext4_reserve_inode_write(handle, inode, &iloc); -+ if (err) -+ return err; - if (ext4_handle_valid(handle) && - EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize && - !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) { -@@ -5291,9 +5293,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode) - } - } - } -- if (!err) -- err = ext4_mark_iloc_dirty(handle, inode, &iloc); -- return err; -+ return ext4_mark_iloc_dirty(handle, inode, &iloc); - } - - /* -diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c -index 4098acc701c3..796ff0eafd3c 100644 ---- a/fs/ext4/move_extent.c -+++ b/fs/ext4/move_extent.c -@@ -60,10 +60,10 @@ ext4_double_down_write_data_sem(struct inode *first, struct inode *second) - { - if (first < second) { - down_write(&EXT4_I(first)->i_data_sem); -- down_write_nested(&EXT4_I(second)->i_data_sem, SINGLE_DEPTH_NESTING); -+ down_write_nested(&EXT4_I(second)->i_data_sem, I_DATA_SEM_OTHER); - } else { - down_write(&EXT4_I(second)->i_data_sem); -- down_write_nested(&EXT4_I(first)->i_data_sem, SINGLE_DEPTH_NESTING); -+ down_write_nested(&EXT4_I(first)->i_data_sem, I_DATA_SEM_OTHER); - - } - } -@@ -484,6 +484,13 @@ mext_check_arguments(struct inode *orig_inode, - return -EBUSY; - } - -+ if (IS_NOQUOTA(orig_inode) || IS_NOQUOTA(donor_inode)) { -+ ext4_debug("ext4 move extent: The argument files should " -+ "not be quota files [ino:orig %lu, donor %lu]\n", -+ orig_inode->i_ino, donor_inode->i_ino); -+ return -EBUSY; -+ } -+ - /* Ext4 move extent supports only extent based file */ - if (!(ext4_test_inode_flag(orig_inode, EXT4_INODE_EXTENTS))) { - ext4_debug("ext4 move extent: orig file is not extents " -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 3ed01ec011d7..a76ca677fd1a 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -1324,9 +1324,9 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args) - return -1; - } - if (ext4_has_feature_quota(sb)) { -- ext4_msg(sb, KERN_ERR, "Cannot set journaled quota options " -- "when QUOTA feature is enabled"); -- return -1; -+ ext4_msg(sb, KERN_INFO, "Journaled quota options " -+ "ignored when QUOTA feature is enabled"); -+ return 1; - } - qname = match_strdup(args); - if (!qname) { -@@ -1689,10 +1689,10 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token, - return -1; - } - if (ext4_has_feature_quota(sb)) { -- ext4_msg(sb, KERN_ERR, -- "Cannot set journaled quota options " -+ ext4_msg(sb, KERN_INFO, -+ "Quota format mount options ignored " - "when QUOTA feature is enabled"); -- return -1; -+ return 1; - } - sbi->s_jquota_fmt = m->mount_opt; - #endif -@@ -1753,11 +1753,11 @@ static int parse_options(char *options, struct super_block *sb, - #ifdef CONFIG_QUOTA - if (ext4_has_feature_quota(sb) && - (test_opt(sb, USRQUOTA) || test_opt(sb, GRPQUOTA))) { -- ext4_msg(sb, KERN_ERR, "Cannot set quota options when QUOTA " -- "feature is enabled"); -- return 0; -- } -- if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) { -+ ext4_msg(sb, KERN_INFO, "Quota feature enabled, usrquota and grpquota " -+ "mount options ignored."); -+ clear_opt(sb, USRQUOTA); -+ clear_opt(sb, GRPQUOTA); -+ } else if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) { - if (test_opt(sb, USRQUOTA) && sbi->s_qf_names[USRQUOTA]) - clear_opt(sb, USRQUOTA); - -@@ -5021,6 +5021,20 @@ static int ext4_quota_on_mount(struct super_block *sb, int type) - EXT4_SB(sb)->s_jquota_fmt, type); - } - -+static void lockdep_set_quota_inode(struct inode *inode, int subclass) -+{ -+ struct ext4_inode_info *ei = EXT4_I(inode); -+ -+ /* The first argument of lockdep_set_subclass has to be -+ * *exactly* the same as the argument to init_rwsem() --- in -+ * this case, in init_once() --- or lockdep gets unhappy -+ * because the name of the lock is set using the -+ * stringification of the argument to init_rwsem(). -+ */ -+ (void) ei; /* shut up clang warning if !CONFIG_LOCKDEP */ -+ lockdep_set_subclass(&ei->i_data_sem, subclass); -+} -+ - /* - * Standard function to be called on quota_on - */ -@@ -5060,8 +5074,12 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id, - if (err) - return err; - } -- -- return dquot_quota_on(sb, type, format_id, path); -+ lockdep_set_quota_inode(path->dentry->d_inode, I_DATA_SEM_QUOTA); -+ err = dquot_quota_on(sb, type, format_id, path); -+ if (err) -+ lockdep_set_quota_inode(path->dentry->d_inode, -+ I_DATA_SEM_NORMAL); -+ return err; - } - - static int ext4_quota_enable(struct super_block *sb, int type, int format_id, -@@ -5088,8 +5106,11 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id, - - /* Don't account quota for quota files to avoid recursion */ - qf_inode->i_flags |= S_NOQUOTA; -+ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_QUOTA); - err = dquot_enable(qf_inode, type, format_id, flags); - iput(qf_inode); -+ if (err) -+ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_NORMAL); - - return err; - } -diff --git a/fs/f2fs/crypto_policy.c b/fs/f2fs/crypto_policy.c -index d4a96af513c2..596f02490f27 100644 ---- a/fs/f2fs/crypto_policy.c -+++ b/fs/f2fs/crypto_policy.c -@@ -192,7 +192,8 @@ int f2fs_inherit_context(struct inode *parent, struct inode *child, - return res; - - ci = F2FS_I(parent)->i_crypt_info; -- BUG_ON(ci == NULL); -+ if (ci == NULL) -+ return -ENOKEY; - - ctx.format = F2FS_ENCRYPTION_CONTEXT_FORMAT_V1; - -diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c -index 5c06db17e41f..44802599fa67 100644 ---- a/fs/f2fs/data.c -+++ b/fs/f2fs/data.c -@@ -67,7 +67,6 @@ static void f2fs_write_end_io(struct bio *bio) - f2fs_restore_and_release_control_page(&page); - - if (unlikely(bio->bi_error)) { -- set_page_dirty(page); - set_bit(AS_EIO, &page->mapping->flags); - f2fs_stop_checkpoint(sbi); - } -@@ -504,7 +503,7 @@ static int __allocate_data_blocks(struct inode *inode, loff_t offset, - struct dnode_of_data dn; - u64 start = F2FS_BYTES_TO_BLK(offset); - u64 len = F2FS_BYTES_TO_BLK(count); -- bool allocated; -+ bool allocated = false; - u64 end_offset; - int err = 0; - -@@ -546,7 +545,7 @@ static int __allocate_data_blocks(struct inode *inode, loff_t offset, - f2fs_put_dnode(&dn); - f2fs_unlock_op(sbi); - -- f2fs_balance_fs(sbi, dn.node_changed); -+ f2fs_balance_fs(sbi, allocated); - } - return err; - -@@ -556,7 +555,7 @@ sync_out: - f2fs_put_dnode(&dn); - out: - f2fs_unlock_op(sbi); -- f2fs_balance_fs(sbi, dn.node_changed); -+ f2fs_balance_fs(sbi, allocated); - return err; - } - -@@ -650,14 +649,14 @@ get_next: - if (dn.ofs_in_node >= end_offset) { - if (allocated) - sync_inode_page(&dn); -- allocated = false; - f2fs_put_dnode(&dn); - - if (create) { - f2fs_unlock_op(sbi); -- f2fs_balance_fs(sbi, dn.node_changed); -+ f2fs_balance_fs(sbi, allocated); - f2fs_lock_op(sbi); - } -+ allocated = false; - - set_new_dnode(&dn, inode, NULL, NULL, 0); - err = get_dnode_of_data(&dn, pgofs, mode); -@@ -715,7 +714,7 @@ put_out: - unlock_out: - if (create) { - f2fs_unlock_op(sbi); -- f2fs_balance_fs(sbi, dn.node_changed); -+ f2fs_balance_fs(sbi, allocated); - } - out: - trace_f2fs_map_blocks(inode, map, err); -diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c -index faa7495e2d7e..30e6b6563494 100644 ---- a/fs/f2fs/dir.c -+++ b/fs/f2fs/dir.c -@@ -892,11 +892,19 @@ out: - return err; - } - -+static int f2fs_dir_open(struct inode *inode, struct file *filp) -+{ -+ if (f2fs_encrypted_inode(inode)) -+ return f2fs_get_encryption_info(inode) ? -EACCES : 0; -+ return 0; -+} -+ - const struct file_operations f2fs_dir_operations = { - .llseek = generic_file_llseek, - .read = generic_read_dir, - .iterate = f2fs_readdir, - .fsync = f2fs_sync_file, -+ .open = f2fs_dir_open, - .unlocked_ioctl = f2fs_ioctl, - #ifdef CONFIG_COMPAT - .compat_ioctl = f2fs_compat_ioctl, -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index ea272be62677..5a322bc00ac4 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -425,6 +425,8 @@ static int f2fs_file_mmap(struct file *file, struct vm_area_struct *vma) - err = f2fs_get_encryption_info(inode); - if (err) - return 0; -+ if (!f2fs_encrypted_inode(inode)) -+ return -ENOKEY; - } - - /* we don't need to use inline_data strictly */ -@@ -444,7 +446,9 @@ static int f2fs_file_open(struct inode *inode, struct file *filp) - if (!ret && f2fs_encrypted_inode(inode)) { - ret = f2fs_get_encryption_info(inode); - if (ret) -- ret = -EACCES; -+ return -EACCES; -+ if (!f2fs_encrypted_inode(inode)) -+ return -ENOKEY; - } - return ret; - } -diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c -index 6f944e5eb76e..7e9e38769660 100644 ---- a/fs/f2fs/namei.c -+++ b/fs/f2fs/namei.c -@@ -980,12 +980,6 @@ static const char *f2fs_encrypted_get_link(struct dentry *dentry, - } - memcpy(cstr.name, sd->encrypted_path, cstr.len); - -- /* this is broken symlink case */ -- if (unlikely(cstr.name[0] == 0)) { -- res = -ENOENT; -- goto errout; -- } -- - if ((cstr.len + sizeof(struct f2fs_encrypted_symlink_data) - 1) > - max_size) { - /* Symlink data on the disk is corrupted */ -@@ -1002,6 +996,12 @@ static const char *f2fs_encrypted_get_link(struct dentry *dentry, - - kfree(cstr.name); - -+ /* this is broken symlink case */ -+ if (unlikely(pstr.name[0] == 0)) { -+ res = -ENOENT; -+ goto errout; -+ } -+ - paddr = pstr.name; - - /* Null-terminate the name */ -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index 6134832baaaf..013a62b2f8ca 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -926,9 +926,25 @@ static loff_t max_file_blocks(void) - return result; - } - -+static int __f2fs_commit_super(struct buffer_head *bh, -+ struct f2fs_super_block *super) -+{ -+ lock_buffer(bh); -+ if (super) -+ memcpy(bh->b_data + F2FS_SUPER_OFFSET, super, sizeof(*super)); -+ set_buffer_uptodate(bh); -+ set_buffer_dirty(bh); -+ unlock_buffer(bh); -+ -+ /* it's rare case, we can do fua all the time */ -+ return __sync_dirty_buffer(bh, WRITE_FLUSH_FUA); -+} -+ - static inline bool sanity_check_area_boundary(struct super_block *sb, -- struct f2fs_super_block *raw_super) -+ struct buffer_head *bh) - { -+ struct f2fs_super_block *raw_super = (struct f2fs_super_block *) -+ (bh->b_data + F2FS_SUPER_OFFSET); - u32 segment0_blkaddr = le32_to_cpu(raw_super->segment0_blkaddr); - u32 cp_blkaddr = le32_to_cpu(raw_super->cp_blkaddr); - u32 sit_blkaddr = le32_to_cpu(raw_super->sit_blkaddr); -@@ -942,6 +958,10 @@ static inline bool sanity_check_area_boundary(struct super_block *sb, - u32 segment_count_main = le32_to_cpu(raw_super->segment_count_main); - u32 segment_count = le32_to_cpu(raw_super->segment_count); - u32 log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg); -+ u64 main_end_blkaddr = main_blkaddr + -+ (segment_count_main << log_blocks_per_seg); -+ u64 seg_end_blkaddr = segment0_blkaddr + -+ (segment_count << log_blocks_per_seg); - - if (segment0_blkaddr != cp_blkaddr) { - f2fs_msg(sb, KERN_INFO, -@@ -986,22 +1006,45 @@ static inline bool sanity_check_area_boundary(struct super_block *sb, - return true; - } - -- if (main_blkaddr + (segment_count_main << log_blocks_per_seg) != -- segment0_blkaddr + (segment_count << log_blocks_per_seg)) { -+ if (main_end_blkaddr > seg_end_blkaddr) { - f2fs_msg(sb, KERN_INFO, -- "Wrong MAIN_AREA boundary, start(%u) end(%u) blocks(%u)", -+ "Wrong MAIN_AREA boundary, start(%u) end(%u) block(%u)", - main_blkaddr, -- segment0_blkaddr + (segment_count << log_blocks_per_seg), -+ segment0_blkaddr + -+ (segment_count << log_blocks_per_seg), - segment_count_main << log_blocks_per_seg); - return true; -+ } else if (main_end_blkaddr < seg_end_blkaddr) { -+ int err = 0; -+ char *res; -+ -+ /* fix in-memory information all the time */ -+ raw_super->segment_count = cpu_to_le32((main_end_blkaddr - -+ segment0_blkaddr) >> log_blocks_per_seg); -+ -+ if (f2fs_readonly(sb) || bdev_read_only(sb->s_bdev)) { -+ res = "internally"; -+ } else { -+ err = __f2fs_commit_super(bh, NULL); -+ res = err ? "failed" : "done"; -+ } -+ f2fs_msg(sb, KERN_INFO, -+ "Fix alignment : %s, start(%u) end(%u) block(%u)", -+ res, main_blkaddr, -+ segment0_blkaddr + -+ (segment_count << log_blocks_per_seg), -+ segment_count_main << log_blocks_per_seg); -+ if (err) -+ return true; - } -- - return false; - } - - static int sanity_check_raw_super(struct super_block *sb, -- struct f2fs_super_block *raw_super) -+ struct buffer_head *bh) - { -+ struct f2fs_super_block *raw_super = (struct f2fs_super_block *) -+ (bh->b_data + F2FS_SUPER_OFFSET); - unsigned int blocksize; - - if (F2FS_SUPER_MAGIC != le32_to_cpu(raw_super->magic)) { -@@ -1068,7 +1111,7 @@ static int sanity_check_raw_super(struct super_block *sb, - } - - /* check CP/SIT/NAT/SSA/MAIN_AREA area boundary */ -- if (sanity_check_area_boundary(sb, raw_super)) -+ if (sanity_check_area_boundary(sb, bh)) - return 1; - - return 0; -@@ -1134,103 +1177,87 @@ static void init_sb_info(struct f2fs_sb_info *sbi) - - /* - * Read f2fs raw super block. -- * Because we have two copies of super block, so read the first one at first, -- * if the first one is invalid, move to read the second one. -+ * Because we have two copies of super block, so read both of them -+ * to get the first valid one. If any one of them is broken, we pass -+ * them recovery flag back to the caller. - */ - static int read_raw_super_block(struct super_block *sb, - struct f2fs_super_block **raw_super, - int *valid_super_block, int *recovery) - { -- int block = 0; -+ int block; - struct buffer_head *bh; -- struct f2fs_super_block *super, *buf; -+ struct f2fs_super_block *super; - int err = 0; - - super = kzalloc(sizeof(struct f2fs_super_block), GFP_KERNEL); - if (!super) - return -ENOMEM; --retry: -- bh = sb_bread(sb, block); -- if (!bh) { -- *recovery = 1; -- f2fs_msg(sb, KERN_ERR, "Unable to read %dth superblock", -+ -+ for (block = 0; block < 2; block++) { -+ bh = sb_bread(sb, block); -+ if (!bh) { -+ f2fs_msg(sb, KERN_ERR, "Unable to read %dth superblock", - block + 1); -- err = -EIO; -- goto next; -- } -+ err = -EIO; -+ continue; -+ } - -- buf = (struct f2fs_super_block *)(bh->b_data + F2FS_SUPER_OFFSET); -+ /* sanity checking of raw super */ -+ if (sanity_check_raw_super(sb, bh)) { -+ f2fs_msg(sb, KERN_ERR, -+ "Can't find valid F2FS filesystem in %dth superblock", -+ block + 1); -+ err = -EINVAL; -+ brelse(bh); -+ continue; -+ } - -- /* sanity checking of raw super */ -- if (sanity_check_raw_super(sb, buf)) { -+ if (!*raw_super) { -+ memcpy(super, bh->b_data + F2FS_SUPER_OFFSET, -+ sizeof(*super)); -+ *valid_super_block = block; -+ *raw_super = super; -+ } - brelse(bh); -- *recovery = 1; -- f2fs_msg(sb, KERN_ERR, -- "Can't find valid F2FS filesystem in %dth superblock", -- block + 1); -- err = -EINVAL; -- goto next; - } - -- if (!*raw_super) { -- memcpy(super, buf, sizeof(*super)); -- *valid_super_block = block; -- *raw_super = super; -- } -- brelse(bh); -- --next: -- /* check the validity of the second superblock */ -- if (block == 0) { -- block++; -- goto retry; -- } -+ /* Fail to read any one of the superblocks*/ -+ if (err < 0) -+ *recovery = 1; - - /* No valid superblock */ -- if (!*raw_super) { -+ if (!*raw_super) - kfree(super); -- return err; -- } -+ else -+ err = 0; - -- return 0; -+ return err; - } - --static int __f2fs_commit_super(struct f2fs_sb_info *sbi, int block) -+int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover) - { -- struct f2fs_super_block *super = F2FS_RAW_SUPER(sbi); - struct buffer_head *bh; - int err; - -- bh = sb_getblk(sbi->sb, block); -+ /* write back-up superblock first */ -+ bh = sb_getblk(sbi->sb, sbi->valid_super_block ? 0: 1); - if (!bh) - return -EIO; -- -- lock_buffer(bh); -- memcpy(bh->b_data + F2FS_SUPER_OFFSET, super, sizeof(*super)); -- set_buffer_uptodate(bh); -- set_buffer_dirty(bh); -- unlock_buffer(bh); -- -- /* it's rare case, we can do fua all the time */ -- err = __sync_dirty_buffer(bh, WRITE_FLUSH_FUA); -+ err = __f2fs_commit_super(bh, F2FS_RAW_SUPER(sbi)); - brelse(bh); - -- return err; --} -- --int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover) --{ -- int err; -- -- /* write back-up superblock first */ -- err = __f2fs_commit_super(sbi, sbi->valid_super_block ? 0 : 1); -- - /* if we are in recovery path, skip writing valid superblock */ - if (recover || err) - return err; - - /* write current valid superblock */ -- return __f2fs_commit_super(sbi, sbi->valid_super_block); -+ bh = sb_getblk(sbi->sb, sbi->valid_super_block); -+ if (!bh) -+ return -EIO; -+ err = __f2fs_commit_super(bh, F2FS_RAW_SUPER(sbi)); -+ brelse(bh); -+ return err; - } - - static int f2fs_fill_super(struct super_block *sb, void *data, int silent) -diff --git a/fs/fhandle.c b/fs/fhandle.c -index d59712dfa3e7..ca3c3dd01789 100644 ---- a/fs/fhandle.c -+++ b/fs/fhandle.c -@@ -228,7 +228,7 @@ long do_handle_open(int mountdirfd, - path_put(&path); - return fd; - } -- file = file_open_root(path.dentry, path.mnt, "", open_flag); -+ file = file_open_root(path.dentry, path.mnt, "", open_flag, 0); - if (IS_ERR(file)) { - put_unused_fd(fd); - retval = PTR_ERR(file); -diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c -index 5c46ed9f3e14..fee81e8768c9 100644 ---- a/fs/fs-writeback.c -+++ b/fs/fs-writeback.c -@@ -281,13 +281,15 @@ locked_inode_to_wb_and_lock_list(struct inode *inode) - wb_get(wb); - spin_unlock(&inode->i_lock); - spin_lock(&wb->list_lock); -- wb_put(wb); /* not gonna deref it anymore */ - - /* i_wb may have changed inbetween, can't use inode_to_wb() */ -- if (likely(wb == inode->i_wb)) -- return wb; /* @inode already has ref */ -+ if (likely(wb == inode->i_wb)) { -+ wb_put(wb); /* @inode already has ref */ -+ return wb; -+ } - - spin_unlock(&wb->list_lock); -+ wb_put(wb); - cpu_relax(); - spin_lock(&inode->i_lock); - } -@@ -1337,10 +1339,10 @@ __writeback_single_inode(struct inode *inode, struct writeback_control *wbc) - * we go e.g. from filesystem. Flusher thread uses __writeback_single_inode() - * and does more profound writeback list handling in writeback_sb_inodes(). - */ --static int --writeback_single_inode(struct inode *inode, struct bdi_writeback *wb, -- struct writeback_control *wbc) -+static int writeback_single_inode(struct inode *inode, -+ struct writeback_control *wbc) - { -+ struct bdi_writeback *wb; - int ret = 0; - - spin_lock(&inode->i_lock); -@@ -1378,7 +1380,8 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb, - ret = __writeback_single_inode(inode, wbc); - - wbc_detach_inode(wbc); -- spin_lock(&wb->list_lock); -+ -+ wb = inode_to_wb_and_lock_list(inode); - spin_lock(&inode->i_lock); - /* - * If inode is clean, remove it from writeback lists. Otherwise don't -@@ -1453,6 +1456,7 @@ static long writeback_sb_inodes(struct super_block *sb, - - while (!list_empty(&wb->b_io)) { - struct inode *inode = wb_inode(wb->b_io.prev); -+ struct bdi_writeback *tmp_wb; - - if (inode->i_sb != sb) { - if (work->sb) { -@@ -1543,15 +1547,23 @@ static long writeback_sb_inodes(struct super_block *sb, - cond_resched(); - } - -- -- spin_lock(&wb->list_lock); -+ /* -+ * Requeue @inode if still dirty. Be careful as @inode may -+ * have been switched to another wb in the meantime. -+ */ -+ tmp_wb = inode_to_wb_and_lock_list(inode); - spin_lock(&inode->i_lock); - if (!(inode->i_state & I_DIRTY_ALL)) - wrote++; -- requeue_inode(inode, wb, &wbc); -+ requeue_inode(inode, tmp_wb, &wbc); - inode_sync_complete(inode); - spin_unlock(&inode->i_lock); - -+ if (unlikely(tmp_wb != wb)) { -+ spin_unlock(&tmp_wb->list_lock); -+ spin_lock(&wb->list_lock); -+ } -+ - /* - * bail out to wb_writeback() often enough to check - * background threshold and other termination conditions. -@@ -2338,7 +2350,6 @@ EXPORT_SYMBOL(sync_inodes_sb); - */ - int write_inode_now(struct inode *inode, int sync) - { -- struct bdi_writeback *wb = &inode_to_bdi(inode)->wb; - struct writeback_control wbc = { - .nr_to_write = LONG_MAX, - .sync_mode = sync ? WB_SYNC_ALL : WB_SYNC_NONE, -@@ -2350,7 +2361,7 @@ int write_inode_now(struct inode *inode, int sync) - wbc.nr_to_write = 0; - - might_sleep(); -- return writeback_single_inode(inode, wb, &wbc); -+ return writeback_single_inode(inode, &wbc); - } - EXPORT_SYMBOL(write_inode_now); - -@@ -2367,7 +2378,7 @@ EXPORT_SYMBOL(write_inode_now); - */ - int sync_inode(struct inode *inode, struct writeback_control *wbc) - { -- return writeback_single_inode(inode, &inode_to_bdi(inode)->wb, wbc); -+ return writeback_single_inode(inode, wbc); - } - EXPORT_SYMBOL(sync_inode); - -diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c -index 8e3ee1936c7e..c5b6b7165489 100644 ---- a/fs/fuse/cuse.c -+++ b/fs/fuse/cuse.c -@@ -90,7 +90,7 @@ static struct list_head *cuse_conntbl_head(dev_t devt) - - static ssize_t cuse_read_iter(struct kiocb *kiocb, struct iov_iter *to) - { -- struct fuse_io_priv io = { .async = 0, .file = kiocb->ki_filp }; -+ struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(kiocb->ki_filp); - loff_t pos = 0; - - return fuse_direct_io(&io, to, &pos, FUSE_DIO_CUSE); -@@ -98,7 +98,7 @@ static ssize_t cuse_read_iter(struct kiocb *kiocb, struct iov_iter *to) - - static ssize_t cuse_write_iter(struct kiocb *kiocb, struct iov_iter *from) - { -- struct fuse_io_priv io = { .async = 0, .file = kiocb->ki_filp }; -+ struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(kiocb->ki_filp); - loff_t pos = 0; - /* - * No locking or generic_write_checks(), the server is -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index b03d253ece15..416108b42412 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -528,6 +528,11 @@ static void fuse_release_user_pages(struct fuse_req *req, int write) - } - } - -+static void fuse_io_release(struct kref *kref) -+{ -+ kfree(container_of(kref, struct fuse_io_priv, refcnt)); -+} -+ - static ssize_t fuse_get_res_by_io(struct fuse_io_priv *io) - { - if (io->err) -@@ -585,8 +590,9 @@ static void fuse_aio_complete(struct fuse_io_priv *io, int err, ssize_t pos) - } - - io->iocb->ki_complete(io->iocb, res, 0); -- kfree(io); - } -+ -+ kref_put(&io->refcnt, fuse_io_release); - } - - static void fuse_aio_complete_req(struct fuse_conn *fc, struct fuse_req *req) -@@ -613,6 +619,7 @@ static size_t fuse_async_req_send(struct fuse_conn *fc, struct fuse_req *req, - size_t num_bytes, struct fuse_io_priv *io) - { - spin_lock(&io->lock); -+ kref_get(&io->refcnt); - io->size += num_bytes; - io->reqs++; - spin_unlock(&io->lock); -@@ -691,7 +698,7 @@ static void fuse_short_read(struct fuse_req *req, struct inode *inode, - - static int fuse_do_readpage(struct file *file, struct page *page) - { -- struct fuse_io_priv io = { .async = 0, .file = file }; -+ struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(file); - struct inode *inode = page->mapping->host; - struct fuse_conn *fc = get_fuse_conn(inode); - struct fuse_req *req; -@@ -984,7 +991,7 @@ static size_t fuse_send_write_pages(struct fuse_req *req, struct file *file, - size_t res; - unsigned offset; - unsigned i; -- struct fuse_io_priv io = { .async = 0, .file = file }; -+ struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(file); - - for (i = 0; i < req->num_pages; i++) - fuse_wait_on_page_writeback(inode, req->pages[i]->index); -@@ -1398,7 +1405,7 @@ static ssize_t __fuse_direct_read(struct fuse_io_priv *io, - - static ssize_t fuse_direct_read_iter(struct kiocb *iocb, struct iov_iter *to) - { -- struct fuse_io_priv io = { .async = 0, .file = iocb->ki_filp }; -+ struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(iocb->ki_filp); - return __fuse_direct_read(&io, to, &iocb->ki_pos); - } - -@@ -1406,7 +1413,7 @@ static ssize_t fuse_direct_write_iter(struct kiocb *iocb, struct iov_iter *from) - { - struct file *file = iocb->ki_filp; - struct inode *inode = file_inode(file); -- struct fuse_io_priv io = { .async = 0, .file = file }; -+ struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(file); - ssize_t res; - - if (is_bad_inode(inode)) -@@ -2843,6 +2850,7 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset) - loff_t i_size; - size_t count = iov_iter_count(iter); - struct fuse_io_priv *io; -+ bool is_sync = is_sync_kiocb(iocb); - - pos = offset; - inode = file->f_mapping->host; -@@ -2863,6 +2871,7 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset) - if (!io) - return -ENOMEM; - spin_lock_init(&io->lock); -+ kref_init(&io->refcnt); - io->reqs = 1; - io->bytes = -1; - io->size = 0; -@@ -2882,12 +2891,18 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset) - * to wait on real async I/O requests, so we must submit this request - * synchronously. - */ -- if (!is_sync_kiocb(iocb) && (offset + count > i_size) && -+ if (!is_sync && (offset + count > i_size) && - iov_iter_rw(iter) == WRITE) - io->async = false; - -- if (io->async && is_sync_kiocb(iocb)) -+ if (io->async && is_sync) { -+ /* -+ * Additional reference to keep io around after -+ * calling fuse_aio_complete() -+ */ -+ kref_get(&io->refcnt); - io->done = &wait; -+ } - - if (iov_iter_rw(iter) == WRITE) { - ret = fuse_direct_io(io, iter, &pos, FUSE_DIO_WRITE); -@@ -2900,14 +2915,14 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset) - fuse_aio_complete(io, ret < 0 ? ret : 0, -1); - - /* we have a non-extending, async request, so return */ -- if (!is_sync_kiocb(iocb)) -+ if (!is_sync) - return -EIOCBQUEUED; - - wait_for_completion(&wait); - ret = fuse_get_res_by_io(io); - } - -- kfree(io); -+ kref_put(&io->refcnt, fuse_io_release); - - if (iov_iter_rw(iter) == WRITE) { - if (ret > 0) -diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h -index ce394b5fe6b4..eddbe02c4028 100644 ---- a/fs/fuse/fuse_i.h -+++ b/fs/fuse/fuse_i.h -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - - /** Max number of pages that can be used in a single read request */ - #define FUSE_MAX_PAGES_PER_REQ 32 -@@ -243,6 +244,7 @@ struct fuse_args { - - /** The request IO state (for asynchronous processing) */ - struct fuse_io_priv { -+ struct kref refcnt; - int async; - spinlock_t lock; - unsigned reqs; -@@ -256,6 +258,13 @@ struct fuse_io_priv { - struct completion *done; - }; - -+#define FUSE_IO_PRIV_SYNC(f) \ -+{ \ -+ .refcnt = { ATOMIC_INIT(1) }, \ -+ .async = 0, \ -+ .file = f, \ -+} -+ - /** - * Request flags - * -diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c -index 458cf463047b..82067ca22f2b 100644 ---- a/fs/hpfs/super.c -+++ b/fs/hpfs/super.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - - /* Mark the filesystem dirty, so that chkdsk checks it when os/2 booted */ - -@@ -453,10 +454,6 @@ static int hpfs_remount_fs(struct super_block *s, int *flags, char *data) - int lowercase, eas, chk, errs, chkdsk, timeshift; - int o; - struct hpfs_sb_info *sbi = hpfs_sb(s); -- char *new_opts = kstrdup(data, GFP_KERNEL); -- -- if (!new_opts) -- return -ENOMEM; - - sync_filesystem(s); - -@@ -493,17 +490,44 @@ static int hpfs_remount_fs(struct super_block *s, int *flags, char *data) - - if (!(*flags & MS_RDONLY)) mark_dirty(s, 1); - -- replace_mount_options(s, new_opts); -- - hpfs_unlock(s); - return 0; - - out_err: - hpfs_unlock(s); -- kfree(new_opts); - return -EINVAL; - } - -+static int hpfs_show_options(struct seq_file *seq, struct dentry *root) -+{ -+ struct hpfs_sb_info *sbi = hpfs_sb(root->d_sb); -+ -+ seq_printf(seq, ",uid=%u", from_kuid_munged(&init_user_ns, sbi->sb_uid)); -+ seq_printf(seq, ",gid=%u", from_kgid_munged(&init_user_ns, sbi->sb_gid)); -+ seq_printf(seq, ",umask=%03o", (~sbi->sb_mode & 0777)); -+ if (sbi->sb_lowercase) -+ seq_printf(seq, ",case=lower"); -+ if (!sbi->sb_chk) -+ seq_printf(seq, ",check=none"); -+ if (sbi->sb_chk == 2) -+ seq_printf(seq, ",check=strict"); -+ if (!sbi->sb_err) -+ seq_printf(seq, ",errors=continue"); -+ if (sbi->sb_err == 2) -+ seq_printf(seq, ",errors=panic"); -+ if (!sbi->sb_chkdsk) -+ seq_printf(seq, ",chkdsk=no"); -+ if (sbi->sb_chkdsk == 2) -+ seq_printf(seq, ",chkdsk=always"); -+ if (!sbi->sb_eas) -+ seq_printf(seq, ",eas=no"); -+ if (sbi->sb_eas == 1) -+ seq_printf(seq, ",eas=ro"); -+ if (sbi->sb_timeshift) -+ seq_printf(seq, ",timeshift=%d", sbi->sb_timeshift); -+ return 0; -+} -+ - /* Super operations */ - - static const struct super_operations hpfs_sops = -@@ -514,7 +538,7 @@ static const struct super_operations hpfs_sops = - .put_super = hpfs_put_super, - .statfs = hpfs_statfs, - .remount_fs = hpfs_remount_fs, -- .show_options = generic_show_options, -+ .show_options = hpfs_show_options, - }; - - static int hpfs_fill_super(struct super_block *s, void *options, int silent) -@@ -537,8 +561,6 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent) - - int o; - -- save_mount_options(s, options); -- - sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); - if (!sbi) { - return -ENOMEM; -diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c -index 5384ceb35b1c..98b3eb7d8eaf 100644 ---- a/fs/isofs/rock.c -+++ b/fs/isofs/rock.c -@@ -203,6 +203,8 @@ int get_rock_ridge_filename(struct iso_directory_record *de, - int retnamlen = 0; - int truncate = 0; - int ret = 0; -+ char *p; -+ int len; - - if (!ISOFS_SB(inode->i_sb)->s_rock) - return 0; -@@ -267,12 +269,17 @@ repeat: - rr->u.NM.flags); - break; - } -- if ((strlen(retname) + rr->len - 5) >= 254) { -+ len = rr->len - 5; -+ if (retnamlen + len >= 254) { - truncate = 1; - break; - } -- strncat(retname, rr->u.NM.name, rr->len - 5); -- retnamlen += rr->len - 5; -+ p = memchr(rr->u.NM.name, '\0', len); -+ if (unlikely(p)) -+ len = p - rr->u.NM.name; -+ memcpy(retname + retnamlen, rr->u.NM.name, len); -+ retnamlen += len; -+ retname[retnamlen] = '\0'; - break; - case SIG('R', 'E'): - kfree(rs.buffer); -diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c -index 81e622681c82..624a57a9c4aa 100644 ---- a/fs/jbd2/journal.c -+++ b/fs/jbd2/journal.c -@@ -1408,11 +1408,12 @@ out: - /** - * jbd2_mark_journal_empty() - Mark on disk journal as empty. - * @journal: The journal to update. -+ * @write_op: With which operation should we write the journal sb - * - * Update a journal's dynamic superblock fields to show that journal is empty. - * Write updated superblock to disk waiting for IO to complete. - */ --static void jbd2_mark_journal_empty(journal_t *journal) -+static void jbd2_mark_journal_empty(journal_t *journal, int write_op) - { - journal_superblock_t *sb = journal->j_superblock; - -@@ -1430,7 +1431,7 @@ static void jbd2_mark_journal_empty(journal_t *journal) - sb->s_start = cpu_to_be32(0); - read_unlock(&journal->j_state_lock); - -- jbd2_write_superblock(journal, WRITE_FUA); -+ jbd2_write_superblock(journal, write_op); - - /* Log is no longer empty */ - write_lock(&journal->j_state_lock); -@@ -1716,7 +1717,13 @@ int jbd2_journal_destroy(journal_t *journal) - if (journal->j_sb_buffer) { - if (!is_journal_aborted(journal)) { - mutex_lock(&journal->j_checkpoint_mutex); -- jbd2_mark_journal_empty(journal); -+ -+ write_lock(&journal->j_state_lock); -+ journal->j_tail_sequence = -+ ++journal->j_transaction_sequence; -+ write_unlock(&journal->j_state_lock); -+ -+ jbd2_mark_journal_empty(journal, WRITE_FLUSH_FUA); - mutex_unlock(&journal->j_checkpoint_mutex); - } else - err = -EIO; -@@ -1975,7 +1982,7 @@ int jbd2_journal_flush(journal_t *journal) - * the magic code for a fully-recovered superblock. Any future - * commits of data to the journal will restore the current - * s_start value. */ -- jbd2_mark_journal_empty(journal); -+ jbd2_mark_journal_empty(journal, WRITE_FUA); - mutex_unlock(&journal->j_checkpoint_mutex); - write_lock(&journal->j_state_lock); - J_ASSERT(!journal->j_running_transaction); -@@ -2021,7 +2028,7 @@ int jbd2_journal_wipe(journal_t *journal, int write) - if (write) { - /* Lock to make assertions happy... */ - mutex_lock(&journal->j_checkpoint_mutex); -- jbd2_mark_journal_empty(journal); -+ jbd2_mark_journal_empty(journal, WRITE_FUA); - mutex_unlock(&journal->j_checkpoint_mutex); - } - -diff --git a/fs/namei.c b/fs/namei.c -index 9c590e0f66e9..7824bfb89ada 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -2968,22 +2968,10 @@ no_open: - dentry = lookup_real(dir, dentry, nd->flags); - if (IS_ERR(dentry)) - return PTR_ERR(dentry); -- -- if (create_error) { -- int open_flag = op->open_flag; -- -- error = create_error; -- if ((open_flag & O_EXCL)) { -- if (!dentry->d_inode) -- goto out; -- } else if (!dentry->d_inode) { -- goto out; -- } else if ((open_flag & O_TRUNC) && -- d_is_reg(dentry)) { -- goto out; -- } -- /* will fail later, go on to get the right error */ -- } -+ } -+ if (create_error && !dentry->d_inode) { -+ error = create_error; -+ goto out; - } - looked_up: - path->dentry = dentry; -@@ -4258,7 +4246,11 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, - bool new_is_dir = false; - unsigned max_links = new_dir->i_sb->s_max_links; - -- if (source == target) -+ /* -+ * Check source == target. -+ * On overlayfs need to look at underlying inodes. -+ */ -+ if (vfs_select_inode(old_dentry, 0) == vfs_select_inode(new_dentry, 0)) - return 0; - - error = may_delete(old_dir, old_dentry, is_dir); -diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c -index 9cce67043f92..7ded17764754 100644 ---- a/fs/nfs/dir.c -+++ b/fs/nfs/dir.c -@@ -377,7 +377,7 @@ int nfs_readdir_xdr_filler(struct page **pages, nfs_readdir_descriptor_t *desc, - again: - timestamp = jiffies; - gencount = nfs_inc_attr_generation_counter(); -- error = NFS_PROTO(inode)->readdir(file->f_path.dentry, cred, entry->cookie, pages, -+ error = NFS_PROTO(inode)->readdir(file_dentry(file), cred, entry->cookie, pages, - NFS_SERVER(inode)->dtsize, desc->plus); - if (error < 0) { - /* We requested READDIRPLUS, but the server doesn't grok it */ -@@ -560,7 +560,7 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en - count++; - - if (desc->plus != 0) -- nfs_prime_dcache(desc->file->f_path.dentry, entry); -+ nfs_prime_dcache(file_dentry(desc->file), entry); - - status = nfs_readdir_add_to_array(entry, page); - if (status != 0) -@@ -864,7 +864,7 @@ static bool nfs_dir_mapping_need_revalidate(struct inode *dir) - */ - static int nfs_readdir(struct file *file, struct dir_context *ctx) - { -- struct dentry *dentry = file->f_path.dentry; -+ struct dentry *dentry = file_dentry(file); - struct inode *inode = d_inode(dentry); - nfs_readdir_descriptor_t my_desc, - *desc = &my_desc; -diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c -index 86faecf8f328..847b678af4f0 100644 ---- a/fs/nfs/inode.c -+++ b/fs/nfs/inode.c -@@ -940,7 +940,7 @@ int nfs_open(struct inode *inode, struct file *filp) - { - struct nfs_open_context *ctx; - -- ctx = alloc_nfs_open_context(filp->f_path.dentry, filp->f_mode); -+ ctx = alloc_nfs_open_context(file_dentry(filp), filp->f_mode); - if (IS_ERR(ctx)) - return PTR_ERR(ctx); - nfs_file_set_open_context(filp, ctx); -diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c -index 57ca1c8039c1..2a9ff14cfb3b 100644 ---- a/fs/nfs/nfs4file.c -+++ b/fs/nfs/nfs4file.c -@@ -26,7 +26,7 @@ static int - nfs4_file_open(struct inode *inode, struct file *filp) - { - struct nfs_open_context *ctx; -- struct dentry *dentry = filp->f_path.dentry; -+ struct dentry *dentry = file_dentry(filp); - struct dentry *parent = NULL; - struct inode *dir; - unsigned openflags = filp->f_flags; -@@ -57,7 +57,7 @@ nfs4_file_open(struct inode *inode, struct file *filp) - parent = dget_parent(dentry); - dir = d_inode(parent); - -- ctx = alloc_nfs_open_context(filp->f_path.dentry, filp->f_mode); -+ ctx = alloc_nfs_open_context(file_dentry(filp), filp->f_mode); - err = PTR_ERR(ctx); - if (IS_ERR(ctx)) - goto out; -diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index 4cba7865f496..f8082c7cde8b 100644 ---- a/fs/nfsd/nfs4proc.c -+++ b/fs/nfsd/nfs4proc.c -@@ -878,6 +878,7 @@ nfsd4_secinfo(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - &exp, &dentry); - if (err) - return err; -+ fh_unlock(&cstate->current_fh); - if (d_really_is_negative(dentry)) { - exp_put(exp); - err = nfserr_noent; -diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c -index d6ef0955a979..1600ec470ce7 100644 ---- a/fs/nfsd/nfs4xdr.c -+++ b/fs/nfsd/nfs4xdr.c -@@ -1072,8 +1072,9 @@ nfsd4_decode_rename(struct nfsd4_compoundargs *argp, struct nfsd4_rename *rename - - READ_BUF(4); - rename->rn_snamelen = be32_to_cpup(p++); -- READ_BUF(rename->rn_snamelen + 4); -+ READ_BUF(rename->rn_snamelen); - SAVEMEM(rename->rn_sname, rename->rn_snamelen); -+ READ_BUF(4); - rename->rn_tnamelen = be32_to_cpup(p++); - READ_BUF(rename->rn_tnamelen); - SAVEMEM(rename->rn_tname, rename->rn_tnamelen); -@@ -1155,13 +1156,14 @@ nfsd4_decode_setclientid(struct nfsd4_compoundargs *argp, struct nfsd4_setclient - READ_BUF(8); - setclientid->se_callback_prog = be32_to_cpup(p++); - setclientid->se_callback_netid_len = be32_to_cpup(p++); -- -- READ_BUF(setclientid->se_callback_netid_len + 4); -+ READ_BUF(setclientid->se_callback_netid_len); - SAVEMEM(setclientid->se_callback_netid_val, setclientid->se_callback_netid_len); -+ READ_BUF(4); - setclientid->se_callback_addr_len = be32_to_cpup(p++); - -- READ_BUF(setclientid->se_callback_addr_len + 4); -+ READ_BUF(setclientid->se_callback_addr_len); - SAVEMEM(setclientid->se_callback_addr_val, setclientid->se_callback_addr_len); -+ READ_BUF(4); - setclientid->se_callback_ident = be32_to_cpup(p++); - - DECODE_TAIL; -@@ -1835,8 +1837,9 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp) - - READ_BUF(4); - argp->taglen = be32_to_cpup(p++); -- READ_BUF(argp->taglen + 8); -+ READ_BUF(argp->taglen); - SAVEMEM(argp->tag, argp->taglen); -+ READ_BUF(8); - argp->minorversion = be32_to_cpup(p++); - argp->opcnt = be32_to_cpup(p++); - max_reply += 4 + (XDR_QUADLEN(argp->taglen) << 2); -diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c -index 0cdf497c91ef..2162434728c0 100644 ---- a/fs/ocfs2/acl.c -+++ b/fs/ocfs2/acl.c -@@ -322,3 +322,90 @@ struct posix_acl *ocfs2_iop_get_acl(struct inode *inode, int type) - brelse(di_bh); - return acl; - } -+ -+int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh) -+{ -+ struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); -+ struct posix_acl *acl; -+ int ret; -+ -+ if (S_ISLNK(inode->i_mode)) -+ return -EOPNOTSUPP; -+ -+ if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) -+ return 0; -+ -+ acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh); -+ if (IS_ERR(acl) || !acl) -+ return PTR_ERR(acl); -+ ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode); -+ if (ret) -+ return ret; -+ ret = ocfs2_set_acl(NULL, inode, NULL, ACL_TYPE_ACCESS, -+ acl, NULL, NULL); -+ posix_acl_release(acl); -+ return ret; -+} -+ -+/* -+ * Initialize the ACLs of a new inode. If parent directory has default ACL, -+ * then clone to new inode. Called from ocfs2_mknod. -+ */ -+int ocfs2_init_acl(handle_t *handle, -+ struct inode *inode, -+ struct inode *dir, -+ struct buffer_head *di_bh, -+ struct buffer_head *dir_bh, -+ struct ocfs2_alloc_context *meta_ac, -+ struct ocfs2_alloc_context *data_ac) -+{ -+ struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); -+ struct posix_acl *acl = NULL; -+ int ret = 0, ret2; -+ umode_t mode; -+ -+ if (!S_ISLNK(inode->i_mode)) { -+ if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) { -+ acl = ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT, -+ dir_bh); -+ if (IS_ERR(acl)) -+ return PTR_ERR(acl); -+ } -+ if (!acl) { -+ mode = inode->i_mode & ~current_umask(); -+ ret = ocfs2_acl_set_mode(inode, di_bh, handle, mode); -+ if (ret) { -+ mlog_errno(ret); -+ goto cleanup; -+ } -+ } -+ } -+ if ((osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) && acl) { -+ if (S_ISDIR(inode->i_mode)) { -+ ret = ocfs2_set_acl(handle, inode, di_bh, -+ ACL_TYPE_DEFAULT, acl, -+ meta_ac, data_ac); -+ if (ret) -+ goto cleanup; -+ } -+ mode = inode->i_mode; -+ ret = __posix_acl_create(&acl, GFP_NOFS, &mode); -+ if (ret < 0) -+ return ret; -+ -+ ret2 = ocfs2_acl_set_mode(inode, di_bh, handle, mode); -+ if (ret2) { -+ mlog_errno(ret2); -+ ret = ret2; -+ goto cleanup; -+ } -+ if (ret > 0) { -+ ret = ocfs2_set_acl(handle, inode, -+ di_bh, ACL_TYPE_ACCESS, -+ acl, meta_ac, data_ac); -+ } -+ } -+cleanup: -+ posix_acl_release(acl); -+ return ret; -+} -diff --git a/fs/ocfs2/acl.h b/fs/ocfs2/acl.h -index 3fce68d08625..2783a75b3999 100644 ---- a/fs/ocfs2/acl.h -+++ b/fs/ocfs2/acl.h -@@ -35,5 +35,10 @@ int ocfs2_set_acl(handle_t *handle, - struct posix_acl *acl, - struct ocfs2_alloc_context *meta_ac, - struct ocfs2_alloc_context *data_ac); -+extern int ocfs2_acl_chmod(struct inode *, struct buffer_head *); -+extern int ocfs2_init_acl(handle_t *, struct inode *, struct inode *, -+ struct buffer_head *, struct buffer_head *, -+ struct ocfs2_alloc_context *, -+ struct ocfs2_alloc_context *); - - #endif /* OCFS2_ACL_H */ -diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c -index a76b9ea7722e..a2370e2c7295 100644 ---- a/fs/ocfs2/cluster/heartbeat.c -+++ b/fs/ocfs2/cluster/heartbeat.c -@@ -1445,8 +1445,8 @@ static void o2hb_region_release(struct config_item *item) - debugfs_remove(reg->hr_debug_dir); - kfree(reg->hr_db_livenodes); - kfree(reg->hr_db_regnum); -- kfree(reg->hr_debug_elapsed_time); -- kfree(reg->hr_debug_pinned); -+ kfree(reg->hr_db_elapsed_time); -+ kfree(reg->hr_db_pinned); - - spin_lock(&o2hb_live_lock); - list_del(®->hr_all_item); -diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c -index e36d63ff1783..f90931335c6b 100644 ---- a/fs/ocfs2/dlm/dlmconvert.c -+++ b/fs/ocfs2/dlm/dlmconvert.c -@@ -262,6 +262,7 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, - struct dlm_lock *lock, int flags, int type) - { - enum dlm_status status; -+ u8 old_owner = res->owner; - - mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type, - lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS); -@@ -287,6 +288,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, - status = DLM_DENIED; - goto bail; - } -+ -+ if (lock->ml.type == type && lock->ml.convert_type == LKM_IVMODE) { -+ mlog(0, "last convert request returned DLM_RECOVERING, but " -+ "owner has already queued and sent ast to me. res %.*s, " -+ "(cookie=%u:%llu, type=%d, conv=%d)\n", -+ res->lockname.len, res->lockname.name, -+ dlm_get_lock_cookie_node(be64_to_cpu(lock->ml.cookie)), -+ dlm_get_lock_cookie_seq(be64_to_cpu(lock->ml.cookie)), -+ lock->ml.type, lock->ml.convert_type); -+ status = DLM_NORMAL; -+ goto bail; -+ } -+ - res->state |= DLM_LOCK_RES_IN_PROGRESS; - /* move lock to local convert queue */ - /* do not alter lock refcount. switching lists. */ -@@ -316,11 +330,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, - spin_lock(&res->spinlock); - res->state &= ~DLM_LOCK_RES_IN_PROGRESS; - lock->convert_pending = 0; -- /* if it failed, move it back to granted queue */ -+ /* if it failed, move it back to granted queue. -+ * if master returns DLM_NORMAL and then down before sending ast, -+ * it may have already been moved to granted queue, reset to -+ * DLM_RECOVERING and retry convert */ - if (status != DLM_NORMAL) { - if (status != DLM_NOTQUEUED) - dlm_error(status); - dlm_revert_pending_convert(res, lock); -+ } else if ((res->state & DLM_LOCK_RES_RECOVERING) || -+ (old_owner != res->owner)) { -+ mlog(0, "res %.*s is in recovering or has been recovered.\n", -+ res->lockname.len, res->lockname.name); -+ status = DLM_RECOVERING; - } - bail: - spin_unlock(&res->spinlock); -diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c -index b94a425f0175..23d0ab881f6e 100644 ---- a/fs/ocfs2/dlm/dlmrecovery.c -+++ b/fs/ocfs2/dlm/dlmrecovery.c -@@ -2071,7 +2071,6 @@ void dlm_move_lockres_to_recovery_list(struct dlm_ctxt *dlm, - dlm_lock_get(lock); - if (lock->convert_pending) { - /* move converting lock back to granted */ -- BUG_ON(i != DLM_CONVERTING_LIST); - mlog(0, "node died with convert pending " - "on %.*s. move back to granted list.\n", - res->lockname.len, res->lockname.name); -diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c -index 7cb38fdca229..3d60fda1cb09 100644 ---- a/fs/ocfs2/file.c -+++ b/fs/ocfs2/file.c -@@ -1268,20 +1268,20 @@ bail_unlock_rw: - if (size_change) - ocfs2_rw_unlock(inode, 1); - bail: -- brelse(bh); - - /* Release quota pointers in case we acquired them */ - for (qtype = 0; qtype < OCFS2_MAXQUOTAS; qtype++) - dqput(transfer_to[qtype]); - - if (!status && attr->ia_valid & ATTR_MODE) { -- status = posix_acl_chmod(inode, inode->i_mode); -+ status = ocfs2_acl_chmod(inode, bh); - if (status < 0) - mlog_errno(status); - } - if (inode_locked) - ocfs2_inode_unlock(inode, 1); - -+ brelse(bh); - return status; - } - -diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c -index 6b3e87189a64..a8f1225e6d9b 100644 ---- a/fs/ocfs2/namei.c -+++ b/fs/ocfs2/namei.c -@@ -259,7 +259,6 @@ static int ocfs2_mknod(struct inode *dir, - struct ocfs2_dir_lookup_result lookup = { NULL, }; - sigset_t oldset; - int did_block_signals = 0; -- struct posix_acl *default_acl = NULL, *acl = NULL; - struct ocfs2_dentry_lock *dl = NULL; - - trace_ocfs2_mknod(dir, dentry, dentry->d_name.len, dentry->d_name.name, -@@ -367,12 +366,6 @@ static int ocfs2_mknod(struct inode *dir, - goto leave; - } - -- status = posix_acl_create(dir, &inode->i_mode, &default_acl, &acl); -- if (status) { -- mlog_errno(status); -- goto leave; -- } -- - handle = ocfs2_start_trans(osb, ocfs2_mknod_credits(osb->sb, - S_ISDIR(mode), - xattr_credits)); -@@ -421,16 +414,8 @@ static int ocfs2_mknod(struct inode *dir, - inc_nlink(dir); - } - -- if (default_acl) { -- status = ocfs2_set_acl(handle, inode, new_fe_bh, -- ACL_TYPE_DEFAULT, default_acl, -- meta_ac, data_ac); -- } -- if (!status && acl) { -- status = ocfs2_set_acl(handle, inode, new_fe_bh, -- ACL_TYPE_ACCESS, acl, -- meta_ac, data_ac); -- } -+ status = ocfs2_init_acl(handle, inode, dir, new_fe_bh, parent_fe_bh, -+ meta_ac, data_ac); - - if (status < 0) { - mlog_errno(status); -@@ -472,10 +457,6 @@ static int ocfs2_mknod(struct inode *dir, - d_instantiate(dentry, inode); - status = 0; - leave: -- if (default_acl) -- posix_acl_release(default_acl); -- if (acl) -- posix_acl_release(acl); - if (status < 0 && did_quota_inode) - dquot_free_inode(inode); - if (handle) -diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c -index 3eff031aaf26..9919964c5b3b 100644 ---- a/fs/ocfs2/refcounttree.c -+++ b/fs/ocfs2/refcounttree.c -@@ -4248,20 +4248,12 @@ static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir, - struct inode *inode = d_inode(old_dentry); - struct buffer_head *old_bh = NULL; - struct inode *new_orphan_inode = NULL; -- struct posix_acl *default_acl, *acl; -- umode_t mode; - - if (!ocfs2_refcount_tree(OCFS2_SB(inode->i_sb))) - return -EOPNOTSUPP; - -- mode = inode->i_mode; -- error = posix_acl_create(dir, &mode, &default_acl, &acl); -- if (error) { -- mlog_errno(error); -- return error; -- } - -- error = ocfs2_create_inode_in_orphan(dir, mode, -+ error = ocfs2_create_inode_in_orphan(dir, inode->i_mode, - &new_orphan_inode); - if (error) { - mlog_errno(error); -@@ -4300,16 +4292,11 @@ static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir, - /* If the security isn't preserved, we need to re-initialize them. */ - if (!preserve) { - error = ocfs2_init_security_and_acl(dir, new_orphan_inode, -- &new_dentry->d_name, -- default_acl, acl); -+ &new_dentry->d_name); - if (error) - mlog_errno(error); - } - out: -- if (default_acl) -- posix_acl_release(default_acl); -- if (acl) -- posix_acl_release(acl); - if (!error) { - error = ocfs2_mv_orphaned_inode_to_new(dir, new_orphan_inode, - new_dentry); -diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c -index 7d3d979f57d9..f19b7381a998 100644 ---- a/fs/ocfs2/xattr.c -+++ b/fs/ocfs2/xattr.c -@@ -7216,12 +7216,10 @@ out: - */ - int ocfs2_init_security_and_acl(struct inode *dir, - struct inode *inode, -- const struct qstr *qstr, -- struct posix_acl *default_acl, -- struct posix_acl *acl) -+ const struct qstr *qstr) - { -- struct buffer_head *dir_bh = NULL; - int ret = 0; -+ struct buffer_head *dir_bh = NULL; - - ret = ocfs2_init_security_get(inode, dir, qstr, NULL); - if (ret) { -@@ -7234,11 +7232,9 @@ int ocfs2_init_security_and_acl(struct inode *dir, - mlog_errno(ret); - goto leave; - } -- -- if (!ret && default_acl) -- ret = ocfs2_iop_set_acl(inode, default_acl, ACL_TYPE_DEFAULT); -- if (!ret && acl) -- ret = ocfs2_iop_set_acl(inode, acl, ACL_TYPE_ACCESS); -+ ret = ocfs2_init_acl(NULL, inode, dir, NULL, dir_bh, NULL, NULL); -+ if (ret) -+ mlog_errno(ret); - - ocfs2_inode_unlock(dir, 0); - brelse(dir_bh); -diff --git a/fs/ocfs2/xattr.h b/fs/ocfs2/xattr.h -index f10d5b93c366..1633cc15ea1f 100644 ---- a/fs/ocfs2/xattr.h -+++ b/fs/ocfs2/xattr.h -@@ -94,7 +94,5 @@ int ocfs2_reflink_xattrs(struct inode *old_inode, - bool preserve_security); - int ocfs2_init_security_and_acl(struct inode *dir, - struct inode *inode, -- const struct qstr *qstr, -- struct posix_acl *default_acl, -- struct posix_acl *acl); -+ const struct qstr *qstr); - #endif /* OCFS2_XATTR_H */ -diff --git a/fs/open.c b/fs/open.c -index 55bdc75e2172..081d3d6df74b 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -840,16 +840,12 @@ EXPORT_SYMBOL(file_path); - int vfs_open(const struct path *path, struct file *file, - const struct cred *cred) - { -- struct dentry *dentry = path->dentry; -- struct inode *inode = dentry->d_inode; -+ struct inode *inode = vfs_select_inode(path->dentry, file->f_flags); - -- file->f_path = *path; -- if (dentry->d_flags & DCACHE_OP_SELECT_INODE) { -- inode = dentry->d_op->d_select_inode(dentry, file->f_flags); -- if (IS_ERR(inode)) -- return PTR_ERR(inode); -- } -+ if (IS_ERR(inode)) -+ return PTR_ERR(inode); - -+ file->f_path = *path; - return do_dentry_open(file, inode, NULL, cred); - } - -@@ -992,14 +988,12 @@ struct file *filp_open(const char *filename, int flags, umode_t mode) - EXPORT_SYMBOL(filp_open); - - struct file *file_open_root(struct dentry *dentry, struct vfsmount *mnt, -- const char *filename, int flags) -+ const char *filename, int flags, umode_t mode) - { - struct open_flags op; -- int err = build_open_flags(flags, 0, &op); -+ int err = build_open_flags(flags, mode, &op); - if (err) - return ERR_PTR(err); -- if (flags & O_CREAT) -- return ERR_PTR(-EINVAL); - return do_file_open_root(dentry, mnt, filename, &op); - } - EXPORT_SYMBOL(file_open_root); -diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index 619ad4b016d2..4399ea804447 100644 ---- a/fs/overlayfs/super.c -+++ b/fs/overlayfs/super.c -@@ -295,6 +295,37 @@ static void ovl_dentry_release(struct dentry *dentry) - } - } - -+static struct dentry *ovl_d_real(struct dentry *dentry, struct inode *inode) -+{ -+ struct dentry *real; -+ -+ if (d_is_dir(dentry)) { -+ if (!inode || inode == d_inode(dentry)) -+ return dentry; -+ goto bug; -+ } -+ -+ real = ovl_dentry_upper(dentry); -+ if (real && (!inode || inode == d_inode(real))) -+ return real; -+ -+ real = ovl_dentry_lower(dentry); -+ if (!real) -+ goto bug; -+ -+ if (!inode || inode == d_inode(real)) -+ return real; -+ -+ /* Handle recursion */ -+ if (real->d_flags & DCACHE_OP_REAL) -+ return real->d_op->d_real(real, inode); -+ -+bug: -+ WARN(1, "ovl_d_real(%pd4, %s:%lu\n): real dentry not found\n", dentry, -+ inode ? inode->i_sb->s_id : "NULL", inode ? inode->i_ino : 0); -+ return dentry; -+} -+ - static int ovl_dentry_revalidate(struct dentry *dentry, unsigned int flags) - { - struct ovl_entry *oe = dentry->d_fsdata; -@@ -339,11 +370,13 @@ static int ovl_dentry_weak_revalidate(struct dentry *dentry, unsigned int flags) - static const struct dentry_operations ovl_dentry_operations = { - .d_release = ovl_dentry_release, - .d_select_inode = ovl_d_select_inode, -+ .d_real = ovl_d_real, - }; - - static const struct dentry_operations ovl_reval_dentry_operations = { - .d_release = ovl_dentry_release, - .d_select_inode = ovl_d_select_inode, -+ .d_real = ovl_d_real, - .d_revalidate = ovl_dentry_revalidate, - .d_weak_revalidate = ovl_dentry_weak_revalidate, - }; -diff --git a/fs/pnode.c b/fs/pnode.c -index c524fdddc7fb..99899705b105 100644 ---- a/fs/pnode.c -+++ b/fs/pnode.c -@@ -198,7 +198,7 @@ static struct mount *next_group(struct mount *m, struct mount *origin) - - /* all accesses are serialized by namespace_sem */ - static struct user_namespace *user_ns; --static struct mount *last_dest, *last_source, *dest_master; -+static struct mount *last_dest, *first_source, *last_source, *dest_master; - static struct mountpoint *mp; - static struct hlist_head *list; - -@@ -221,20 +221,22 @@ static int propagate_one(struct mount *m) - type = CL_MAKE_SHARED; - } else { - struct mount *n, *p; -+ bool done; - for (n = m; ; n = p) { - p = n->mnt_master; -- if (p == dest_master || IS_MNT_MARKED(p)) { -- while (last_dest->mnt_master != p) { -- last_source = last_source->mnt_master; -- last_dest = last_source->mnt_parent; -- } -- if (!peers(n, last_dest)) { -- last_source = last_source->mnt_master; -- last_dest = last_source->mnt_parent; -- } -+ if (p == dest_master || IS_MNT_MARKED(p)) - break; -- } - } -+ do { -+ struct mount *parent = last_source->mnt_parent; -+ if (last_source == first_source) -+ break; -+ done = parent->mnt_master == p; -+ if (done && peers(n, parent)) -+ break; -+ last_source = last_source->mnt_master; -+ } while (!done); -+ - type = CL_SLAVE; - /* beginning of peer group among the slaves? */ - if (IS_MNT_SHARED(m)) -@@ -286,6 +288,7 @@ int propagate_mnt(struct mount *dest_mnt, struct mountpoint *dest_mp, - */ - user_ns = current->nsproxy->mnt_ns->user_ns; - last_dest = dest_mnt; -+ first_source = source_mnt; - last_source = source_mnt; - mp = dest_mp; - list = tree_list; -diff --git a/fs/proc/base.c b/fs/proc/base.c -index 4f764c2ac1a5..45f2162e55b2 100644 ---- a/fs/proc/base.c -+++ b/fs/proc/base.c -@@ -955,7 +955,8 @@ static ssize_t environ_read(struct file *file, char __user *buf, - struct mm_struct *mm = file->private_data; - unsigned long env_start, env_end; - -- if (!mm) -+ /* Ensure the process spawned far enough to have an environment. */ -+ if (!mm || !mm->env_end) - return 0; - - page = (char *)__get_free_page(GFP_TEMPORARY); -diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index fa95ab2d3674..9d2f3e0a6360 100644 ---- a/fs/proc/task_mmu.c -+++ b/fs/proc/task_mmu.c -@@ -1504,6 +1504,32 @@ static struct page *can_gather_numa_stats(pte_t pte, struct vm_area_struct *vma, - return page; - } - -+#ifdef CONFIG_TRANSPARENT_HUGEPAGE -+static struct page *can_gather_numa_stats_pmd(pmd_t pmd, -+ struct vm_area_struct *vma, -+ unsigned long addr) -+{ -+ struct page *page; -+ int nid; -+ -+ if (!pmd_present(pmd)) -+ return NULL; -+ -+ page = vm_normal_page_pmd(vma, addr, pmd); -+ if (!page) -+ return NULL; -+ -+ if (PageReserved(page)) -+ return NULL; -+ -+ nid = page_to_nid(page); -+ if (!node_isset(nid, node_states[N_MEMORY])) -+ return NULL; -+ -+ return page; -+} -+#endif -+ - static int gather_pte_stats(pmd_t *pmd, unsigned long addr, - unsigned long end, struct mm_walk *walk) - { -@@ -1513,14 +1539,14 @@ static int gather_pte_stats(pmd_t *pmd, unsigned long addr, - pte_t *orig_pte; - pte_t *pte; - -+#ifdef CONFIG_TRANSPARENT_HUGEPAGE - ptl = pmd_trans_huge_lock(pmd, vma); - if (ptl) { -- pte_t huge_pte = *(pte_t *)pmd; - struct page *page; - -- page = can_gather_numa_stats(huge_pte, vma, addr); -+ page = can_gather_numa_stats_pmd(*pmd, vma, addr); - if (page) -- gather_stats(page, md, pte_dirty(huge_pte), -+ gather_stats(page, md, pmd_dirty(*pmd), - HPAGE_PMD_SIZE/PAGE_SIZE); - spin_unlock(ptl); - return 0; -@@ -1528,6 +1554,7 @@ static int gather_pte_stats(pmd_t *pmd, unsigned long addr, - - if (pmd_trans_unstable(pmd)) - return 0; -+#endif - orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl); - do { - struct page *page = can_gather_numa_stats(*pte, vma, addr); -diff --git a/fs/proc_namespace.c b/fs/proc_namespace.c -index 2256e7e23e67..3f1190d18991 100644 ---- a/fs/proc_namespace.c -+++ b/fs/proc_namespace.c -@@ -199,6 +199,8 @@ static int show_vfsstat(struct seq_file *m, struct vfsmount *mnt) - if (sb->s_op->show_devname) { - seq_puts(m, "device "); - err = sb->s_op->show_devname(m, mnt_path.dentry); -+ if (err) -+ goto out; - } else { - if (r->mnt_devname) { - seq_puts(m, "device "); -diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c -index 3c3b81bb6dfe..850d17fa0aa3 100644 ---- a/fs/quota/dquot.c -+++ b/fs/quota/dquot.c -@@ -1398,7 +1398,7 @@ static int dquot_active(const struct inode *inode) - static int __dquot_initialize(struct inode *inode, int type) - { - int cnt, init_needed = 0; -- struct dquot **dquots, *got[MAXQUOTAS]; -+ struct dquot **dquots, *got[MAXQUOTAS] = {}; - struct super_block *sb = inode->i_sb; - qsize_t rsv; - int ret = 0; -@@ -1415,7 +1415,6 @@ static int __dquot_initialize(struct inode *inode, int type) - int rc; - struct dquot *dquot; - -- got[cnt] = NULL; - if (type != -1 && cnt != type) - continue; - /* -diff --git a/fs/splice.c b/fs/splice.c -index 82bc0d64fc38..19e0b103d253 100644 ---- a/fs/splice.c -+++ b/fs/splice.c -@@ -185,6 +185,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe, - unsigned int spd_pages = spd->nr_pages; - int ret, do_wakeup, page_nr; - -+ if (!spd_pages) -+ return 0; -+ - ret = 0; - do_wakeup = 0; - page_nr = 0; -diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c -index 0ef7c2ed3f8a..4fa14820e2e2 100644 ---- a/fs/xfs/xfs_attr_list.c -+++ b/fs/xfs/xfs_attr_list.c -@@ -202,8 +202,10 @@ xfs_attr_shortform_list(xfs_attr_list_context_t *context) - sbp->namelen, - sbp->valuelen, - &sbp->name[sbp->namelen]); -- if (error) -+ if (error) { -+ kmem_free(sbuf); - return error; -+ } - if (context->seen_enough) - break; - cursor->offset++; -@@ -454,14 +456,13 @@ xfs_attr3_leaf_list_int( - args.rmtblkcnt = xfs_attr3_rmt_blocks( - args.dp->i_mount, valuelen); - retval = xfs_attr_rmtval_get(&args); -- if (retval) -- return retval; -- retval = context->put_listent(context, -- entry->flags, -- name_rmt->name, -- (int)name_rmt->namelen, -- valuelen, -- args.value); -+ if (!retval) -+ retval = context->put_listent(context, -+ entry->flags, -+ name_rmt->name, -+ (int)name_rmt->namelen, -+ valuelen, -+ args.value); - kmem_free(args.value); - } else { - retval = context->put_listent(context, -diff --git a/include/asm-generic/bitops/lock.h b/include/asm-generic/bitops/lock.h -index c30266e94806..8ef0ccbf8167 100644 ---- a/include/asm-generic/bitops/lock.h -+++ b/include/asm-generic/bitops/lock.h -@@ -29,16 +29,16 @@ do { \ - * @nr: the bit to set - * @addr: the address to start counting from - * -- * This operation is like clear_bit_unlock, however it is not atomic. -- * It does provide release barrier semantics so it can be used to unlock -- * a bit lock, however it would only be used if no other CPU can modify -- * any bits in the memory until the lock is released (a good example is -- * if the bit lock itself protects access to the other bits in the word). -+ * A weaker form of clear_bit_unlock() as used by __bit_lock_unlock(). If all -+ * the bits in the word are protected by this lock some archs can use weaker -+ * ops to safely unlock. -+ * -+ * See for example x86's implementation. - */ - #define __clear_bit_unlock(nr, addr) \ - do { \ -- smp_mb(); \ -- __clear_bit(nr, addr); \ -+ smp_mb__before_atomic(); \ -+ clear_bit(nr, addr); \ - } while (0) - - #endif /* _ASM_GENERIC_BITOPS_LOCK_H_ */ -diff --git a/include/asm-generic/futex.h b/include/asm-generic/futex.h -index e56272c919b5..bf2d34c9d804 100644 ---- a/include/asm-generic/futex.h -+++ b/include/asm-generic/futex.h -@@ -108,11 +108,15 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, - u32 val; - - preempt_disable(); -- if (unlikely(get_user(val, uaddr) != 0)) -+ if (unlikely(get_user(val, uaddr) != 0)) { -+ preempt_enable(); - return -EFAULT; -+ } - -- if (val == oldval && unlikely(put_user(newval, uaddr) != 0)) -+ if (val == oldval && unlikely(put_user(newval, uaddr) != 0)) { -+ preempt_enable(); - return -EFAULT; -+ } - - *uval = val; - preempt_enable(); -diff --git a/include/asm-generic/qspinlock.h b/include/asm-generic/qspinlock.h -index 39e1cb201b8e..332da3ad8eb5 100644 ---- a/include/asm-generic/qspinlock.h -+++ b/include/asm-generic/qspinlock.h -@@ -28,7 +28,30 @@ - */ - static __always_inline int queued_spin_is_locked(struct qspinlock *lock) - { -- return atomic_read(&lock->val); -+ /* -+ * queued_spin_lock_slowpath() can ACQUIRE the lock before -+ * issuing the unordered store that sets _Q_LOCKED_VAL. -+ * -+ * See both smp_cond_acquire() sites for more detail. -+ * -+ * This however means that in code like: -+ * -+ * spin_lock(A) spin_lock(B) -+ * spin_unlock_wait(B) spin_is_locked(A) -+ * do_something() do_something() -+ * -+ * Both CPUs can end up running do_something() because the store -+ * setting _Q_LOCKED_VAL will pass through the loads in -+ * spin_unlock_wait() and/or spin_is_locked(). -+ * -+ * Avoid this by issuing a full memory barrier between the spin_lock() -+ * and the loads in spin_unlock_wait() and spin_is_locked(). -+ * -+ * Note that regular mutual exclusion doesn't care about this -+ * delayed store. -+ */ -+ smp_mb(); -+ return atomic_read(&lock->val) & _Q_LOCKED_MASK; - } - - /** -@@ -108,6 +131,8 @@ static __always_inline void queued_spin_unlock(struct qspinlock *lock) - */ - static inline void queued_spin_unlock_wait(struct qspinlock *lock) - { -+ /* See queued_spin_is_locked() */ -+ smp_mb(); - while (atomic_read(&lock->val) & _Q_LOCKED_MASK) - cpu_relax(); - } -diff --git a/include/asm-generic/siginfo.h b/include/asm-generic/siginfo.h -index 3d1a3af5cf59..a2508a8f9a9c 100644 ---- a/include/asm-generic/siginfo.h -+++ b/include/asm-generic/siginfo.h -@@ -17,21 +17,6 @@ - struct siginfo; - void do_schedule_next_timer(struct siginfo *info); - --#ifndef HAVE_ARCH_COPY_SIGINFO -- --#include -- --static inline void copy_siginfo(struct siginfo *to, struct siginfo *from) --{ -- if (from->si_code < 0) -- memcpy(to, from, sizeof(*to)); -- else -- /* _sigchld is currently the largest know union member */ -- memcpy(to, from, __ARCH_SI_PREAMBLE_SIZE + sizeof(from->_sifields._sigchld)); --} -- --#endif -- - extern int copy_siginfo_to_user(struct siginfo __user *to, const struct siginfo *from); - - #endif -diff --git a/include/drm/drm_cache.h b/include/drm/drm_cache.h -index 461a0558bca4..cebecff536a3 100644 ---- a/include/drm/drm_cache.h -+++ b/include/drm/drm_cache.h -@@ -39,6 +39,8 @@ static inline bool drm_arch_can_wc_memory(void) - { - #if defined(CONFIG_PPC) && !defined(CONFIG_NOT_COHERENT_CACHE) - return false; -+#elif defined(CONFIG_MIPS) && defined(CONFIG_CPU_LOONGSON3) -+ return false; - #else - return true; - #endif -diff --git a/include/keys/trusted-type.h b/include/keys/trusted-type.h -index 42cf2d991bf4..4ea7e55f20b0 100644 ---- a/include/keys/trusted-type.h -+++ b/include/keys/trusted-type.h -@@ -38,7 +38,7 @@ struct trusted_key_options { - unsigned char pcrinfo[MAX_PCRINFO_SIZE]; - int pcrlock; - uint32_t hash; -- uint32_t digest_len; -+ uint32_t policydigest_len; - unsigned char policydigest[MAX_DIGEST_SIZE]; - uint32_t policyhandle; - }; -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 83d1926c61e4..67bc2da5d233 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -165,12 +165,13 @@ void bpf_register_prog_type(struct bpf_prog_type_list *tl); - void bpf_register_map_type(struct bpf_map_type_list *tl); - - struct bpf_prog *bpf_prog_get(u32 ufd); -+struct bpf_prog *bpf_prog_inc(struct bpf_prog *prog); - void bpf_prog_put(struct bpf_prog *prog); - void bpf_prog_put_rcu(struct bpf_prog *prog); - - struct bpf_map *bpf_map_get_with_uref(u32 ufd); - struct bpf_map *__bpf_map_get(struct fd f); --void bpf_map_inc(struct bpf_map *map, bool uref); -+struct bpf_map *bpf_map_inc(struct bpf_map *map, bool uref); - void bpf_map_put_with_uref(struct bpf_map *map); - void bpf_map_put(struct bpf_map *map); - -diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h -index 735f9f8c4e43..5261751f6bd4 100644 ---- a/include/linux/can/dev.h -+++ b/include/linux/can/dev.h -@@ -40,8 +40,11 @@ struct can_priv { - struct can_clock clock; - - enum can_state state; -- u32 ctrlmode; -- u32 ctrlmode_supported; -+ -+ /* CAN controller features - see include/uapi/linux/can/netlink.h */ -+ u32 ctrlmode; /* current options setting */ -+ u32 ctrlmode_supported; /* options that can be modified by netlink */ -+ u32 ctrlmode_static; /* static enabled options for driver/hardware */ - - int restart_ms; - struct timer_list restart_timer; -@@ -108,6 +111,21 @@ static inline bool can_is_canfd_skb(const struct sk_buff *skb) - return skb->len == CANFD_MTU; - } - -+/* helper to define static CAN controller features at device creation time */ -+static inline void can_set_static_ctrlmode(struct net_device *dev, -+ u32 static_mode) -+{ -+ struct can_priv *priv = netdev_priv(dev); -+ -+ /* alloc_candev() succeeded => netdev_priv() is valid at this point */ -+ priv->ctrlmode = static_mode; -+ priv->ctrlmode_static = static_mode; -+ -+ /* override MTU which was set by default in can_setup()? */ -+ if (static_mode & CAN_CTRLMODE_FD) -+ dev->mtu = CANFD_MTU; -+} -+ - /* get data length from can_dlc with sanitized can_dlc */ - u8 can_dlc2len(u8 can_dlc); - -diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h -index 789471dba6fb..7fc7cb7872e3 100644 ---- a/include/linux/cgroup-defs.h -+++ b/include/linux/cgroup-defs.h -@@ -210,6 +210,9 @@ struct css_set { - /* all css_task_iters currently walking this cset */ - struct list_head task_iters; - -+ /* dead and being drained, ignore for migration */ -+ bool dead; -+ - /* For RCU-protected deletion */ - struct rcu_head rcu_head; - }; -@@ -439,6 +442,7 @@ struct cgroup_subsys { - int (*can_attach)(struct cgroup_taskset *tset); - void (*cancel_attach)(struct cgroup_taskset *tset); - void (*attach)(struct cgroup_taskset *tset); -+ void (*post_attach)(void); - int (*can_fork)(struct task_struct *task); - void (*cancel_fork)(struct task_struct *task); - void (*fork)(struct task_struct *task); -diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h -index 1143e38555a4..408a60dca353 100644 ---- a/include/linux/clk-provider.h -+++ b/include/linux/clk-provider.h -@@ -385,6 +385,7 @@ struct clk_divider { - #define CLK_DIVIDER_MAX_AT_ZERO BIT(6) - - extern const struct clk_ops clk_divider_ops; -+extern const struct clk_ops clk_divider_ro_ops; - - unsigned long divider_recalc_rate(struct clk_hw *hw, unsigned long parent_rate, - unsigned int val, const struct clk_div_table *table, -diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h -index 22ab246feed3..eeae401a2412 100644 ---- a/include/linux/compiler-gcc.h -+++ b/include/linux/compiler-gcc.h -@@ -199,7 +199,7 @@ - #define unreachable() __builtin_unreachable() - - /* Mark a function definition as prohibited from being cloned. */ --#define __noclone __attribute__((__noclone__)) -+#define __noclone __attribute__((__noclone__, __optimize__("no-tracer"))) - - #endif /* GCC_VERSION >= 40500 */ - -diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h -index fea160ee5803..85a868ccb493 100644 ---- a/include/linux/cpuset.h -+++ b/include/linux/cpuset.h -@@ -137,8 +137,6 @@ static inline void set_mems_allowed(nodemask_t nodemask) - task_unlock(current); - } - --extern void cpuset_post_attach_flush(void); -- - #else /* !CONFIG_CPUSETS */ - - static inline bool cpusets_enabled(void) { return false; } -@@ -245,10 +243,6 @@ static inline bool read_mems_allowed_retry(unsigned int seq) - return false; - } - --static inline void cpuset_post_attach_flush(void) --{ --} -- - #endif /* !CONFIG_CPUSETS */ - - #endif /* _LINUX_CPUSET_H */ -diff --git a/include/linux/dcache.h b/include/linux/dcache.h -index c4b5f4b3f8f8..96c1a2da92d7 100644 ---- a/include/linux/dcache.h -+++ b/include/linux/dcache.h -@@ -161,6 +161,7 @@ struct dentry_operations { - struct vfsmount *(*d_automount)(struct path *); - int (*d_manage)(struct dentry *, bool); - struct inode *(*d_select_inode)(struct dentry *, unsigned); -+ struct dentry *(*d_real)(struct dentry *, struct inode *); - } ____cacheline_aligned; - - /* -@@ -227,6 +228,7 @@ struct dentry_operations { - #define DCACHE_MAY_FREE 0x00800000 - #define DCACHE_FALLTHRU 0x01000000 /* Fall through to lower layer */ - #define DCACHE_OP_SELECT_INODE 0x02000000 /* Unioned entry: dcache op selects inode */ -+#define DCACHE_OP_REAL 0x08000000 - - extern seqlock_t rename_lock; - -@@ -582,4 +584,24 @@ static inline struct dentry *d_backing_dentry(struct dentry *upper) - return upper; - } - -+static inline struct dentry *d_real(struct dentry *dentry) -+{ -+ if (unlikely(dentry->d_flags & DCACHE_OP_REAL)) -+ return dentry->d_op->d_real(dentry, NULL); -+ else -+ return dentry; -+} -+ -+static inline struct inode *vfs_select_inode(struct dentry *dentry, -+ unsigned open_flags) -+{ -+ struct inode *inode = d_inode(dentry); -+ -+ if (inode && unlikely(dentry->d_flags & DCACHE_OP_SELECT_INODE)) -+ inode = dentry->d_op->d_select_inode(dentry, open_flags); -+ -+ return inode; -+} -+ -+ - #endif /* __LINUX_DCACHE_H */ -diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h -index ec1c61c87d89..899ab9f8549e 100644 ---- a/include/linux/device-mapper.h -+++ b/include/linux/device-mapper.h -@@ -124,6 +124,8 @@ struct dm_dev { - char name[16]; - }; - -+dev_t dm_get_dev_t(const char *path); -+ - /* - * Constructors should call these functions to ensure destination devices - * are opened/closed correctly. -diff --git a/include/linux/filter.h b/include/linux/filter.h -index 43aa1f8855c7..a51a5361695f 100644 ---- a/include/linux/filter.h -+++ b/include/linux/filter.h -@@ -465,10 +465,14 @@ int bpf_prog_create_from_user(struct bpf_prog **pfp, struct sock_fprog *fprog, - void bpf_prog_destroy(struct bpf_prog *fp); - - int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk); -+int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk, -+ bool locked); - int sk_attach_bpf(u32 ufd, struct sock *sk); - int sk_reuseport_attach_filter(struct sock_fprog *fprog, struct sock *sk); - int sk_reuseport_attach_bpf(u32 ufd, struct sock *sk); - int sk_detach_filter(struct sock *sk); -+int __sk_detach_filter(struct sock *sk, bool locked); -+ - int sk_get_filter(struct sock *sk, struct sock_filter __user *filter, - unsigned int len); - -diff --git a/include/linux/fs.h b/include/linux/fs.h -index ae681002100a..83c77b093ce2 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -1234,6 +1234,16 @@ static inline struct inode *file_inode(const struct file *f) - return f->f_inode; - } - -+static inline struct dentry *file_dentry(const struct file *file) -+{ -+ struct dentry *dentry = file->f_path.dentry; -+ -+ if (unlikely(dentry->d_flags & DCACHE_OP_REAL)) -+ return dentry->d_op->d_real(dentry, file_inode(file)); -+ else -+ return dentry; -+} -+ - static inline int locks_lock_file_wait(struct file *filp, struct file_lock *fl) - { - return locks_lock_inode_wait(file_inode(filp), fl); -@@ -2259,7 +2269,7 @@ extern long do_sys_open(int dfd, const char __user *filename, int flags, - extern struct file *file_open_name(struct filename *, int, umode_t); - extern struct file *filp_open(const char *, int, umode_t); - extern struct file *file_open_root(struct dentry *, struct vfsmount *, -- const char *, int); -+ const char *, int, umode_t); - extern struct file * dentry_open(const struct path *, int, const struct cred *); - extern int filp_close(struct file *, fl_owner_t id); - -diff --git a/include/linux/hash.h b/include/linux/hash.h -index 1afde47e1528..79c52fa81cac 100644 ---- a/include/linux/hash.h -+++ b/include/linux/hash.h -@@ -32,12 +32,28 @@ - #error Wordsize not 32 or 64 - #endif - -+/* -+ * The above primes are actively bad for hashing, since they are -+ * too sparse. The 32-bit one is mostly ok, the 64-bit one causes -+ * real problems. Besides, the "prime" part is pointless for the -+ * multiplicative hash. -+ * -+ * Although a random odd number will do, it turns out that the golden -+ * ratio phi = (sqrt(5)-1)/2, or its negative, has particularly nice -+ * properties. -+ * -+ * These are the negative, (1 - phi) = (phi^2) = (3 - sqrt(5))/2. -+ * (See Knuth vol 3, section 6.4, exercise 9.) -+ */ -+#define GOLDEN_RATIO_32 0x61C88647 -+#define GOLDEN_RATIO_64 0x61C8864680B583EBull -+ - static __always_inline u64 hash_64(u64 val, unsigned int bits) - { - u64 hash = val; - --#if defined(CONFIG_ARCH_HAS_FAST_MULTIPLIER) && BITS_PER_LONG == 64 -- hash = hash * GOLDEN_RATIO_PRIME_64; -+#if BITS_PER_LONG == 64 -+ hash = hash * GOLDEN_RATIO_64; - #else - /* Sigh, gcc can't optimise this alone like it does for 32 bits. */ - u64 n = hash; -diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h -index a338a688ee4a..dcb89e3515db 100644 ---- a/include/linux/if_bridge.h -+++ b/include/linux/if_bridge.h -@@ -46,10 +46,6 @@ struct br_ip_list { - #define BR_LEARNING_SYNC BIT(9) - #define BR_PROXYARP_WIFI BIT(10) - --/* values as per ieee8021QBridgeFdbAgingTime */ --#define BR_MIN_AGEING_TIME (10 * HZ) --#define BR_MAX_AGEING_TIME (1000000 * HZ) -- - #define BR_DEFAULT_AGEING_TIME (300 * HZ) - - extern void brioctl_set(int (*ioctl_hook)(struct net *, unsigned int, void __user *)); -diff --git a/include/linux/kernel.h b/include/linux/kernel.h -index f31638c6e873..95452f72349a 100644 ---- a/include/linux/kernel.h -+++ b/include/linux/kernel.h -@@ -635,7 +635,7 @@ do { \ - - #define do_trace_printk(fmt, args...) \ - do { \ -- static const char *trace_printk_fmt \ -+ static const char *trace_printk_fmt __used \ - __attribute__((section("__trace_printk_fmt"))) = \ - __builtin_constant_p(fmt) ? fmt : NULL; \ - \ -@@ -679,7 +679,7 @@ int __trace_printk(unsigned long ip, const char *fmt, ...); - */ - - #define trace_puts(str) ({ \ -- static const char *trace_printk_fmt \ -+ static const char *trace_printk_fmt __used \ - __attribute__((section("__trace_printk_fmt"))) = \ - __builtin_constant_p(str) ? str : NULL; \ - \ -@@ -701,7 +701,7 @@ extern void trace_dump_stack(int skip); - #define ftrace_vprintk(fmt, vargs) \ - do { \ - if (__builtin_constant_p(fmt)) { \ -- static const char *trace_printk_fmt \ -+ static const char *trace_printk_fmt __used \ - __attribute__((section("__trace_printk_fmt"))) = \ - __builtin_constant_p(fmt) ? fmt : NULL; \ - \ -diff --git a/include/linux/mfd/samsung/s2mps11.h b/include/linux/mfd/samsung/s2mps11.h -index b288965e8101..2c14eeca46f0 100644 ---- a/include/linux/mfd/samsung/s2mps11.h -+++ b/include/linux/mfd/samsung/s2mps11.h -@@ -173,10 +173,12 @@ enum s2mps11_regulators { - - #define S2MPS11_LDO_VSEL_MASK 0x3F - #define S2MPS11_BUCK_VSEL_MASK 0xFF -+#define S2MPS11_BUCK9_VSEL_MASK 0x1F - #define S2MPS11_ENABLE_MASK (0x03 << S2MPS11_ENABLE_SHIFT) - #define S2MPS11_ENABLE_SHIFT 0x06 - #define S2MPS11_LDO_N_VOLTAGES (S2MPS11_LDO_VSEL_MASK + 1) - #define S2MPS11_BUCK_N_VOLTAGES (S2MPS11_BUCK_VSEL_MASK + 1) -+#define S2MPS11_BUCK9_N_VOLTAGES (S2MPS11_BUCK9_VSEL_MASK + 1) - #define S2MPS11_RAMP_DELAY 25000 /* uV/us */ - - #define S2MPS11_CTRL1_PWRHOLD_MASK BIT(4) -diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h -index 987764afa65c..f8b83792939b 100644 ---- a/include/linux/mlx5/device.h -+++ b/include/linux/mlx5/device.h -@@ -363,6 +363,17 @@ enum { - MLX5_CAP_OFF_CMDIF_CSUM = 46, - }; - -+enum { -+ /* -+ * Max wqe size for rdma read is 512 bytes, so this -+ * limits our max_sge_rd as the wqe needs to fit: -+ * - ctrl segment (16 bytes) -+ * - rdma segment (16 bytes) -+ * - scatter elements (16 bytes each) -+ */ -+ MLX5_MAX_SGE_RD = (512 - 16 - 16) / 16 -+}; -+ - struct mlx5_inbox_hdr { - __be16 opcode; - u8 rsvd[4]; -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 1e3006dcf35d..46dd88e7071b 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -813,9 +813,9 @@ int mlx5_set_port_admin_status(struct mlx5_core_dev *dev, - int mlx5_query_port_admin_status(struct mlx5_core_dev *dev, - enum mlx5_port_status *status); - --int mlx5_set_port_mtu(struct mlx5_core_dev *dev, int mtu, u8 port); --void mlx5_query_port_max_mtu(struct mlx5_core_dev *dev, int *max_mtu, u8 port); --void mlx5_query_port_oper_mtu(struct mlx5_core_dev *dev, int *oper_mtu, -+int mlx5_set_port_mtu(struct mlx5_core_dev *dev, u16 mtu, u8 port); -+void mlx5_query_port_max_mtu(struct mlx5_core_dev *dev, u16 *max_mtu, u8 port); -+void mlx5_query_port_oper_mtu(struct mlx5_core_dev *dev, u16 *oper_mtu, - u8 port); - - int mlx5_query_port_vl_hw_cap(struct mlx5_core_dev *dev, -diff --git a/include/linux/mlx5/vport.h b/include/linux/mlx5/vport.h -index 123771003e68..a3f3c71124d3 100644 ---- a/include/linux/mlx5/vport.h -+++ b/include/linux/mlx5/vport.h -@@ -45,6 +45,8 @@ int mlx5_query_nic_vport_mac_address(struct mlx5_core_dev *mdev, - u16 vport, u8 *addr); - int mlx5_modify_nic_vport_mac_address(struct mlx5_core_dev *dev, - u16 vport, u8 *addr); -+int mlx5_query_nic_vport_mtu(struct mlx5_core_dev *mdev, u16 *mtu); -+int mlx5_modify_nic_vport_mtu(struct mlx5_core_dev *mdev, u16 mtu); - int mlx5_query_nic_vport_system_image_guid(struct mlx5_core_dev *mdev, - u64 *system_image_guid); - int mlx5_query_nic_vport_node_guid(struct mlx5_core_dev *mdev, u64 *node_guid); -diff --git a/include/linux/mm.h b/include/linux/mm.h -index 516e14944339..e4e59f9d82f1 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -456,11 +456,20 @@ static inline int page_mapcount(struct page *page) - - #ifdef CONFIG_TRANSPARENT_HUGEPAGE - int total_mapcount(struct page *page); -+int page_trans_huge_mapcount(struct page *page, int *total_mapcount); - #else - static inline int total_mapcount(struct page *page) - { - return page_mapcount(page); - } -+static inline int page_trans_huge_mapcount(struct page *page, -+ int *total_mapcount) -+{ -+ int mapcount = page_mapcount(page); -+ if (total_mapcount) -+ *total_mapcount = mapcount; -+ return mapcount; -+} - #endif - - static inline int page_count(struct page *page) -@@ -1010,6 +1019,8 @@ static inline bool page_mapped(struct page *page) - page = compound_head(page); - if (atomic_read(compound_mapcount_ptr(page)) >= 0) - return true; -+ if (PageHuge(page)) -+ return false; - for (i = 0; i < hpage_nr_pages(page); i++) { - if (atomic_read(&page[i]._mapcount) >= 0) - return true; -@@ -1117,6 +1128,8 @@ struct zap_details { - - struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr, - pte_t pte); -+struct page *vm_normal_page_pmd(struct vm_area_struct *vma, unsigned long addr, -+ pmd_t pmd); - - int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address, - unsigned long size); -diff --git a/include/linux/net.h b/include/linux/net.h -index 0b4ac7da583a..25ef630f1bd6 100644 ---- a/include/linux/net.h -+++ b/include/linux/net.h -@@ -245,7 +245,15 @@ do { \ - net_ratelimited_function(pr_warn, fmt, ##__VA_ARGS__) - #define net_info_ratelimited(fmt, ...) \ - net_ratelimited_function(pr_info, fmt, ##__VA_ARGS__) --#if defined(DEBUG) -+#if defined(CONFIG_DYNAMIC_DEBUG) -+#define net_dbg_ratelimited(fmt, ...) \ -+do { \ -+ DEFINE_DYNAMIC_DEBUG_METADATA(descriptor, fmt); \ -+ if (unlikely(descriptor.flags & _DPRINTK_FLAGS_PRINT) && \ -+ net_ratelimit()) \ -+ __dynamic_pr_debug(&descriptor, fmt, ##__VA_ARGS__); \ -+} while (0) -+#elif defined(DEBUG) - #define net_dbg_ratelimited(fmt, ...) \ - net_ratelimited_function(pr_debug, fmt, ##__VA_ARGS__) - #else -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 5440b7b705eb..6d1d8f4f759b 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -267,6 +267,7 @@ struct header_ops { - void (*cache_update)(struct hh_cache *hh, - const struct net_device *dev, - const unsigned char *haddr); -+ bool (*validate)(const char *ll_header, unsigned int len); - }; - - /* These flag bits are private to the generic network queueing -@@ -1420,8 +1421,7 @@ enum netdev_priv_flags { - * @dma: DMA channel - * @mtu: Interface MTU value - * @type: Interface hardware type -- * @hard_header_len: Hardware header length, which means that this is the -- * minimum size of a packet. -+ * @hard_header_len: Maximum hardware header length. - * - * @needed_headroom: Extra headroom the hardware may need, but not in all - * cases can this be guaranteed -@@ -2627,6 +2627,24 @@ static inline int dev_parse_header(const struct sk_buff *skb, - return dev->header_ops->parse(skb, haddr); - } - -+/* ll_header must have at least hard_header_len allocated */ -+static inline bool dev_validate_header(const struct net_device *dev, -+ char *ll_header, int len) -+{ -+ if (likely(len >= dev->hard_header_len)) -+ return true; -+ -+ if (capable(CAP_SYS_RAWIO)) { -+ memset(ll_header + len, 0, dev->hard_header_len - len); -+ return true; -+ } -+ -+ if (dev->header_ops && dev->header_ops->validate) -+ return dev->header_ops->validate(ll_header, len); -+ -+ return false; -+} -+ - typedef int gifconf_func_t(struct net_device * dev, char __user * bufptr, int len); - int register_gifconf(unsigned int family, gifconf_func_t *gifconf); - static inline int unregister_gifconf(unsigned int family) -diff --git a/include/linux/pci.h b/include/linux/pci.h -index 27716254dcc5..60042ab5d7bd 100644 ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -359,6 +359,7 @@ struct pci_dev { - unsigned int io_window_1k:1; /* Intel P2P bridge 1K I/O windows */ - unsigned int irq_managed:1; - unsigned int has_secondary_link:1; -+ unsigned int non_compliant_bars:1; /* broken BARs; ignore them */ - pci_dev_flags_t dev_flags; - atomic_t enable_cnt; /* pci_enable_device has been called */ - -diff --git a/include/linux/platform_data/mmp_dma.h b/include/linux/platform_data/mmp_dma.h -index 2a330ec9e2af..d1397c8ed94e 100644 ---- a/include/linux/platform_data/mmp_dma.h -+++ b/include/linux/platform_data/mmp_dma.h -@@ -14,6 +14,7 @@ - - struct mmp_dma_platdata { - int dma_channels; -+ int nb_requestors; - }; - - #endif /* MMP_DMA_H */ -diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h -index 1c33dd7da4a7..4ae95f7e8597 100644 ---- a/include/linux/rculist_nulls.h -+++ b/include/linux/rculist_nulls.h -@@ -98,6 +98,45 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n, - if (!is_a_nulls(first)) - first->pprev = &n->next; - } -+ -+/** -+ * hlist_nulls_add_tail_rcu -+ * @n: the element to add to the hash list. -+ * @h: the list to add to. -+ * -+ * Description: -+ * Adds the specified element to the end of the specified hlist_nulls, -+ * while permitting racing traversals. NOTE: tail insertion requires -+ * list traversal. -+ * -+ * The caller must take whatever precautions are necessary -+ * (such as holding appropriate locks) to avoid racing -+ * with another list-mutation primitive, such as hlist_nulls_add_head_rcu() -+ * or hlist_nulls_del_rcu(), running on this same list. -+ * However, it is perfectly legal to run concurrently with -+ * the _rcu list-traversal primitives, such as -+ * hlist_nulls_for_each_entry_rcu(), used to prevent memory-consistency -+ * problems on Alpha CPUs. Regardless of the type of CPU, the -+ * list-traversal primitive must be guarded by rcu_read_lock(). -+ */ -+static inline void hlist_nulls_add_tail_rcu(struct hlist_nulls_node *n, -+ struct hlist_nulls_head *h) -+{ -+ struct hlist_nulls_node *i, *last = NULL; -+ -+ for (i = hlist_nulls_first_rcu(h); !is_a_nulls(i); -+ i = hlist_nulls_next_rcu(i)) -+ last = i; -+ -+ if (last) { -+ n->next = last->next; -+ n->pprev = &last->next; -+ rcu_assign_pointer(hlist_nulls_next_rcu(last), n); -+ } else { -+ hlist_nulls_add_head_rcu(n, h); -+ } -+} -+ - /** - * hlist_nulls_for_each_entry_rcu - iterate over rcu list of given type - * @tpos: the type * to use as a loop cursor. -diff --git a/include/linux/signal.h b/include/linux/signal.h -index 92557bbce7e7..d80259afb9e5 100644 ---- a/include/linux/signal.h -+++ b/include/linux/signal.h -@@ -28,6 +28,21 @@ struct sigpending { - sigset_t signal; - }; - -+#ifndef HAVE_ARCH_COPY_SIGINFO -+ -+#include -+ -+static inline void copy_siginfo(struct siginfo *to, struct siginfo *from) -+{ -+ if (from->si_code < 0) -+ memcpy(to, from, sizeof(*to)); -+ else -+ /* _sigchld is currently the largest know union member */ -+ memcpy(to, from, __ARCH_SI_PREAMBLE_SIZE + sizeof(from->_sifields._sigchld)); -+} -+ -+#endif -+ - /* - * Define some primitives to manipulate sigset_t. - */ -diff --git a/include/linux/swap.h b/include/linux/swap.h -index d18b65c53dbb..b974a2106dd7 100644 ---- a/include/linux/swap.h -+++ b/include/linux/swap.h -@@ -418,7 +418,7 @@ extern sector_t swapdev_block(int, pgoff_t); - extern int page_swapcount(struct page *); - extern int swp_swapcount(swp_entry_t entry); - extern struct swap_info_struct *page_swap_info(struct page *); --extern int reuse_swap_page(struct page *); -+extern bool reuse_swap_page(struct page *, int *); - extern int try_to_free_swap(struct page *); - struct backing_dev_info; - -@@ -513,8 +513,8 @@ static inline int swp_swapcount(swp_entry_t entry) - return 0; - } - --#define reuse_swap_page(page) \ -- (!PageTransCompound(page) && page_mapcount(page) == 1) -+#define reuse_swap_page(page, total_mapcount) \ -+ (page_trans_huge_mapcount(page, total_mapcount) == 1) - - static inline int try_to_free_swap(struct page *page) - { -@@ -533,6 +533,10 @@ static inline swp_entry_t get_swap_page(void) - #ifdef CONFIG_MEMCG - static inline int mem_cgroup_swappiness(struct mem_cgroup *memcg) - { -+ /* Cgroup2 doesn't have per-cgroup swappiness */ -+ if (cgroup_subsys_on_dfl(memory_cgrp_subsys)) -+ return vm_swappiness; -+ - /* root ? */ - if (mem_cgroup_disabled() || !memcg->css.parent) - return vm_swappiness; -diff --git a/include/linux/thermal.h b/include/linux/thermal.h -index e13a1ace50e9..4a849f19e6c9 100644 ---- a/include/linux/thermal.h -+++ b/include/linux/thermal.h -@@ -156,6 +156,7 @@ struct thermal_attr { - * @trip_hyst_attrs: attributes for trip points for sysfs: trip hysteresis - * @devdata: private pointer for device private data - * @trips: number of trip points the thermal zone supports -+ * @trips_disabled; bitmap for disabled trips - * @passive_delay: number of milliseconds to wait between polls when - * performing passive cooling. - * @polling_delay: number of milliseconds to wait between polls when -@@ -191,6 +192,7 @@ struct thermal_zone_device { - struct thermal_attr *trip_hyst_attrs; - void *devdata; - int trips; -+ unsigned long trips_disabled; /* bitmap for disabled trips */ - int passive_delay; - int polling_delay; - int temperature; -diff --git a/include/linux/tty.h b/include/linux/tty.h -index d9fb4b043f56..e5b996d887ce 100644 ---- a/include/linux/tty.h -+++ b/include/linux/tty.h -@@ -338,7 +338,6 @@ struct tty_file_private { - #define TTY_EXCLUSIVE 3 /* Exclusive open mode */ - #define TTY_DEBUG 4 /* Debugging */ - #define TTY_DO_WRITE_WAKEUP 5 /* Call write_wakeup after queuing new */ --#define TTY_OTHER_DONE 6 /* Closed pty has completed input processing */ - #define TTY_LDISC_OPEN 11 /* Line discipline is open */ - #define TTY_PTY_LOCK 16 /* pty private */ - #define TTY_NO_WRITE_SPLIT 17 /* Preserve write boundaries to driver */ -@@ -464,6 +463,7 @@ extern void tty_buffer_init(struct tty_port *port); - extern void tty_buffer_set_lock_subclass(struct tty_port *port); - extern bool tty_buffer_restart_work(struct tty_port *port); - extern bool tty_buffer_cancel_work(struct tty_port *port); -+extern void tty_buffer_flush_work(struct tty_port *port); - extern speed_t tty_termios_baud_rate(struct ktermios *termios); - extern speed_t tty_termios_input_baud_rate(struct ktermios *termios); - extern void tty_termios_encode_baud_rate(struct ktermios *termios, -@@ -589,7 +589,7 @@ static inline int tty_ldisc_receive_buf(struct tty_ldisc *ld, unsigned char *p, - count = ld->ops->receive_buf2(ld->tty, p, f, count); - else { - count = min_t(int, count, ld->tty->receive_room); -- if (count) -+ if (count && ld->ops->receive_buf) - ld->ops->receive_buf(ld->tty, p, f, count); - } - return count; -diff --git a/include/linux/usb.h b/include/linux/usb.h -index 89533ba38691..f3dbc217ff41 100644 ---- a/include/linux/usb.h -+++ b/include/linux/usb.h -@@ -1066,7 +1066,7 @@ struct usbdrv_wrap { - * for interfaces bound to this driver. - * @soft_unbind: if set to 1, the USB core will not kill URBs and disable - * endpoints before calling the driver's disconnect method. -- * @disable_hub_initiated_lpm: if set to 0, the USB core will not allow hubs -+ * @disable_hub_initiated_lpm: if set to 1, the USB core will not allow hubs - * to initiate lower power link state transitions when an idle timeout - * occurs. Device-initiated USB 3.0 link PM will still be allowed. - * -diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h -index 7f5f78bd15ad..245f57dbbb61 100644 ---- a/include/linux/usb_usual.h -+++ b/include/linux/usb_usual.h -@@ -79,6 +79,8 @@ - /* Cannot handle MI_REPORT_SUPPORTED_OPERATION_CODES */ \ - US_FLAG(MAX_SECTORS_240, 0x08000000) \ - /* Sets max_sectors to 240 */ \ -+ US_FLAG(NO_REPORT_LUNS, 0x10000000) \ -+ /* Cannot handle REPORT_LUNS */ \ - - #define US_FLAG(name, value) US_FL_##name = value , - enum { US_DO_ALL_FLAGS }; -diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h -index 8a0f55b6c2ba..88e3ab496e8f 100644 ---- a/include/media/videobuf2-core.h -+++ b/include/media/videobuf2-core.h -@@ -375,6 +375,9 @@ struct vb2_ops { - /** - * struct vb2_ops - driver-specific callbacks - * -+ * @verify_planes_array: Verify that a given user space structure contains -+ * enough planes for the buffer. This is called -+ * for each dequeued buffer. - * @fill_user_buffer: given a vb2_buffer fill in the userspace structure. - * For V4L2 this is a struct v4l2_buffer. - * @fill_vb2_buffer: given a userspace structure, fill in the vb2_buffer. -@@ -384,6 +387,7 @@ struct vb2_ops { - * the vb2_buffer struct. - */ - struct vb2_buf_ops { -+ int (*verify_planes_array)(struct vb2_buffer *vb, const void *pb); - void (*fill_user_buffer)(struct vb2_buffer *vb, void *pb); - int (*fill_vb2_buffer)(struct vb2_buffer *vb, const void *pb, - struct vb2_plane *planes); -@@ -400,6 +404,9 @@ struct vb2_buf_ops { - * @fileio_read_once: report EOF after reading the first buffer - * @fileio_write_immediately: queue buffer after each write() call - * @allow_zero_bytesused: allow bytesused == 0 to be passed to the driver -+ * @quirk_poll_must_check_waiting_for_buffers: Return POLLERR at poll when QBUF -+ * has not been called. This is a vb1 idiom that has been adopted -+ * also by vb2. - * @lock: pointer to a mutex that protects the vb2_queue struct. The - * driver can set this to a mutex to let the v4l2 core serialize - * the queuing ioctls. If the driver wants to handle locking -@@ -463,6 +470,7 @@ struct vb2_queue { - unsigned fileio_read_once:1; - unsigned fileio_write_immediately:1; - unsigned allow_zero_bytesused:1; -+ unsigned quirk_poll_must_check_waiting_for_buffers:1; - - struct mutex *lock; - void *owner; -diff --git a/include/net/bonding.h b/include/net/bonding.h -index ee6c52053aa3..791800ddd6d9 100644 ---- a/include/net/bonding.h -+++ b/include/net/bonding.h -@@ -215,6 +215,7 @@ struct bonding { - * ALB mode (6) - to sync the use and modifications of its hash table - */ - spinlock_t mode_lock; -+ spinlock_t stats_lock; - u8 send_peer_notif; - u8 igmp_retrans; - #ifdef CONFIG_PROC_FS -diff --git a/include/net/codel.h b/include/net/codel.h -index 267e70210061..d168aca115cc 100644 ---- a/include/net/codel.h -+++ b/include/net/codel.h -@@ -162,12 +162,14 @@ struct codel_vars { - * struct codel_stats - contains codel shared variables and stats - * @maxpacket: largest packet we've seen so far - * @drop_count: temp count of dropped packets in dequeue() -+ * @drop_len: bytes of dropped packets in dequeue() - * ecn_mark: number of packets we ECN marked instead of dropping - * ce_mark: number of packets CE marked because sojourn time was above ce_threshold - */ - struct codel_stats { - u32 maxpacket; - u32 drop_count; -+ u32 drop_len; - u32 ecn_mark; - u32 ce_mark; - }; -@@ -308,6 +310,7 @@ static struct sk_buff *codel_dequeue(struct Qdisc *sch, - vars->rec_inv_sqrt); - goto end; - } -+ stats->drop_len += qdisc_pkt_len(skb); - qdisc_drop(skb, sch); - stats->drop_count++; - skb = dequeue_func(vars, sch); -@@ -330,6 +333,7 @@ static struct sk_buff *codel_dequeue(struct Qdisc *sch, - if (params->ecn && INET_ECN_set_ce(skb)) { - stats->ecn_mark++; - } else { -+ stats->drop_len += qdisc_pkt_len(skb); - qdisc_drop(skb, sch); - stats->drop_count++; - -diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h -index 0816c872b689..a6cc576fd467 100644 ---- a/include/net/ip_vs.h -+++ b/include/net/ip_vs.h -@@ -1588,6 +1588,23 @@ static inline void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp) - } - #endif /* CONFIG_IP_VS_NFCT */ - -+/* Really using conntrack? */ -+static inline bool ip_vs_conn_uses_conntrack(struct ip_vs_conn *cp, -+ struct sk_buff *skb) -+{ -+#ifdef CONFIG_IP_VS_NFCT -+ enum ip_conntrack_info ctinfo; -+ struct nf_conn *ct; -+ -+ if (!(cp->flags & IP_VS_CONN_F_NFCT)) -+ return false; -+ ct = nf_ct_get(skb, &ctinfo); -+ if (ct && !nf_ct_is_untracked(ct)) -+ return true; -+#endif -+ return false; -+} -+ - static inline int - ip_vs_dest_conn_overhead(struct ip_vs_dest *dest) - { -diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h -index 636a362a0e03..e5bba897d206 100644 ---- a/include/net/sch_generic.h -+++ b/include/net/sch_generic.h -@@ -396,7 +396,8 @@ struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue, - struct Qdisc *qdisc); - void qdisc_reset(struct Qdisc *qdisc); - void qdisc_destroy(struct Qdisc *qdisc); --void qdisc_tree_decrease_qlen(struct Qdisc *qdisc, unsigned int n); -+void qdisc_tree_reduce_backlog(struct Qdisc *qdisc, unsigned int n, -+ unsigned int len); - struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue, - const struct Qdisc_ops *ops); - struct Qdisc *qdisc_create_dflt(struct netdev_queue *dev_queue, -@@ -707,6 +708,23 @@ static inline void qdisc_reset_queue(struct Qdisc *sch) - sch->qstats.backlog = 0; - } - -+static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new, -+ struct Qdisc **pold) -+{ -+ struct Qdisc *old; -+ -+ sch_tree_lock(sch); -+ old = *pold; -+ *pold = new; -+ if (old != NULL) { -+ qdisc_tree_reduce_backlog(old, old->q.qlen, old->qstats.backlog); -+ qdisc_reset(old); -+ } -+ sch_tree_unlock(sch); -+ -+ return old; -+} -+ - static inline unsigned int __qdisc_queue_drop(struct Qdisc *sch, - struct sk_buff_head *list) - { -diff --git a/include/net/sock.h b/include/net/sock.h -index f5ea148853e2..3c688ca3456d 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -630,7 +630,11 @@ static inline void sk_add_node_rcu(struct sock *sk, struct hlist_head *list) - - static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) - { -- hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); -+ if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport && -+ sk->sk_family == AF_INET6) -+ hlist_nulls_add_tail_rcu(&sk->sk_nulls_node, list); -+ else -+ hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); - } - - static inline void sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) -diff --git a/include/rdma/ib.h b/include/rdma/ib.h -index cf8f9e700e48..a6b93706b0fc 100644 ---- a/include/rdma/ib.h -+++ b/include/rdma/ib.h -@@ -34,6 +34,7 @@ - #define _RDMA_IB_H - - #include -+#include - - struct ib_addr { - union { -@@ -86,4 +87,19 @@ struct sockaddr_ib { - __u64 sib_scope_id; - }; - -+/* -+ * The IB interfaces that use write() as bi-directional ioctl() are -+ * fundamentally unsafe, since there are lots of ways to trigger "write()" -+ * calls from various contexts with elevated privileges. That includes the -+ * traditional suid executable error message writes, but also various kernel -+ * interfaces that can write to file descriptors. -+ * -+ * This function provides protection for the legacy API by restricting the -+ * calling context. -+ */ -+static inline bool ib_safe_file_access(struct file *filp) -+{ -+ return filp->f_cred == current_cred() && segment_eq(get_fs(), USER_DS); -+} -+ - #endif /* _RDMA_IB_H */ -diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h -index f63a16760ae9..a5d31f794cac 100644 ---- a/include/scsi/scsi_device.h -+++ b/include/scsi/scsi_device.h -@@ -240,6 +240,7 @@ scmd_printk(const char *, const struct scsi_cmnd *, const char *, ...); - enum scsi_target_state { - STARGET_CREATED = 1, - STARGET_RUNNING, -+ STARGET_REMOVE, - STARGET_DEL, - }; - -@@ -513,6 +514,31 @@ static inline int scsi_device_tpgs(struct scsi_device *sdev) - return sdev->inquiry ? (sdev->inquiry[5] >> 4) & 0x3 : 0; - } - -+/** -+ * scsi_device_supports_vpd - test if a device supports VPD pages -+ * @sdev: the &struct scsi_device to test -+ * -+ * If the 'try_vpd_pages' flag is set it takes precedence. -+ * Otherwise we will assume VPD pages are supported if the -+ * SCSI level is at least SPC-3 and 'skip_vpd_pages' is not set. -+ */ -+static inline int scsi_device_supports_vpd(struct scsi_device *sdev) -+{ -+ /* Attempt VPD inquiry if the device blacklist explicitly calls -+ * for it. -+ */ -+ if (sdev->try_vpd_pages) -+ return 1; -+ /* -+ * Although VPD inquiries can go to SCSI-2 type devices, -+ * some USB ones crash on receiving them, and the pages -+ * we currently ask for are for SPC-3 and beyond -+ */ -+ if (sdev->scsi_level > SCSI_SPC_2 && !sdev->skip_vpd_pages) -+ return 1; -+ return 0; -+} -+ - #define MODULE_ALIAS_SCSI_DEVICE(type) \ - MODULE_ALIAS("scsi:t-" __stringify(type) "*") - #define SCSI_DEVICE_MODALIAS_FMT "scsi:t-0x%02x" -diff --git a/include/sound/hda_i915.h b/include/sound/hda_i915.h -index fa341fcb5829..f5842bcd9c94 100644 ---- a/include/sound/hda_i915.h -+++ b/include/sound/hda_i915.h -@@ -9,7 +9,7 @@ - #ifdef CONFIG_SND_HDA_I915 - int snd_hdac_set_codec_wakeup(struct hdac_bus *bus, bool enable); - int snd_hdac_display_power(struct hdac_bus *bus, bool enable); --int snd_hdac_get_display_clk(struct hdac_bus *bus); -+void snd_hdac_i915_set_bclk(struct hdac_bus *bus); - int snd_hdac_sync_audio_rate(struct hdac_bus *bus, hda_nid_t nid, int rate); - int snd_hdac_acomp_get_eld(struct hdac_bus *bus, hda_nid_t nid, - bool *audio_enabled, char *buffer, int max_bytes); -@@ -25,9 +25,8 @@ static inline int snd_hdac_display_power(struct hdac_bus *bus, bool enable) - { - return 0; - } --static inline int snd_hdac_get_display_clk(struct hdac_bus *bus) -+static inline void snd_hdac_i915_set_bclk(struct hdac_bus *bus) - { -- return 0; - } - static inline int snd_hdac_sync_audio_rate(struct hdac_bus *bus, hda_nid_t nid, - int rate) -diff --git a/include/sound/hdaudio.h b/include/sound/hdaudio.h -index c21c38ce7450..93e63c56f48f 100644 ---- a/include/sound/hdaudio.h -+++ b/include/sound/hdaudio.h -@@ -168,11 +168,13 @@ int snd_hdac_power_up(struct hdac_device *codec); - int snd_hdac_power_down(struct hdac_device *codec); - int snd_hdac_power_up_pm(struct hdac_device *codec); - int snd_hdac_power_down_pm(struct hdac_device *codec); -+int snd_hdac_keep_power_up(struct hdac_device *codec); - #else - static inline int snd_hdac_power_up(struct hdac_device *codec) { return 0; } - static inline int snd_hdac_power_down(struct hdac_device *codec) { return 0; } - static inline int snd_hdac_power_up_pm(struct hdac_device *codec) { return 0; } - static inline int snd_hdac_power_down_pm(struct hdac_device *codec) { return 0; } -+static inline int snd_hdac_keep_power_up(struct hdac_device *codec) { return 0; } - #endif - - /* -diff --git a/include/uapi/linux/if.h b/include/uapi/linux/if.h -index 9cf2394f0bcf..752f5dc040a5 100644 ---- a/include/uapi/linux/if.h -+++ b/include/uapi/linux/if.h -@@ -19,14 +19,20 @@ - #ifndef _LINUX_IF_H - #define _LINUX_IF_H - -+#include /* for compatibility with glibc */ - #include /* for "__kernel_caddr_t" et al */ - #include /* for "struct sockaddr" et al */ - #include /* for "__user" et al */ - -+#if __UAPI_DEF_IF_IFNAMSIZ - #define IFNAMSIZ 16 -+#endif /* __UAPI_DEF_IF_IFNAMSIZ */ - #define IFALIASZ 256 - #include - -+/* For glibc compatibility. An empty enum does not compile. */ -+#if __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO != 0 && \ -+ __UAPI_DEF_IF_NET_DEVICE_FLAGS != 0 - /** - * enum net_device_flags - &struct net_device flags - * -@@ -68,6 +74,8 @@ - * @IFF_ECHO: echo sent packets. Volatile. - */ - enum net_device_flags { -+/* for compatibility with glibc net/if.h */ -+#if __UAPI_DEF_IF_NET_DEVICE_FLAGS - IFF_UP = 1<<0, /* sysfs */ - IFF_BROADCAST = 1<<1, /* volatile */ - IFF_DEBUG = 1<<2, /* sysfs */ -@@ -84,11 +92,17 @@ enum net_device_flags { - IFF_PORTSEL = 1<<13, /* sysfs */ - IFF_AUTOMEDIA = 1<<14, /* sysfs */ - IFF_DYNAMIC = 1<<15, /* sysfs */ -+#endif /* __UAPI_DEF_IF_NET_DEVICE_FLAGS */ -+#if __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO - IFF_LOWER_UP = 1<<16, /* volatile */ - IFF_DORMANT = 1<<17, /* volatile */ - IFF_ECHO = 1<<18, /* volatile */ -+#endif /* __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO */ - }; -+#endif /* __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO != 0 && __UAPI_DEF_IF_NET_DEVICE_FLAGS != 0 */ - -+/* for compatibility with glibc net/if.h */ -+#if __UAPI_DEF_IF_NET_DEVICE_FLAGS - #define IFF_UP IFF_UP - #define IFF_BROADCAST IFF_BROADCAST - #define IFF_DEBUG IFF_DEBUG -@@ -105,9 +119,13 @@ enum net_device_flags { - #define IFF_PORTSEL IFF_PORTSEL - #define IFF_AUTOMEDIA IFF_AUTOMEDIA - #define IFF_DYNAMIC IFF_DYNAMIC -+#endif /* __UAPI_DEF_IF_NET_DEVICE_FLAGS */ -+ -+#if __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO - #define IFF_LOWER_UP IFF_LOWER_UP - #define IFF_DORMANT IFF_DORMANT - #define IFF_ECHO IFF_ECHO -+#endif /* __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO */ - - #define IFF_VOLATILE (IFF_LOOPBACK|IFF_POINTOPOINT|IFF_BROADCAST|IFF_ECHO|\ - IFF_MASTER|IFF_SLAVE|IFF_RUNNING|IFF_LOWER_UP|IFF_DORMANT) -@@ -166,6 +184,8 @@ enum { - * being very small might be worth keeping for clean configuration. - */ - -+/* for compatibility with glibc net/if.h */ -+#if __UAPI_DEF_IF_IFMAP - struct ifmap { - unsigned long mem_start; - unsigned long mem_end; -@@ -175,6 +195,7 @@ struct ifmap { - unsigned char port; - /* 3 bytes spare */ - }; -+#endif /* __UAPI_DEF_IF_IFMAP */ - - struct if_settings { - unsigned int type; /* Type of physical device or protocol */ -@@ -200,6 +221,8 @@ struct if_settings { - * remainder may be interface specific. - */ - -+/* for compatibility with glibc net/if.h */ -+#if __UAPI_DEF_IF_IFREQ - struct ifreq { - #define IFHWADDRLEN 6 - union -@@ -223,6 +246,7 @@ struct ifreq { - struct if_settings ifru_settings; - } ifr_ifru; - }; -+#endif /* __UAPI_DEF_IF_IFREQ */ - - #define ifr_name ifr_ifrn.ifrn_name /* interface name */ - #define ifr_hwaddr ifr_ifru.ifru_hwaddr /* MAC address */ -@@ -249,6 +273,8 @@ struct ifreq { - * must know all networks accessible). - */ - -+/* for compatibility with glibc net/if.h */ -+#if __UAPI_DEF_IF_IFCONF - struct ifconf { - int ifc_len; /* size of buffer */ - union { -@@ -256,6 +282,8 @@ struct ifconf { - struct ifreq __user *ifcu_req; - } ifc_ifcu; - }; -+#endif /* __UAPI_DEF_IF_IFCONF */ -+ - #define ifc_buf ifc_ifcu.ifcu_buf /* buffer address */ - #define ifc_req ifc_ifcu.ifcu_req /* array of structures */ - -diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h -index 7d024ceb075d..d5e38c73377c 100644 ---- a/include/uapi/linux/libc-compat.h -+++ b/include/uapi/linux/libc-compat.h -@@ -51,6 +51,40 @@ - /* We have included glibc headers... */ - #if defined(__GLIBC__) - -+/* Coordinate with glibc net/if.h header. */ -+#if defined(_NET_IF_H) -+ -+/* GLIBC headers included first so don't define anything -+ * that would already be defined. */ -+ -+#define __UAPI_DEF_IF_IFCONF 0 -+#define __UAPI_DEF_IF_IFMAP 0 -+#define __UAPI_DEF_IF_IFNAMSIZ 0 -+#define __UAPI_DEF_IF_IFREQ 0 -+/* Everything up to IFF_DYNAMIC, matches net/if.h until glibc 2.23 */ -+#define __UAPI_DEF_IF_NET_DEVICE_FLAGS 0 -+/* For the future if glibc adds IFF_LOWER_UP, IFF_DORMANT and IFF_ECHO */ -+#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO -+#define __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO 1 -+#endif /* __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO */ -+ -+#else /* _NET_IF_H */ -+ -+/* Linux headers included first, and we must define everything -+ * we need. The expectation is that glibc will check the -+ * __UAPI_DEF_* defines and adjust appropriately. */ -+ -+#define __UAPI_DEF_IF_IFCONF 1 -+#define __UAPI_DEF_IF_IFMAP 1 -+#define __UAPI_DEF_IF_IFNAMSIZ 1 -+#define __UAPI_DEF_IF_IFREQ 1 -+/* Everything up to IFF_DYNAMIC, matches net/if.h until glibc 2.23 */ -+#define __UAPI_DEF_IF_NET_DEVICE_FLAGS 1 -+/* For the future if glibc adds IFF_LOWER_UP, IFF_DORMANT and IFF_ECHO */ -+#define __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO 1 -+ -+#endif /* _NET_IF_H */ -+ - /* Coordinate with glibc netinet/in.h header. */ - #if defined(_NETINET_IN_H) - -@@ -117,6 +151,16 @@ - * that we need. */ - #else /* !defined(__GLIBC__) */ - -+/* Definitions for if.h */ -+#define __UAPI_DEF_IF_IFCONF 1 -+#define __UAPI_DEF_IF_IFMAP 1 -+#define __UAPI_DEF_IF_IFNAMSIZ 1 -+#define __UAPI_DEF_IF_IFREQ 1 -+/* Everything up to IFF_DYNAMIC, matches net/if.h until glibc 2.23 */ -+#define __UAPI_DEF_IF_NET_DEVICE_FLAGS 1 -+/* For the future if glibc adds IFF_LOWER_UP, IFF_DORMANT and IFF_ECHO */ -+#define __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO 1 -+ - /* Definitions for in.h */ - #define __UAPI_DEF_IN_ADDR 1 - #define __UAPI_DEF_IN_IPPROTO 1 -diff --git a/include/uapi/linux/v4l2-dv-timings.h b/include/uapi/linux/v4l2-dv-timings.h -index c039f1d68a09..086168e18ca8 100644 ---- a/include/uapi/linux/v4l2-dv-timings.h -+++ b/include/uapi/linux/v4l2-dv-timings.h -@@ -183,7 +183,8 @@ - - #define V4L2_DV_BT_CEA_3840X2160P24 { \ - .type = V4L2_DV_BT_656_1120, \ -- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ -+ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \ -+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ - 297000000, 1276, 88, 296, 8, 10, 72, 0, 0, 0, \ - V4L2_DV_BT_STD_CEA861, \ - V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \ -@@ -191,14 +192,16 @@ - - #define V4L2_DV_BT_CEA_3840X2160P25 { \ - .type = V4L2_DV_BT_656_1120, \ -- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ -+ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \ -+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ - 297000000, 1056, 88, 296, 8, 10, 72, 0, 0, 0, \ - V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \ - } - - #define V4L2_DV_BT_CEA_3840X2160P30 { \ - .type = V4L2_DV_BT_656_1120, \ -- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ -+ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \ -+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ - 297000000, 176, 88, 296, 8, 10, 72, 0, 0, 0, \ - V4L2_DV_BT_STD_CEA861, \ - V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \ -@@ -206,14 +209,16 @@ - - #define V4L2_DV_BT_CEA_3840X2160P50 { \ - .type = V4L2_DV_BT_656_1120, \ -- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ -+ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \ -+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ - 594000000, 1056, 88, 296, 8, 10, 72, 0, 0, 0, \ - V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \ - } - - #define V4L2_DV_BT_CEA_3840X2160P60 { \ - .type = V4L2_DV_BT_656_1120, \ -- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ -+ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \ -+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ - 594000000, 176, 88, 296, 8, 10, 72, 0, 0, 0, \ - V4L2_DV_BT_STD_CEA861, \ - V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \ -@@ -221,7 +226,8 @@ - - #define V4L2_DV_BT_CEA_4096X2160P24 { \ - .type = V4L2_DV_BT_656_1120, \ -- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ -+ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \ -+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ - 297000000, 1020, 88, 296, 8, 10, 72, 0, 0, 0, \ - V4L2_DV_BT_STD_CEA861, \ - V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \ -@@ -229,14 +235,16 @@ - - #define V4L2_DV_BT_CEA_4096X2160P25 { \ - .type = V4L2_DV_BT_656_1120, \ -- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ -+ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \ -+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ - 297000000, 968, 88, 128, 8, 10, 72, 0, 0, 0, \ - V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \ - } - - #define V4L2_DV_BT_CEA_4096X2160P30 { \ - .type = V4L2_DV_BT_656_1120, \ -- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ -+ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \ -+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ - 297000000, 88, 88, 128, 8, 10, 72, 0, 0, 0, \ - V4L2_DV_BT_STD_CEA861, \ - V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \ -@@ -244,14 +252,16 @@ - - #define V4L2_DV_BT_CEA_4096X2160P50 { \ - .type = V4L2_DV_BT_656_1120, \ -- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ -+ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \ -+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ - 594000000, 968, 88, 128, 8, 10, 72, 0, 0, 0, \ - V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \ - } - - #define V4L2_DV_BT_CEA_4096X2160P60 { \ - .type = V4L2_DV_BT_656_1120, \ -- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ -+ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \ -+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ - 594000000, 88, 88, 128, 8, 10, 72, 0, 0, 0, \ - V4L2_DV_BT_STD_CEA861, \ - V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \ -diff --git a/include/xen/page.h b/include/xen/page.h -index 96294ac93755..9dc46cb8a0fd 100644 ---- a/include/xen/page.h -+++ b/include/xen/page.h -@@ -15,9 +15,9 @@ - */ - - #define xen_pfn_to_page(xen_pfn) \ -- ((pfn_to_page(((unsigned long)(xen_pfn) << XEN_PAGE_SHIFT) >> PAGE_SHIFT))) -+ (pfn_to_page((unsigned long)(xen_pfn) >> (PAGE_SHIFT - XEN_PAGE_SHIFT))) - #define page_to_xen_pfn(page) \ -- (((page_to_pfn(page)) << PAGE_SHIFT) >> XEN_PAGE_SHIFT) -+ ((page_to_pfn(page)) << (PAGE_SHIFT - XEN_PAGE_SHIFT)) - - #define XEN_PFN_PER_PAGE (PAGE_SIZE / XEN_PAGE_SIZE) - -diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c -index 4504ca66118d..50da680c479f 100644 ---- a/kernel/bpf/helpers.c -+++ b/kernel/bpf/helpers.c -@@ -166,7 +166,7 @@ static u64 bpf_get_current_comm(u64 r1, u64 size, u64 r3, u64 r4, u64 r5) - if (!task) - return -EINVAL; - -- memcpy(buf, task->comm, min_t(size_t, size, sizeof(task->comm))); -+ strlcpy(buf, task->comm, min_t(size_t, size, sizeof(task->comm))); - return 0; - } - -diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c -index f2ece3c174a5..8f94ca1860cf 100644 ---- a/kernel/bpf/inode.c -+++ b/kernel/bpf/inode.c -@@ -31,10 +31,10 @@ static void *bpf_any_get(void *raw, enum bpf_type type) - { - switch (type) { - case BPF_TYPE_PROG: -- atomic_inc(&((struct bpf_prog *)raw)->aux->refcnt); -+ raw = bpf_prog_inc(raw); - break; - case BPF_TYPE_MAP: -- bpf_map_inc(raw, true); -+ raw = bpf_map_inc(raw, true); - break; - default: - WARN_ON_ONCE(1); -@@ -297,7 +297,8 @@ static void *bpf_obj_do_get(const struct filename *pathname, - goto out; - - raw = bpf_any_get(inode->i_private, *type); -- touch_atime(&path); -+ if (!IS_ERR(raw)) -+ touch_atime(&path); - - path_put(&path); - return raw; -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index 637397059f76..aa5f39772ac4 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -201,11 +201,18 @@ struct bpf_map *__bpf_map_get(struct fd f) - return f.file->private_data; - } - --void bpf_map_inc(struct bpf_map *map, bool uref) -+/* prog's and map's refcnt limit */ -+#define BPF_MAX_REFCNT 32768 -+ -+struct bpf_map *bpf_map_inc(struct bpf_map *map, bool uref) - { -- atomic_inc(&map->refcnt); -+ if (atomic_inc_return(&map->refcnt) > BPF_MAX_REFCNT) { -+ atomic_dec(&map->refcnt); -+ return ERR_PTR(-EBUSY); -+ } - if (uref) - atomic_inc(&map->usercnt); -+ return map; - } - - struct bpf_map *bpf_map_get_with_uref(u32 ufd) -@@ -217,7 +224,7 @@ struct bpf_map *bpf_map_get_with_uref(u32 ufd) - if (IS_ERR(map)) - return map; - -- bpf_map_inc(map, true); -+ map = bpf_map_inc(map, true); - fdput(f); - - return map; -@@ -600,6 +607,15 @@ static struct bpf_prog *__bpf_prog_get(struct fd f) - return f.file->private_data; - } - -+struct bpf_prog *bpf_prog_inc(struct bpf_prog *prog) -+{ -+ if (atomic_inc_return(&prog->aux->refcnt) > BPF_MAX_REFCNT) { -+ atomic_dec(&prog->aux->refcnt); -+ return ERR_PTR(-EBUSY); -+ } -+ return prog; -+} -+ - /* called by sockets/tracing/seccomp before attaching program to an event - * pairs with bpf_prog_put() - */ -@@ -612,7 +628,7 @@ struct bpf_prog *bpf_prog_get(u32 ufd) - if (IS_ERR(prog)) - return prog; - -- atomic_inc(&prog->aux->refcnt); -+ prog = bpf_prog_inc(prog); - fdput(f); - - return prog; -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 2e7f7ab739e4..2cbfba78d3db 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -239,15 +239,6 @@ static const char * const reg_type_str[] = { - [CONST_IMM] = "imm", - }; - --static const struct { -- int map_type; -- int func_id; --} func_limit[] = { -- {BPF_MAP_TYPE_PROG_ARRAY, BPF_FUNC_tail_call}, -- {BPF_MAP_TYPE_PERF_EVENT_ARRAY, BPF_FUNC_perf_event_read}, -- {BPF_MAP_TYPE_PERF_EVENT_ARRAY, BPF_FUNC_perf_event_output}, --}; -- - static void print_verifier_state(struct verifier_env *env) - { - enum bpf_reg_type t; -@@ -898,24 +889,44 @@ static int check_func_arg(struct verifier_env *env, u32 regno, - - static int check_map_func_compatibility(struct bpf_map *map, int func_id) - { -- bool bool_map, bool_func; -- int i; -- - if (!map) - return 0; - -- for (i = 0; i < ARRAY_SIZE(func_limit); i++) { -- bool_map = (map->map_type == func_limit[i].map_type); -- bool_func = (func_id == func_limit[i].func_id); -- /* only when map & func pair match it can continue. -- * don't allow any other map type to be passed into -- * the special func; -- */ -- if (bool_func && bool_map != bool_func) -- return -EINVAL; -+ /* We need a two way check, first is from map perspective ... */ -+ switch (map->map_type) { -+ case BPF_MAP_TYPE_PROG_ARRAY: -+ if (func_id != BPF_FUNC_tail_call) -+ goto error; -+ break; -+ case BPF_MAP_TYPE_PERF_EVENT_ARRAY: -+ if (func_id != BPF_FUNC_perf_event_read && -+ func_id != BPF_FUNC_perf_event_output) -+ goto error; -+ break; -+ default: -+ break; -+ } -+ -+ /* ... and second from the function itself. */ -+ switch (func_id) { -+ case BPF_FUNC_tail_call: -+ if (map->map_type != BPF_MAP_TYPE_PROG_ARRAY) -+ goto error; -+ break; -+ case BPF_FUNC_perf_event_read: -+ case BPF_FUNC_perf_event_output: -+ if (map->map_type != BPF_MAP_TYPE_PERF_EVENT_ARRAY) -+ goto error; -+ break; -+ default: -+ break; - } - - return 0; -+error: -+ verbose("cannot pass map_type %d into func %d\n", -+ map->map_type, func_id); -+ return -EINVAL; - } - - static int check_call(struct verifier_env *env, int func_id) -@@ -1348,6 +1359,7 @@ static int check_ld_abs(struct verifier_env *env, struct bpf_insn *insn) - } - - if (insn->dst_reg != BPF_REG_0 || insn->off != 0 || -+ BPF_SIZE(insn->code) == BPF_DW || - (mode == BPF_ABS && insn->src_reg != BPF_REG_0)) { - verbose("BPF_LD_ABS uses reserved fields\n"); - return -EINVAL; -@@ -2003,7 +2015,6 @@ static int replace_map_fd_with_map_ptr(struct verifier_env *env) - if (IS_ERR(map)) { - verbose("fd %d is not pointing to valid bpf_map\n", - insn->imm); -- fdput(f); - return PTR_ERR(map); - } - -@@ -2023,15 +2034,18 @@ static int replace_map_fd_with_map_ptr(struct verifier_env *env) - return -E2BIG; - } - -- /* remember this map */ -- env->used_maps[env->used_map_cnt++] = map; -- - /* hold the map. If the program is rejected by verifier, - * the map will be released by release_maps() or it - * will be used by the valid program until it's unloaded - * and all maps are released in free_bpf_prog_info() - */ -- bpf_map_inc(map, false); -+ map = bpf_map_inc(map, false); -+ if (IS_ERR(map)) { -+ fdput(f); -+ return PTR_ERR(map); -+ } -+ env->used_maps[env->used_map_cnt++] = map; -+ - fdput(f); - next_insn: - insn++; -diff --git a/kernel/cgroup.c b/kernel/cgroup.c -index d27904c193da..355cd5f2b416 100644 ---- a/kernel/cgroup.c -+++ b/kernel/cgroup.c -@@ -2474,6 +2474,14 @@ static void cgroup_migrate_add_src(struct css_set *src_cset, - lockdep_assert_held(&cgroup_mutex); - lockdep_assert_held(&css_set_lock); - -+ /* -+ * If ->dead, @src_set is associated with one or more dead cgroups -+ * and doesn't contain any migratable tasks. Ignore it early so -+ * that the rest of migration path doesn't get confused by it. -+ */ -+ if (src_cset->dead) -+ return; -+ - src_cgrp = cset_cgroup_from_root(src_cset, dst_cgrp->root); - - if (!list_empty(&src_cset->mg_preload_node)) -@@ -2689,9 +2697,10 @@ static ssize_t __cgroup_procs_write(struct kernfs_open_file *of, char *buf, - size_t nbytes, loff_t off, bool threadgroup) - { - struct task_struct *tsk; -+ struct cgroup_subsys *ss; - struct cgroup *cgrp; - pid_t pid; -- int ret; -+ int ssid, ret; - - if (kstrtoint(strstrip(buf), 0, &pid) || pid < 0) - return -EINVAL; -@@ -2739,8 +2748,10 @@ out_unlock_rcu: - rcu_read_unlock(); - out_unlock_threadgroup: - percpu_up_write(&cgroup_threadgroup_rwsem); -+ for_each_subsys(ss, ssid) -+ if (ss->post_attach) -+ ss->post_attach(); - cgroup_kn_unlock(of->kn); -- cpuset_post_attach_flush(); - return ret ?: nbytes; - } - -@@ -5114,6 +5125,7 @@ static int cgroup_destroy_locked(struct cgroup *cgrp) - __releases(&cgroup_mutex) __acquires(&cgroup_mutex) - { - struct cgroup_subsys_state *css; -+ struct cgrp_cset_link *link; - int ssid; - - lockdep_assert_held(&cgroup_mutex); -@@ -5134,11 +5146,18 @@ static int cgroup_destroy_locked(struct cgroup *cgrp) - return -EBUSY; - - /* -- * Mark @cgrp dead. This prevents further task migration and child -- * creation by disabling cgroup_lock_live_group(). -+ * Mark @cgrp and the associated csets dead. The former prevents -+ * further task migration and child creation by disabling -+ * cgroup_lock_live_group(). The latter makes the csets ignored by -+ * the migration path. - */ - cgrp->self.flags &= ~CSS_ONLINE; - -+ spin_lock_bh(&css_set_lock); -+ list_for_each_entry(link, &cgrp->cset_links, cset_link) -+ link->cset->dead = true; -+ spin_unlock_bh(&css_set_lock); -+ - /* initiate massacre of all css's */ - for_each_css(css, ssid, cgrp) - kill_css(css); -diff --git a/kernel/cpuset.c b/kernel/cpuset.c -index 41989ab4db57..df16d0c9349f 100644 ---- a/kernel/cpuset.c -+++ b/kernel/cpuset.c -@@ -58,7 +58,6 @@ - #include - #include - #include --#include - #include - #include - -@@ -1016,7 +1015,7 @@ static void cpuset_migrate_mm(struct mm_struct *mm, const nodemask_t *from, - } - } - --void cpuset_post_attach_flush(void) -+static void cpuset_post_attach(void) - { - flush_workqueue(cpuset_migrate_mm_wq); - } -@@ -2087,6 +2086,7 @@ struct cgroup_subsys cpuset_cgrp_subsys = { - .can_attach = cpuset_can_attach, - .cancel_attach = cpuset_cancel_attach, - .attach = cpuset_attach, -+ .post_attach = cpuset_post_attach, - .bind = cpuset_bind, - .legacy_cftypes = files, - .early_init = 1, -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 614614821f00..477fb6b8ca20 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -1090,6 +1090,7 @@ static void put_ctx(struct perf_event_context *ctx) - * function. - * - * Lock order: -+ * cred_guard_mutex - * task_struct::perf_event_mutex - * perf_event_context::mutex - * perf_event::child_mutex; -@@ -2402,14 +2403,24 @@ static void ctx_sched_out(struct perf_event_context *ctx, - cpuctx->task_ctx = NULL; - } - -- is_active ^= ctx->is_active; /* changed bits */ -- -+ /* -+ * Always update time if it was set; not only when it changes. -+ * Otherwise we can 'forget' to update time for any but the last -+ * context we sched out. For example: -+ * -+ * ctx_sched_out(.event_type = EVENT_FLEXIBLE) -+ * ctx_sched_out(.event_type = EVENT_PINNED) -+ * -+ * would only update time for the pinned events. -+ */ - if (is_active & EVENT_TIME) { - /* update (and stop) ctx time */ - update_context_time(ctx); - update_cgrp_time_from_cpuctx(cpuctx); - } - -+ is_active ^= ctx->is_active; /* changed bits */ -+ - if (!ctx->nr_active || !(is_active & EVENT_ALL)) - return; - -@@ -3405,7 +3416,6 @@ static struct task_struct * - find_lively_task_by_vpid(pid_t vpid) - { - struct task_struct *task; -- int err; - - rcu_read_lock(); - if (!vpid) -@@ -3419,16 +3429,7 @@ find_lively_task_by_vpid(pid_t vpid) - if (!task) - return ERR_PTR(-ESRCH); - -- /* Reuse ptrace permission checks for now. */ -- err = -EACCES; -- if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) -- goto errout; -- - return task; --errout: -- put_task_struct(task); -- return ERR_PTR(err); -- - } - - /* -@@ -8001,6 +8002,9 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, - } - } - -+ /* symmetric to unaccount_event() in _free_event() */ -+ account_event(event); -+ - return event; - - err_per_task: -@@ -8347,6 +8351,24 @@ SYSCALL_DEFINE5(perf_event_open, - - get_online_cpus(); - -+ if (task) { -+ err = mutex_lock_interruptible(&task->signal->cred_guard_mutex); -+ if (err) -+ goto err_cpus; -+ -+ /* -+ * Reuse ptrace permission checks for now. -+ * -+ * We must hold cred_guard_mutex across this and any potential -+ * perf_install_in_context() call for this new event to -+ * serialize against exec() altering our credentials (and the -+ * perf_event_exit_task() that could imply). -+ */ -+ err = -EACCES; -+ if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) -+ goto err_cred; -+ } -+ - if (flags & PERF_FLAG_PID_CGROUP) - cgroup_fd = pid; - -@@ -8354,7 +8376,7 @@ SYSCALL_DEFINE5(perf_event_open, - NULL, NULL, cgroup_fd); - if (IS_ERR(event)) { - err = PTR_ERR(event); -- goto err_cpus; -+ goto err_cred; - } - - if (is_sampling_event(event)) { -@@ -8364,8 +8386,6 @@ SYSCALL_DEFINE5(perf_event_open, - } - } - -- account_event(event); -- - /* - * Special case software events and allow them to be part of - * any hardware group. -@@ -8415,11 +8435,6 @@ SYSCALL_DEFINE5(perf_event_open, - goto err_context; - } - -- if (task) { -- put_task_struct(task); -- task = NULL; -- } -- - /* - * Look up the group leader (we will attach this event to it): - */ -@@ -8478,6 +8493,7 @@ SYSCALL_DEFINE5(perf_event_open, - f_flags); - if (IS_ERR(event_file)) { - err = PTR_ERR(event_file); -+ event_file = NULL; - goto err_context; - } - -@@ -8516,6 +8532,11 @@ SYSCALL_DEFINE5(perf_event_open, - - WARN_ON_ONCE(ctx->parent_ctx); - -+ /* -+ * This is the point on no return; we cannot fail hereafter. This is -+ * where we start modifying current state. -+ */ -+ - if (move_group) { - /* - * See perf_event_ctx_lock() for comments on the details -@@ -8587,6 +8608,11 @@ SYSCALL_DEFINE5(perf_event_open, - mutex_unlock(&gctx->mutex); - mutex_unlock(&ctx->mutex); - -+ if (task) { -+ mutex_unlock(&task->signal->cred_guard_mutex); -+ put_task_struct(task); -+ } -+ - put_online_cpus(); - - mutex_lock(¤t->perf_event_mutex); -@@ -8619,6 +8645,9 @@ err_alloc: - */ - if (!event_file) - free_event(event); -+err_cred: -+ if (task) -+ mutex_unlock(&task->signal->cred_guard_mutex); - err_cpus: - put_online_cpus(); - err_task: -@@ -8662,8 +8691,6 @@ perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu, - /* Mark owner so we could distinguish it from user events. */ - event->owner = TASK_TOMBSTONE; - -- account_event(event); -- - ctx = find_get_context(event->pmu, task, event); - if (IS_ERR(ctx)) { - err = PTR_ERR(ctx); -@@ -8905,6 +8932,9 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn) - - /* - * When a child task exits, feed back event values to parent events. -+ * -+ * Can be called with cred_guard_mutex held when called from -+ * install_exec_creds(). - */ - void perf_event_exit_task(struct task_struct *child) - { -diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c -index 1faad2cfdb9e..287201a5d12f 100644 ---- a/kernel/events/ring_buffer.c -+++ b/kernel/events/ring_buffer.c -@@ -347,6 +347,7 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size, - bool truncated) - { - struct ring_buffer *rb = handle->rb; -+ bool wakeup = truncated; - unsigned long aux_head; - u64 flags = 0; - -@@ -375,9 +376,16 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size, - aux_head = rb->user_page->aux_head = local_read(&rb->aux_head); - - if (aux_head - local_read(&rb->aux_wakeup) >= rb->aux_watermark) { -- perf_output_wakeup(handle); -+ wakeup = true; - local_add(rb->aux_watermark, &rb->aux_wakeup); - } -+ -+ if (wakeup) { -+ if (truncated) -+ handle->event->pending_disable = 1; -+ perf_output_wakeup(handle); -+ } -+ - handle->event = NULL; - - local_set(&rb->aux_nest, 0); -diff --git a/kernel/futex.c b/kernel/futex.c -index 5d6ce6413ef1..11b502159f3a 100644 ---- a/kernel/futex.c -+++ b/kernel/futex.c -@@ -1212,10 +1212,20 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this, - if (unlikely(should_fail_futex(true))) - ret = -EFAULT; - -- if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) -+ if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) { - ret = -EFAULT; -- else if (curval != uval) -- ret = -EINVAL; -+ } else if (curval != uval) { -+ /* -+ * If a unconditional UNLOCK_PI operation (user space did not -+ * try the TID->0 transition) raced with a waiter setting the -+ * FUTEX_WAITERS flag between get_user() and locking the hash -+ * bucket lock, retry the operation. -+ */ -+ if ((FUTEX_TID_MASK & curval) == uval) -+ ret = -EAGAIN; -+ else -+ ret = -EINVAL; -+ } - if (ret) { - raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); - return ret; -@@ -1442,8 +1452,8 @@ void requeue_futex(struct futex_q *q, struct futex_hash_bucket *hb1, - if (likely(&hb1->chain != &hb2->chain)) { - plist_del(&q->list, &hb1->chain); - hb_waiters_dec(hb1); -- plist_add(&q->list, &hb2->chain); - hb_waiters_inc(hb2); -+ plist_add(&q->list, &hb2->chain); - q->lock_ptr = &hb2->lock; - } - get_futex_key_refs(key2); -@@ -2536,6 +2546,15 @@ retry: - if (ret == -EFAULT) - goto pi_faulted; - /* -+ * A unconditional UNLOCK_PI op raced against a waiter -+ * setting the FUTEX_WAITERS bit. Try again. -+ */ -+ if (ret == -EAGAIN) { -+ spin_unlock(&hb->lock); -+ put_futex_key(&key); -+ goto retry; -+ } -+ /* - * wake_futex_pi has detected invalid state. Tell user - * space. - */ -diff --git a/kernel/locking/mcs_spinlock.h b/kernel/locking/mcs_spinlock.h -index 5b9102a47ea5..c835270f0c2f 100644 ---- a/kernel/locking/mcs_spinlock.h -+++ b/kernel/locking/mcs_spinlock.h -@@ -67,7 +67,13 @@ void mcs_spin_lock(struct mcs_spinlock **lock, struct mcs_spinlock *node) - node->locked = 0; - node->next = NULL; - -- prev = xchg_acquire(lock, node); -+ /* -+ * We rely on the full barrier with global transitivity implied by the -+ * below xchg() to order the initialization stores above against any -+ * observation of @node. And to provide the ACQUIRE ordering associated -+ * with a LOCK primitive. -+ */ -+ prev = xchg(lock, node); - if (likely(prev == NULL)) { - /* - * Lock acquired, don't need to set node->locked to 1. Threads -diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c -index b7342a24f559..b7dd5718836e 100644 ---- a/kernel/power/hibernate.c -+++ b/kernel/power/hibernate.c -@@ -339,6 +339,7 @@ int hibernation_snapshot(int platform_mode) - pm_message_t msg; - int error; - -+ pm_suspend_clear_flags(); - error = platform_begin(platform_mode); - if (error) - goto Close; -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 41f6b2215aa8..1c1d2a00ad95 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -5630,6 +5630,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu) - - case CPU_UP_PREPARE: - rq->calc_load_update = calc_load_update; -+ account_reset_rq(rq); - break; - - case CPU_ONLINE: -@@ -7801,7 +7802,7 @@ void set_curr_task(int cpu, struct task_struct *p) - /* task_group_lock serializes the addition/removal of task groups */ - static DEFINE_SPINLOCK(task_group_lock); - --static void free_sched_group(struct task_group *tg) -+static void sched_free_group(struct task_group *tg) - { - free_fair_sched_group(tg); - free_rt_sched_group(tg); -@@ -7827,7 +7828,7 @@ struct task_group *sched_create_group(struct task_group *parent) - return tg; - - err: -- free_sched_group(tg); -+ sched_free_group(tg); - return ERR_PTR(-ENOMEM); - } - -@@ -7847,17 +7848,16 @@ void sched_online_group(struct task_group *tg, struct task_group *parent) - } - - /* rcu callback to free various structures associated with a task group */ --static void free_sched_group_rcu(struct rcu_head *rhp) -+static void sched_free_group_rcu(struct rcu_head *rhp) - { - /* now it should be safe to free those cfs_rqs */ -- free_sched_group(container_of(rhp, struct task_group, rcu)); -+ sched_free_group(container_of(rhp, struct task_group, rcu)); - } - --/* Destroy runqueue etc associated with a task group */ - void sched_destroy_group(struct task_group *tg) - { - /* wait for possible concurrent references to cfs_rqs complete */ -- call_rcu(&tg->rcu, free_sched_group_rcu); -+ call_rcu(&tg->rcu, sched_free_group_rcu); - } - - void sched_offline_group(struct task_group *tg) -@@ -8318,31 +8318,26 @@ cpu_cgroup_css_alloc(struct cgroup_subsys_state *parent_css) - if (IS_ERR(tg)) - return ERR_PTR(-ENOMEM); - -+ sched_online_group(tg, parent); -+ - return &tg->css; - } - --static int cpu_cgroup_css_online(struct cgroup_subsys_state *css) -+static void cpu_cgroup_css_released(struct cgroup_subsys_state *css) - { - struct task_group *tg = css_tg(css); -- struct task_group *parent = css_tg(css->parent); - -- if (parent) -- sched_online_group(tg, parent); -- return 0; -+ sched_offline_group(tg); - } - - static void cpu_cgroup_css_free(struct cgroup_subsys_state *css) - { - struct task_group *tg = css_tg(css); - -- sched_destroy_group(tg); --} -- --static void cpu_cgroup_css_offline(struct cgroup_subsys_state *css) --{ -- struct task_group *tg = css_tg(css); -- -- sched_offline_group(tg); -+ /* -+ * Relies on the RCU grace period between css_released() and this. -+ */ -+ sched_free_group(tg); - } - - static void cpu_cgroup_fork(struct task_struct *task) -@@ -8702,9 +8697,8 @@ static struct cftype cpu_files[] = { - - struct cgroup_subsys cpu_cgrp_subsys = { - .css_alloc = cpu_cgroup_css_alloc, -+ .css_released = cpu_cgroup_css_released, - .css_free = cpu_cgroup_css_free, -- .css_online = cpu_cgroup_css_online, -- .css_offline = cpu_cgroup_css_offline, - .fork = cpu_cgroup_fork, - .can_attach = cpu_cgroup_can_attach, - .attach = cpu_cgroup_attach, -diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c -index b2ab2ffb1adc..ab2b5fb9821d 100644 ---- a/kernel/sched/cputime.c -+++ b/kernel/sched/cputime.c -@@ -262,21 +262,21 @@ static __always_inline bool steal_account_process_tick(void) - #ifdef CONFIG_PARAVIRT - if (static_key_false(¶virt_steal_enabled)) { - u64 steal; -- cputime_t steal_ct; -+ unsigned long steal_jiffies; - - steal = paravirt_steal_clock(smp_processor_id()); - steal -= this_rq()->prev_steal_time; - - /* -- * cputime_t may be less precise than nsecs (eg: if it's -- * based on jiffies). Lets cast the result to cputime -+ * steal is in nsecs but our caller is expecting steal -+ * time in jiffies. Lets cast the result to jiffies - * granularity and account the rest on the next rounds. - */ -- steal_ct = nsecs_to_cputime(steal); -- this_rq()->prev_steal_time += cputime_to_nsecs(steal_ct); -+ steal_jiffies = nsecs_to_jiffies(steal); -+ this_rq()->prev_steal_time += jiffies_to_nsecs(steal_jiffies); - -- account_steal_time(steal_ct); -- return steal_ct; -+ account_steal_time(jiffies_to_cputime(steal_jiffies)); -+ return steal_jiffies; - } - #endif - return false; -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 56b7d4b83947..adff850e5d42 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -4459,9 +4459,17 @@ static void __update_cpu_load(struct rq *this_rq, unsigned long this_load, - - /* scale is effectively 1 << i now, and >> i divides by scale */ - -- old_load = this_rq->cpu_load[i] - tickless_load; -+ old_load = this_rq->cpu_load[i]; - old_load = decay_load_missed(old_load, pending_updates - 1, i); -- old_load += tickless_load; -+ if (tickless_load) { -+ old_load -= decay_load_missed(tickless_load, pending_updates - 1, i); -+ /* -+ * old_load can never be a negative value because a -+ * decayed tickless_load cannot be greater than the -+ * original tickless_load. -+ */ -+ old_load += tickless_load; -+ } - new_load = this_load; - /* - * Round up the averaging division if load is increasing. This -diff --git a/kernel/sched/loadavg.c b/kernel/sched/loadavg.c -index ef7159012cf3..b0b93fd33af9 100644 ---- a/kernel/sched/loadavg.c -+++ b/kernel/sched/loadavg.c -@@ -99,10 +99,13 @@ long calc_load_fold_active(struct rq *this_rq) - static unsigned long - calc_load(unsigned long load, unsigned long exp, unsigned long active) - { -- load *= exp; -- load += active * (FIXED_1 - exp); -- load += 1UL << (FSHIFT - 1); -- return load >> FSHIFT; -+ unsigned long newload; -+ -+ newload = load * exp + active * (FIXED_1 - exp); -+ if (active >= load) -+ newload += FIXED_1-1; -+ -+ return newload / FIXED_1; - } - - #ifdef CONFIG_NO_HZ_COMMON -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index 10f16374df7f..ff87d887ff62 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -1738,3 +1738,16 @@ static inline u64 irq_time_read(int cpu) - } - #endif /* CONFIG_64BIT */ - #endif /* CONFIG_IRQ_TIME_ACCOUNTING */ -+ -+static inline void account_reset_rq(struct rq *rq) -+{ -+#ifdef CONFIG_IRQ_TIME_ACCOUNTING -+ rq->prev_irq_time = 0; -+#endif -+#ifdef CONFIG_PARAVIRT -+ rq->prev_steal_time = 0; -+#endif -+#ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING -+ rq->prev_steal_time_rq = 0; -+#endif -+} -diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c -index 7e7746a42a62..10a1d7dc9313 100644 ---- a/kernel/sysctl_binary.c -+++ b/kernel/sysctl_binary.c -@@ -1321,7 +1321,7 @@ static ssize_t binary_sysctl(const int *name, int nlen, - } - - mnt = task_active_pid_ns(current)->proc_mnt; -- file = file_open_root(mnt->mnt_root, mnt, pathname, flags); -+ file = file_open_root(mnt->mnt_root, mnt, pathname, flags, 0); - result = PTR_ERR(file); - if (IS_ERR(file)) - goto out_putname; -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 95181e36891a..9c143739b8d7 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -437,7 +437,7 @@ struct ring_buffer_per_cpu { - raw_spinlock_t reader_lock; /* serialize readers */ - arch_spinlock_t lock; - struct lock_class_key lock_key; -- unsigned int nr_pages; -+ unsigned long nr_pages; - unsigned int current_context; - struct list_head *pages; - struct buffer_page *head_page; /* read from head */ -@@ -458,7 +458,7 @@ struct ring_buffer_per_cpu { - u64 write_stamp; - u64 read_stamp; - /* ring buffer pages to update, > 0 to add, < 0 to remove */ -- int nr_pages_to_update; -+ long nr_pages_to_update; - struct list_head new_pages; /* new pages to add */ - struct work_struct update_pages_work; - struct completion update_done; -@@ -1128,10 +1128,10 @@ static int rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer) - return 0; - } - --static int __rb_allocate_pages(int nr_pages, struct list_head *pages, int cpu) -+static int __rb_allocate_pages(long nr_pages, struct list_head *pages, int cpu) - { -- int i; - struct buffer_page *bpage, *tmp; -+ long i; - - for (i = 0; i < nr_pages; i++) { - struct page *page; -@@ -1168,7 +1168,7 @@ free_pages: - } - - static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer, -- unsigned nr_pages) -+ unsigned long nr_pages) - { - LIST_HEAD(pages); - -@@ -1193,7 +1193,7 @@ static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer, - } - - static struct ring_buffer_per_cpu * --rb_allocate_cpu_buffer(struct ring_buffer *buffer, int nr_pages, int cpu) -+rb_allocate_cpu_buffer(struct ring_buffer *buffer, long nr_pages, int cpu) - { - struct ring_buffer_per_cpu *cpu_buffer; - struct buffer_page *bpage; -@@ -1293,8 +1293,9 @@ struct ring_buffer *__ring_buffer_alloc(unsigned long size, unsigned flags, - struct lock_class_key *key) - { - struct ring_buffer *buffer; -+ long nr_pages; - int bsize; -- int cpu, nr_pages; -+ int cpu; - - /* keep it in its own cache line */ - buffer = kzalloc(ALIGN(sizeof(*buffer), cache_line_size()), -@@ -1420,12 +1421,12 @@ static inline unsigned long rb_page_write(struct buffer_page *bpage) - } - - static int --rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned int nr_pages) -+rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) - { - struct list_head *tail_page, *to_remove, *next_page; - struct buffer_page *to_remove_page, *tmp_iter_page; - struct buffer_page *last_page, *first_page; -- unsigned int nr_removed; -+ unsigned long nr_removed; - unsigned long head_bit; - int page_entries; - -@@ -1642,7 +1643,7 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, - int cpu_id) - { - struct ring_buffer_per_cpu *cpu_buffer; -- unsigned nr_pages; -+ unsigned long nr_pages; - int cpu, err = 0; - - /* -@@ -1656,14 +1657,13 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, - !cpumask_test_cpu(cpu_id, buffer->cpumask)) - return size; - -- size = DIV_ROUND_UP(size, BUF_PAGE_SIZE); -- size *= BUF_PAGE_SIZE; -+ nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); - - /* we need a minimum of two pages */ -- if (size < BUF_PAGE_SIZE * 2) -- size = BUF_PAGE_SIZE * 2; -+ if (nr_pages < 2) -+ nr_pages = 2; - -- nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); -+ size = nr_pages * BUF_PAGE_SIZE; - - /* - * Don't succeed if resizing is disabled, as a reader might be -@@ -4640,8 +4640,9 @@ static int rb_cpu_notify(struct notifier_block *self, - struct ring_buffer *buffer = - container_of(self, struct ring_buffer, cpu_notify); - long cpu = (long)hcpu; -- int cpu_i, nr_pages_same; -- unsigned int nr_pages; -+ long nr_pages_same; -+ int cpu_i; -+ unsigned long nr_pages; - - switch (action) { - case CPU_UP_PREPARE: -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index d9293402ee68..8305cbb2d5a2 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -4949,7 +4949,10 @@ static ssize_t tracing_splice_read_pipe(struct file *filp, - - spd.nr_pages = i; - -- ret = splice_to_pipe(pipe, &spd); -+ if (i) -+ ret = splice_to_pipe(pipe, &spd); -+ else -+ ret = 0; - out: - splice_shrink_spd(&spd); - return ret; -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index 05ddc0820771..6f965864cc02 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -2095,8 +2095,13 @@ event_create_dir(struct dentry *parent, struct trace_event_file *file) - trace_create_file("filter", 0644, file->dir, file, - &ftrace_event_filter_fops); - -- trace_create_file("trigger", 0644, file->dir, file, -- &event_trigger_fops); -+ /* -+ * Only event directories that can be enabled should have -+ * triggers. -+ */ -+ if (!(call->flags & TRACE_EVENT_FL_IGNORE_ENABLE)) -+ trace_create_file("trigger", 0644, file->dir, file, -+ &event_trigger_fops); - - trace_create_file("format", 0444, file->dir, call, - &ftrace_event_format_fops); -diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c -index e4e56589ec1d..be3222b7d72e 100644 ---- a/kernel/trace/trace_irqsoff.c -+++ b/kernel/trace/trace_irqsoff.c -@@ -109,8 +109,12 @@ static int func_prolog_dec(struct trace_array *tr, - return 0; - - local_save_flags(*flags); -- /* slight chance to get a false positive on tracing_cpu */ -- if (!irqs_disabled_flags(*flags)) -+ /* -+ * Slight chance to get a false positive on tracing_cpu, -+ * although I'm starting to think there isn't a chance. -+ * Leave this for now just to be paranoid. -+ */ -+ if (!irqs_disabled_flags(*flags) && !preempt_count()) - return 0; - - *data = per_cpu_ptr(tr->trace_buffer.data, cpu); -diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c -index 060df67dbdd1..f96f0383f6c6 100644 ---- a/kernel/trace/trace_printk.c -+++ b/kernel/trace/trace_printk.c -@@ -296,6 +296,9 @@ static int t_show(struct seq_file *m, void *v) - const char *str = *fmt; - int i; - -+ if (!*fmt) -+ return 0; -+ - seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt); - - /* -diff --git a/kernel/watchdog.c b/kernel/watchdog.c -index b3ace6ebbba3..9acb29f280ec 100644 ---- a/kernel/watchdog.c -+++ b/kernel/watchdog.c -@@ -923,6 +923,9 @@ static int proc_watchdog_common(int which, struct ctl_table *table, int write, - * both lockup detectors are disabled if proc_watchdog_update() - * returns an error. - */ -+ if (old == new) -+ goto out; -+ - err = proc_watchdog_update(); - } - out: -@@ -967,7 +970,7 @@ int proc_soft_watchdog(struct ctl_table *table, int write, - int proc_watchdog_thresh(struct ctl_table *table, int write, - void __user *buffer, size_t *lenp, loff_t *ppos) - { -- int err, old; -+ int err, old, new; - - get_online_cpus(); - mutex_lock(&watchdog_proc_mutex); -@@ -987,6 +990,10 @@ int proc_watchdog_thresh(struct ctl_table *table, int write, - /* - * Update the sample period. Restore on failure. - */ -+ new = ACCESS_ONCE(watchdog_thresh); -+ if (old == new) -+ goto out; -+ - set_sample_period(); - err = proc_watchdog_update(); - if (err) { -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index 7ff5dc7d2ac5..f48c80e4ba75 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -667,6 +667,35 @@ static void set_work_pool_and_clear_pending(struct work_struct *work, - */ - smp_wmb(); - set_work_data(work, (unsigned long)pool_id << WORK_OFFQ_POOL_SHIFT, 0); -+ /* -+ * The following mb guarantees that previous clear of a PENDING bit -+ * will not be reordered with any speculative LOADS or STORES from -+ * work->current_func, which is executed afterwards. This possible -+ * reordering can lead to a missed execution on attempt to qeueue -+ * the same @work. E.g. consider this case: -+ * -+ * CPU#0 CPU#1 -+ * ---------------------------- -------------------------------- -+ * -+ * 1 STORE event_indicated -+ * 2 queue_work_on() { -+ * 3 test_and_set_bit(PENDING) -+ * 4 } set_..._and_clear_pending() { -+ * 5 set_work_data() # clear bit -+ * 6 smp_mb() -+ * 7 work->current_func() { -+ * 8 LOAD event_indicated -+ * } -+ * -+ * Without an explicit full barrier speculative LOAD on line 8 can -+ * be executed before CPU#0 does STORE on line 1. If that happens, -+ * CPU#0 observes the PENDING bit is still set and new execution of -+ * a @work is not queued in a hope, that CPU#1 will eventually -+ * finish the queued @work. Meanwhile CPU#1 does not see -+ * event_indicated is set, because speculative LOAD was executed -+ * before actual STORE. -+ */ -+ smp_mb(); - } - - static void clear_work_data(struct work_struct *work) -@@ -4527,6 +4556,17 @@ static void rebind_workers(struct worker_pool *pool) - pool->attrs->cpumask) < 0); - - spin_lock_irq(&pool->lock); -+ -+ /* -+ * XXX: CPU hotplug notifiers are weird and can call DOWN_FAILED -+ * w/o preceding DOWN_PREPARE. Work around it. CPU hotplug is -+ * being reworked and this can go away in time. -+ */ -+ if (!(pool->flags & POOL_DISASSOCIATED)) { -+ spin_unlock_irq(&pool->lock); -+ return; -+ } -+ - pool->flags &= ~POOL_DISASSOCIATED; - - for_each_pool_worker(worker, pool) { -diff --git a/lib/assoc_array.c b/lib/assoc_array.c -index 03dd576e6773..59fd7c0b119c 100644 ---- a/lib/assoc_array.c -+++ b/lib/assoc_array.c -@@ -524,7 +524,9 @@ static bool assoc_array_insert_into_terminal_node(struct assoc_array_edit *edit, - free_slot = i; - continue; + for (;;) { +- if (test_bit(TTY_OTHER_DONE, &tty->flags)) { ++ if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) { + ret = -EIO; + break; } -- if (ops->compare_object(assoc_array_ptr_to_leaf(ptr), index_key)) { -+ if (assoc_array_ptr_is_leaf(ptr) && -+ ops->compare_object(assoc_array_ptr_to_leaf(ptr), -+ index_key)) { - pr_devel("replace in slot %d\n", i); - edit->leaf_p = &node->slots[i]; - edit->dead_leaf = node->slots[i]; -diff --git a/lib/lz4/lz4defs.h b/lib/lz4/lz4defs.h -index abcecdc2d0f2..0710a62ad2f6 100644 ---- a/lib/lz4/lz4defs.h -+++ b/lib/lz4/lz4defs.h -@@ -11,8 +11,7 @@ - /* - * Detects 64 bits mode - */ --#if (defined(__x86_64__) || defined(__x86_64) || defined(__amd64__) \ -- || defined(__ppc64__) || defined(__LP64__)) -+#if defined(CONFIG_64BIT) - #define LZ4_ARCH64 1 - #else - #define LZ4_ARCH64 0 -@@ -35,6 +34,10 @@ typedef struct _U64_S { u64 v; } U64_S; - - #define PUT4(s, d) (A32(d) = A32(s)) - #define PUT8(s, d) (A64(d) = A64(s)) -+ -+#define LZ4_READ_LITTLEENDIAN_16(d, s, p) \ -+ (d = s - A16(p)) -+ - #define LZ4_WRITE_LITTLEENDIAN_16(p, v) \ - do { \ - A16(p) = v; \ -@@ -51,10 +54,13 @@ typedef struct _U64_S { u64 v; } U64_S; - #define PUT8(s, d) \ - put_unaligned(get_unaligned((const u64 *) s), (u64 *) d) - --#define LZ4_WRITE_LITTLEENDIAN_16(p, v) \ -- do { \ -- put_unaligned(v, (u16 *)(p)); \ -- p += 2; \ -+#define LZ4_READ_LITTLEENDIAN_16(d, s, p) \ -+ (d = s - get_unaligned_le16(p)) -+ -+#define LZ4_WRITE_LITTLEENDIAN_16(p, v) \ -+ do { \ -+ put_unaligned_le16(v, (u16 *)(p)); \ -+ p += 2; \ - } while (0) - #endif - -@@ -140,9 +146,6 @@ typedef struct _U64_S { u64 v; } U64_S; - - #endif - --#define LZ4_READ_LITTLEENDIAN_16(d, s, p) \ -- (d = s - get_unaligned_le16(p)) -- - #define LZ4_WILDCOPY(s, d, e) \ - do { \ - LZ4_COPYPACKET(s, d); \ -diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c -index ec533a6c77b5..eb15e7dc7b65 100644 ---- a/lib/mpi/mpicoder.c -+++ b/lib/mpi/mpicoder.c -@@ -128,6 +128,23 @@ leave: +@@ -828,7 +828,7 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp, + /* set bits for operations that won't block */ + if (n_hdlc->rx_buf_list.head) + mask |= POLLIN | POLLRDNORM; /* readable */ +- if (test_bit(TTY_OTHER_DONE, &tty->flags)) ++ if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) + mask |= POLLHUP; + if (tty_hung_up_p(filp)) + mask |= POLLHUP; +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index b280abaad91b..c12def71ed37 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -1963,18 +1963,6 @@ static inline int input_available_p(struct tty_struct *tty, int poll) + return ldata->commit_head - ldata->read_tail >= amt; } - EXPORT_SYMBOL_GPL(mpi_read_from_buffer); -+static int count_lzeros(MPI a) -+{ -+ mpi_limb_t alimb; -+ int i, lzeros = 0; -+ -+ for (i = a->nlimbs - 1; i >= 0; i--) { -+ alimb = a->d[i]; -+ if (alimb == 0) { -+ lzeros += sizeof(mpi_limb_t); -+ } else { -+ lzeros += count_leading_zeros(alimb) / 8; -+ break; -+ } -+ } -+ return lzeros; -+} -+ +-static inline int check_other_done(struct tty_struct *tty) +-{ +- int done = test_bit(TTY_OTHER_DONE, &tty->flags); +- if (done) { +- /* paired with cmpxchg() in check_other_closed(); ensures +- * read buffer head index is not stale +- */ +- smp_mb__after_atomic(); +- } +- return done; +-} +- /** - * mpi_read_buffer() - read MPI to a bufer provided by user (msb first) - * -@@ -148,7 +165,7 @@ int mpi_read_buffer(MPI a, uint8_t *buf, unsigned buf_len, unsigned *nbytes, - uint8_t *p; - mpi_limb_t alimb; - unsigned int n = mpi_get_size(a); -- int i, lzeros = 0; -+ int i, lzeros; - - if (!buf || !nbytes) - return -EINVAL; -@@ -156,14 +173,7 @@ int mpi_read_buffer(MPI a, uint8_t *buf, unsigned buf_len, unsigned *nbytes, - if (sign) - *sign = a->sign; + * copy_from_read_buf - copy read data directly + * @tty: terminal device +@@ -2170,7 +2158,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, + struct n_tty_data *ldata = tty->disc_data; + unsigned char __user *b = buf; + DEFINE_WAIT_FUNC(wait, woken_wake_function); +- int c, done; ++ int c; + int minimum, time; + ssize_t retval = 0; + long timeout; +@@ -2238,32 +2226,35 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, + ((minimum - (b - buf)) >= 1)) + ldata->minimum_to_wake = (minimum - (b - buf)); -- p = (void *)&a->d[a->nlimbs] - 1; +- done = check_other_done(tty); - -- for (i = a->nlimbs * sizeof(alimb) - 1; i >= 0; i--, p--) { -- if (!*p) -- lzeros++; -- else -- break; -- } -+ lzeros = count_lzeros(a); - - if (buf_len < n - lzeros) { - *nbytes = n - lzeros; -@@ -351,7 +361,7 @@ int mpi_write_to_sgl(MPI a, struct scatterlist *sgl, unsigned *nbytes, - u8 *p, *p2; - mpi_limb_t alimb, alimb2; - unsigned int n = mpi_get_size(a); -- int i, x, y = 0, lzeros = 0, buf_len; -+ int i, x, y = 0, lzeros, buf_len; - - if (!nbytes) - return -EINVAL; -@@ -359,14 +369,7 @@ int mpi_write_to_sgl(MPI a, struct scatterlist *sgl, unsigned *nbytes, - if (sign) - *sign = a->sign; + if (!input_available_p(tty, 0)) { +- if (done) { +- retval = -EIO; +- break; +- } +- if (tty_hung_up_p(file)) +- break; +- if (!timeout) +- break; +- if (file->f_flags & O_NONBLOCK) { +- retval = -EAGAIN; +- break; +- } +- if (signal_pending(current)) { +- retval = -ERESTARTSYS; +- break; +- } + up_read(&tty->termios_rwsem); ++ tty_buffer_flush_work(tty->port); ++ down_read(&tty->termios_rwsem); ++ if (!input_available_p(tty, 0)) { ++ if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) { ++ retval = -EIO; ++ break; ++ } ++ if (tty_hung_up_p(file)) ++ break; ++ if (!timeout) ++ break; ++ if (file->f_flags & O_NONBLOCK) { ++ retval = -EAGAIN; ++ break; ++ } ++ if (signal_pending(current)) { ++ retval = -ERESTARTSYS; ++ break; ++ } ++ up_read(&tty->termios_rwsem); -- p = (void *)&a->d[a->nlimbs] - 1; -- -- for (i = a->nlimbs * sizeof(alimb) - 1; i >= 0; i--, p--) { -- if (!*p) -- lzeros++; -- else -- break; -- } -+ lzeros = count_lzeros(a); - - if (*nbytes < n - lzeros) { - *nbytes = n - lzeros; -diff --git a/mm/compaction.c b/mm/compaction.c -index 585de54dbe8c..29fb26970fba 100644 ---- a/mm/compaction.c -+++ b/mm/compaction.c -@@ -880,16 +880,8 @@ isolate_migratepages_range(struct compact_control *cc, unsigned long start_pfn, - pfn = isolate_migratepages_block(cc, pfn, block_end_pfn, - ISOLATE_UNEVICTABLE); - -- /* -- * In case of fatal failure, release everything that might -- * have been isolated in the previous iteration, and signal -- * the failure back to caller. -- */ -- if (!pfn) { -- putback_movable_pages(&cc->migratepages); -- cc->nr_migratepages = 0; -+ if (!pfn) - break; -- } +- timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, +- timeout); ++ timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, ++ timeout); - if (cc->nr_migratepages == COMPACT_CLUSTER_MAX) - break; -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index e10a4fee88d2..a82a87b3f9c6 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -1257,15 +1257,9 @@ int do_huge_pmd_wp_page(struct mm_struct *mm, struct vm_area_struct *vma, - VM_BUG_ON_PAGE(!PageCompound(page) || !PageHead(page), page); - /* - * We can only reuse the page if nobody else maps the huge page or it's -- * part. We can do it by checking page_mapcount() on each sub-page, but -- * it's expensive. -- * The cheaper way is to check page_count() to be equal 1: every -- * mapcount takes page reference reference, so this way we can -- * guarantee, that the PMD is the only mapping. -- * This can give false negative if somebody pinned the page, but that's -- * fine. -+ * part. - */ -- if (page_mapcount(page) == 1 && page_count(page) == 1) { -+ if (page_trans_huge_mapcount(page, NULL) == 1) { - pmd_t entry; - entry = pmd_mkyoung(orig_pmd); - entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma); -@@ -1919,10 +1913,9 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma, - * page fault if needed. - */ - return 0; -- if (vma->vm_ops) -+ if (vma->vm_ops || (vm_flags & VM_NO_THP)) - /* khugepaged not yet working on file or special mappings */ - return 0; -- VM_BUG_ON_VMA(vm_flags & VM_NO_THP, vma); - hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK; - hend = vma->vm_end & HPAGE_PMD_MASK; - if (hstart < hend) -@@ -2039,7 +2032,8 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma, - if (pte_write(pteval)) { - writable = true; - } else { -- if (PageSwapCache(page) && !reuse_swap_page(page)) { -+ if (PageSwapCache(page) && -+ !reuse_swap_page(page, NULL)) { - unlock_page(page); - result = SCAN_SWAP_CACHE_PAGE; - goto out; -@@ -2310,8 +2304,7 @@ static bool hugepage_vma_check(struct vm_area_struct *vma) - return false; - if (is_vma_temporary_stack(vma)) - return false; -- VM_BUG_ON_VMA(vma->vm_flags & VM_NO_THP, vma); -- return true; -+ return !(vma->vm_flags & VM_NO_THP); - } +- down_read(&tty->termios_rwsem); +- continue; ++ down_read(&tty->termios_rwsem); ++ continue; ++ } + } - static void collapse_huge_page(struct mm_struct *mm, -@@ -3340,6 +3333,64 @@ int total_mapcount(struct page *page) - } + if (ldata->icanon && !L_EXTPROC(tty)) { +@@ -2445,12 +2436,17 @@ static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file, - /* -+ * This calculates accurately how many mappings a transparent hugepage -+ * has (unlike page_mapcount() which isn't fully accurate). This full -+ * accuracy is primarily needed to know if copy-on-write faults can -+ * reuse the page and change the mapping to read-write instead of -+ * copying them. At the same time this returns the total_mapcount too. -+ * -+ * The function returns the highest mapcount any one of the subpages -+ * has. If the return value is one, even if different processes are -+ * mapping different subpages of the transparent hugepage, they can -+ * all reuse it, because each process is reusing a different subpage. -+ * -+ * The total_mapcount is instead counting all virtual mappings of the -+ * subpages. If the total_mapcount is equal to "one", it tells the -+ * caller all mappings belong to the same "mm" and in turn the -+ * anon_vma of the transparent hugepage can become the vma->anon_vma -+ * local one as no other process may be mapping any of the subpages. -+ * -+ * It would be more accurate to replace page_mapcount() with -+ * page_trans_huge_mapcount(), however we only use -+ * page_trans_huge_mapcount() in the copy-on-write faults where we -+ * need full accuracy to avoid breaking page pinning, because -+ * page_trans_huge_mapcount() is slower than page_mapcount(). -+ */ -+int page_trans_huge_mapcount(struct page *page, int *total_mapcount) -+{ -+ int i, ret, _total_mapcount, mapcount; -+ -+ /* hugetlbfs shouldn't call it */ -+ VM_BUG_ON_PAGE(PageHuge(page), page); -+ -+ if (likely(!PageTransCompound(page))) { -+ mapcount = atomic_read(&page->_mapcount) + 1; -+ if (total_mapcount) -+ *total_mapcount = mapcount; -+ return mapcount; -+ } -+ -+ page = compound_head(page); -+ -+ _total_mapcount = ret = 0; -+ for (i = 0; i < HPAGE_PMD_NR; i++) { -+ mapcount = atomic_read(&page[i]._mapcount) + 1; -+ ret = max(ret, mapcount); -+ _total_mapcount += mapcount; -+ } -+ if (PageDoubleMap(page)) { -+ ret -= 1; -+ _total_mapcount -= HPAGE_PMD_NR; + poll_wait(file, &tty->read_wait, wait); + poll_wait(file, &tty->write_wait, wait); +- if (check_other_done(tty)) +- mask |= POLLHUP; + if (input_available_p(tty, 1)) + mask |= POLLIN | POLLRDNORM; ++ else { ++ tty_buffer_flush_work(tty->port); ++ if (input_available_p(tty, 1)) ++ mask |= POLLIN | POLLRDNORM; + } -+ mapcount = compound_mapcount(page); -+ ret += mapcount; -+ _total_mapcount += mapcount; -+ if (total_mapcount) -+ *total_mapcount = _total_mapcount; -+ return ret; -+} -+ -+/* - * This function splits huge page into normal pages. @page can point to any - * subpage of huge page to split. Split doesn't change the position of @page. - * -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index d06cae2de783..a65ad1d59232 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -207,6 +207,7 @@ static void mem_cgroup_oom_notify(struct mem_cgroup *memcg); - /* "mc" and its members are protected by cgroup_mutex */ - static struct move_charge_struct { - spinlock_t lock; /* for from, to */ -+ struct mm_struct *mm; - struct mem_cgroup *from; - struct mem_cgroup *to; - unsigned long flags; -@@ -1262,7 +1263,7 @@ static unsigned long mem_cgroup_get_limit(struct mem_cgroup *memcg) - return limit; - } + if (tty->packet && tty->link->ctrl_status) + mask |= POLLPRI | POLLIN | POLLRDNORM; ++ if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) ++ mask |= POLLHUP; + if (tty_hung_up_p(file)) + mask |= POLLHUP; + if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) { +diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c +index 2348fa613707..6427a39bd360 100644 +--- a/drivers/tty/pty.c ++++ b/drivers/tty/pty.c +@@ -59,7 +59,7 @@ static void pty_close(struct tty_struct *tty, struct file *filp) + if (!tty->link) + return; + set_bit(TTY_OTHER_CLOSED, &tty->link->flags); +- tty_flip_buffer_push(tty->link->port); ++ wake_up_interruptible(&tty->link->read_wait); + wake_up_interruptible(&tty->link->write_wait); + if (tty->driver->subtype == PTY_TYPE_MASTER) { + set_bit(TTY_OTHER_CLOSED, &tty->flags); +@@ -247,9 +247,7 @@ static int pty_open(struct tty_struct *tty, struct file *filp) + goto out; --static void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask, -+static bool mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask, - int order) - { - struct oom_control oc = { -@@ -1340,6 +1341,7 @@ static void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask, - } - unlock: - mutex_unlock(&oom_lock); -+ return chosen; - } + clear_bit(TTY_IO_ERROR, &tty->flags); +- /* TTY_OTHER_CLOSED must be cleared before TTY_OTHER_DONE */ + clear_bit(TTY_OTHER_CLOSED, &tty->link->flags); +- clear_bit(TTY_OTHER_DONE, &tty->link->flags); + set_bit(TTY_THROTTLED, &tty->flags); + return 0; - #if MAX_NUMNODES > 1 -@@ -4729,6 +4731,8 @@ static void __mem_cgroup_clear_mc(void) +diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c +index 88531a36b69c..ed489880e62b 100644 +--- a/drivers/tty/serial/8250/8250_mid.c ++++ b/drivers/tty/serial/8250/8250_mid.c +@@ -14,6 +14,7 @@ + #include - static void mem_cgroup_clear_mc(void) - { -+ struct mm_struct *mm = mc.mm; -+ - /* - * we must clear moving_task before waking up waiters at the end of - * task migration. -@@ -4738,7 +4742,10 @@ static void mem_cgroup_clear_mc(void) - spin_lock(&mc.lock); - mc.from = NULL; - mc.to = NULL; -+ mc.mm = NULL; - spin_unlock(&mc.lock); -+ -+ mmput(mm); - } + #include ++#include - static int mem_cgroup_can_attach(struct cgroup_taskset *tset) -@@ -4795,6 +4802,7 @@ static int mem_cgroup_can_attach(struct cgroup_taskset *tset) - VM_BUG_ON(mc.moved_swap); - - spin_lock(&mc.lock); -+ mc.mm = mm; - mc.from = from; - mc.to = memcg; - mc.flags = move_flags; -@@ -4804,8 +4812,9 @@ static int mem_cgroup_can_attach(struct cgroup_taskset *tset) - ret = mem_cgroup_precharge_mc(mm); - if (ret) - mem_cgroup_clear_mc(); -+ } else { -+ mmput(mm); - } -- mmput(mm); - return ret; - } + #include "8250.h" -@@ -4914,11 +4923,11 @@ put: /* get_mctgt_type() gets the page */ - return ret; - } +@@ -24,6 +25,7 @@ + #define PCI_DEVICE_ID_INTEL_DNV_UART 0x19d8 --static void mem_cgroup_move_charge(struct mm_struct *mm) -+static void mem_cgroup_move_charge(void) - { - struct mm_walk mem_cgroup_move_charge_walk = { - .pmd_entry = mem_cgroup_move_charge_pte_range, -- .mm = mm, -+ .mm = mc.mm, - }; - - lru_add_drain_all(); -@@ -4930,7 +4939,7 @@ static void mem_cgroup_move_charge(struct mm_struct *mm) - atomic_inc(&mc.from->moving_account); - synchronize_rcu(); - retry: -- if (unlikely(!down_read_trylock(&mm->mmap_sem))) { -+ if (unlikely(!down_read_trylock(&mc.mm->mmap_sem))) { - /* - * Someone who are holding the mmap_sem might be waiting in - * waitq. So we cancel all extra charges, wake up all waiters, -@@ -4947,23 +4956,16 @@ retry: - * additional charge, the page walk just aborts. - */ - walk_page_range(0, ~0UL, &mem_cgroup_move_charge_walk); -- up_read(&mm->mmap_sem); -+ up_read(&mc.mm->mmap_sem); - atomic_dec(&mc.from->moving_account); - } + /* Intel MID Specific registers */ ++#define INTEL_MID_UART_DNV_FISR 0x08 + #define INTEL_MID_UART_PS 0x30 + #define INTEL_MID_UART_MUL 0x34 + #define INTEL_MID_UART_DIV 0x38 +@@ -31,6 +33,7 @@ + struct mid8250; --static void mem_cgroup_move_task(struct cgroup_taskset *tset) -+static void mem_cgroup_move_task(void) + struct mid8250_board { ++ unsigned int flags; + unsigned long freq; + unsigned int base_baud; + int (*setup)(struct mid8250 *, struct uart_port *p); +@@ -88,16 +91,16 @@ static int tng_setup(struct mid8250 *mid, struct uart_port *p) + static int dnv_handle_irq(struct uart_port *p) { -- struct cgroup_subsys_state *css; -- struct task_struct *p = cgroup_taskset_first(tset, &css); -- struct mm_struct *mm = get_task_mm(p); + struct mid8250 *mid = p->private_data; +- int ret; - -- if (mm) { -- if (mc.to) -- mem_cgroup_move_charge(mm); -- mmput(mm); -- } -- if (mc.to) -+ if (mc.to) { -+ mem_cgroup_move_charge(); - mem_cgroup_clear_mc(); -+ } - } - #else /* !CONFIG_MMU */ - static int mem_cgroup_can_attach(struct cgroup_taskset *tset) -@@ -4973,7 +4975,7 @@ static int mem_cgroup_can_attach(struct cgroup_taskset *tset) - static void mem_cgroup_cancel_attach(struct cgroup_taskset *tset) - { +- ret = hsu_dma_irq(&mid->dma_chip, 0); +- ret |= hsu_dma_irq(&mid->dma_chip, 1); +- +- /* For now, letting the HW generate separate interrupt for the UART */ +- if (ret) +- return ret; +- +- return serial8250_handle_irq(p, serial_port_in(p, UART_IIR)); ++ unsigned int fisr = serial_port_in(p, INTEL_MID_UART_DNV_FISR); ++ int ret = IRQ_NONE; ++ ++ if (fisr & BIT(2)) ++ ret |= hsu_dma_irq(&mid->dma_chip, 1); ++ if (fisr & BIT(1)) ++ ret |= hsu_dma_irq(&mid->dma_chip, 0); ++ if (fisr & BIT(0)) ++ ret |= serial8250_handle_irq(p, serial_port_in(p, UART_IIR)); ++ return ret; } --static void mem_cgroup_move_task(struct cgroup_taskset *tset) -+static void mem_cgroup_move_task(void) + + #define DNV_DMA_CHAN_OFFSET 0x80 +@@ -106,12 +109,13 @@ static int dnv_setup(struct mid8250 *mid, struct uart_port *p) { - } - #endif -@@ -5051,6 +5053,7 @@ static ssize_t memory_high_write(struct kernfs_open_file *of, - char *buf, size_t nbytes, loff_t off) + struct hsu_dma_chip *chip = &mid->dma_chip; + struct pci_dev *pdev = to_pci_dev(p->dev); ++ unsigned int bar = FL_GET_BASE(mid->board->flags); + int ret; + + chip->dev = &pdev->dev; + chip->irq = pdev->irq; + chip->regs = p->membase; +- chip->length = pci_resource_len(pdev, 0); ++ chip->length = pci_resource_len(pdev, bar); + chip->offset = DNV_DMA_CHAN_OFFSET; + + /* Falling back to PIO mode if DMA probing fails */ +@@ -217,6 +221,7 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id) { - struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of)); -+ unsigned long nr_pages; - unsigned long high; - int err; + struct uart_8250_port uart; + struct mid8250 *mid; ++ unsigned int bar; + int ret; -@@ -5061,6 +5064,11 @@ static ssize_t memory_high_write(struct kernfs_open_file *of, + ret = pcim_enable_device(pdev); +@@ -230,6 +235,7 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id) + return -ENOMEM; - memcg->high = high; + mid->board = (struct mid8250_board *)id->driver_data; ++ bar = FL_GET_BASE(mid->board->flags); -+ nr_pages = page_counter_read(&memcg->memory); -+ if (nr_pages > high) -+ try_to_free_mem_cgroup_pages(memcg, nr_pages - high, -+ GFP_KERNEL, true); -+ - memcg_wb_domain_size_changed(memcg); - return nbytes; - } -@@ -5082,6 +5090,8 @@ static ssize_t memory_max_write(struct kernfs_open_file *of, - char *buf, size_t nbytes, loff_t off) - { - struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of)); -+ unsigned int nr_reclaims = MEM_CGROUP_RECLAIM_RETRIES; -+ bool drained = false; - unsigned long max; - int err; + memset(&uart, 0, sizeof(struct uart_8250_port)); -@@ -5090,9 +5100,36 @@ static ssize_t memory_max_write(struct kernfs_open_file *of, - if (err) - return err; +@@ -242,8 +248,8 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id) + uart.port.flags = UPF_SHARE_IRQ | UPF_FIXED_PORT | UPF_FIXED_TYPE; + uart.port.set_termios = mid8250_set_termios; -- err = mem_cgroup_resize_limit(memcg, max); -- if (err) -- return err; -+ xchg(&memcg->memory.limit, max); -+ -+ for (;;) { -+ unsigned long nr_pages = page_counter_read(&memcg->memory); -+ -+ if (nr_pages <= max) -+ break; -+ -+ if (signal_pending(current)) { -+ err = -EINTR; -+ break; -+ } -+ -+ if (!drained) { -+ drain_all_stock(memcg); -+ drained = true; -+ continue; -+ } -+ -+ if (nr_reclaims) { -+ if (!try_to_free_mem_cgroup_pages(memcg, nr_pages - max, -+ GFP_KERNEL, true)) -+ nr_reclaims--; -+ continue; -+ } -+ -+ mem_cgroup_events(memcg, MEMCG_OOM, 1); -+ if (!mem_cgroup_out_of_memory(memcg, GFP_KERNEL, 0)) -+ break; -+ } +- uart.port.mapbase = pci_resource_start(pdev, 0); +- uart.port.membase = pcim_iomap(pdev, 0, 0); ++ uart.port.mapbase = pci_resource_start(pdev, bar); ++ uart.port.membase = pcim_iomap(pdev, bar, 0); + if (!uart.port.membase) + return -ENOMEM; - memcg_wb_domain_size_changed(memcg); - return nbytes; -@@ -5210,7 +5247,7 @@ struct cgroup_subsys memory_cgrp_subsys = { - .css_reset = mem_cgroup_css_reset, - .can_attach = mem_cgroup_can_attach, - .cancel_attach = mem_cgroup_cancel_attach, -- .attach = mem_cgroup_move_task, -+ .post_attach = mem_cgroup_move_task, - .bind = mem_cgroup_bind, - .dfl_cftypes = memory_files, - .legacy_cftypes = mem_cgroup_legacy_files, -diff --git a/mm/memory.c b/mm/memory.c -index 8132787ae4d5..c1aa0e4b4096 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -792,6 +792,46 @@ out: - return pfn_to_page(pfn); +@@ -282,18 +288,21 @@ static void mid8250_remove(struct pci_dev *pdev) } -+#ifdef CONFIG_TRANSPARENT_HUGEPAGE -+struct page *vm_normal_page_pmd(struct vm_area_struct *vma, unsigned long addr, -+ pmd_t pmd) -+{ -+ unsigned long pfn = pmd_pfn(pmd); -+ -+ /* -+ * There is no pmd_special() but there may be special pmds, e.g. -+ * in a direct-access (dax) mapping, so let's just replicate the -+ * !HAVE_PTE_SPECIAL case from vm_normal_page() here. -+ */ -+ if (unlikely(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP))) { -+ if (vma->vm_flags & VM_MIXEDMAP) { -+ if (!pfn_valid(pfn)) -+ return NULL; -+ goto out; -+ } else { -+ unsigned long off; -+ off = (addr - vma->vm_start) >> PAGE_SHIFT; -+ if (pfn == vma->vm_pgoff + off) -+ return NULL; -+ if (!is_cow_mapping(vma->vm_flags)) -+ return NULL; -+ } -+ } -+ -+ if (is_zero_pfn(pfn)) -+ return NULL; -+ if (unlikely(pfn > highest_memmap_pfn)) -+ return NULL; -+ -+ /* -+ * NOTE! We still have PageReserved() pages in the page tables. -+ * eg. VDSO mappings can cause them to exist. -+ */ -+out: -+ return pfn_to_page(pfn); -+} -+#endif -+ - /* - * copy one vm_area from one task to the other. Assumes the page tables - * already present in the new task to be cleared in the whole range -@@ -2317,6 +2357,7 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma, - * not dirty accountable. - */ - if (PageAnon(old_page) && !PageKsm(old_page)) { -+ int total_mapcount; - if (!trylock_page(old_page)) { - page_cache_get(old_page); - pte_unmap_unlock(page_table, ptl); -@@ -2331,13 +2372,18 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma, - } - page_cache_release(old_page); - } -- if (reuse_swap_page(old_page)) { -- /* -- * The page is all ours. Move it to our anon_vma so -- * the rmap code will not search our parent or siblings. -- * Protected against the rmap code by the page lock. -- */ -- page_move_anon_rmap(old_page, vma, address); -+ if (reuse_swap_page(old_page, &total_mapcount)) { -+ if (total_mapcount == 1) { -+ /* -+ * The page is all ours. Move it to -+ * our anon_vma so the rmap code will -+ * not search our parent or siblings. -+ * Protected against the rmap code by -+ * the page lock. -+ */ -+ page_move_anon_rmap(compound_head(old_page), -+ vma, address); -+ } - unlock_page(old_page); - return wp_page_reuse(mm, vma, address, page_table, ptl, - orig_pte, old_page, 0, 0); -@@ -2562,7 +2608,7 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma, - inc_mm_counter_fast(mm, MM_ANONPAGES); - dec_mm_counter_fast(mm, MM_SWAPENTS); - pte = mk_pte(page, vma->vm_page_prot); -- if ((flags & FAULT_FLAG_WRITE) && reuse_swap_page(page)) { -+ if ((flags & FAULT_FLAG_WRITE) && reuse_swap_page(page, NULL)) { - pte = maybe_mkwrite(pte_mkdirty(pte), vma); - flags &= ~FAULT_FLAG_WRITE; - ret |= VM_FAULT_WRITE; -diff --git a/mm/migrate.c b/mm/migrate.c -index 3ad0fea5c438..625741faa068 100644 ---- a/mm/migrate.c -+++ b/mm/migrate.c -@@ -967,7 +967,13 @@ out: - dec_zone_page_state(page, NR_ISOLATED_ANON + - page_is_file_cache(page)); - /* Soft-offlined page shouldn't go through lru cache list */ -- if (reason == MR_MEMORY_FAILURE) { -+ if (reason == MR_MEMORY_FAILURE && rc == MIGRATEPAGE_SUCCESS) { -+ /* -+ * With this release, we free successfully migrated -+ * page and set PG_HWPoison on just freed page -+ * intentionally. Although it's rather weird, it's how -+ * HWPoison flag works at the moment. -+ */ - put_page(page); - if (!test_set_page_hwpoison(page)) - num_poisoned_pages_inc(); -diff --git a/mm/page-writeback.c b/mm/page-writeback.c -index 6fe7d15bd1f7..62bbf350ddf7 100644 ---- a/mm/page-writeback.c -+++ b/mm/page-writeback.c -@@ -1909,7 +1909,8 @@ bool wb_over_bg_thresh(struct bdi_writeback *wb) - if (gdtc->dirty > gdtc->bg_thresh) - return true; - -- if (wb_stat(wb, WB_RECLAIMABLE) > __wb_calc_thresh(gdtc)) -+ if (wb_stat(wb, WB_RECLAIMABLE) > -+ wb_calc_thresh(gdtc->wb, gdtc->bg_thresh)) - return true; + static const struct mid8250_board pnw_board = { ++ .flags = FL_BASE0, + .freq = 50000000, + .base_baud = 115200, + .setup = pnw_setup, + }; - if (mdtc) { -@@ -1923,7 +1924,8 @@ bool wb_over_bg_thresh(struct bdi_writeback *wb) - if (mdtc->dirty > mdtc->bg_thresh) - return true; + static const struct mid8250_board tng_board = { ++ .flags = FL_BASE0, + .freq = 38400000, + .base_baud = 1843200, + .setup = tng_setup, + }; -- if (wb_stat(wb, WB_RECLAIMABLE) > __wb_calc_thresh(mdtc)) -+ if (wb_stat(wb, WB_RECLAIMABLE) > -+ wb_calc_thresh(mdtc->wb, mdtc->bg_thresh)) - return true; - } + static const struct mid8250_board dnv_board = { ++ .flags = FL_BASE1, + .freq = 133333333, + .base_baud = 115200, + .setup = dnv_setup, +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index 7cd6f9a90542..c1d4a8fa9be8 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -1401,6 +1401,9 @@ byt_set_termios(struct uart_port *p, struct ktermios *termios, + unsigned long m, n; + u32 reg; -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 838ca8bb64f7..629ce645cffd 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -660,34 +660,28 @@ static inline void __free_one_page(struct page *page, - unsigned long combined_idx; - unsigned long uninitialized_var(buddy_idx); - struct page *buddy; -- unsigned int max_order = MAX_ORDER; -+ unsigned int max_order; ++ /* Gracefully handle the B0 case: fall back to B9600 */ ++ fuart = fuart ? fuart : 9600 * 16; + -+ max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1); - - VM_BUG_ON(!zone_is_initialized(zone)); - VM_BUG_ON_PAGE(page->flags & PAGE_FLAGS_CHECK_AT_PREP, page); - - VM_BUG_ON(migratetype == -1); -- if (is_migrate_isolate(migratetype)) { -- /* -- * We restrict max order of merging to prevent merge -- * between freepages on isolate pageblock and normal -- * pageblock. Without this, pageblock isolation -- * could cause incorrect freepage accounting. -- */ -- max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1); -- } else { -+ if (likely(!is_migrate_isolate(migratetype))) - __mod_zone_freepage_state(zone, 1 << order, migratetype); -- } - -- page_idx = pfn & ((1 << max_order) - 1); -+ page_idx = pfn & ((1 << MAX_ORDER) - 1); + /* Get Fuart closer to Fref */ + fuart *= rounddown_pow_of_two(fref / fuart); - VM_BUG_ON_PAGE(page_idx & ((1 << order) - 1), page); - VM_BUG_ON_PAGE(bad_range(zone, page), page); +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index 1c0884d8ef32..172a8ccb0b63 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -273,6 +273,13 @@ static bool atmel_use_dma_rx(struct uart_port *port) + return atmel_port->use_dma_rx; + } -+continue_merging: - while (order < max_order - 1) { - buddy_idx = __find_buddy_index(page_idx, order); - buddy = page + (buddy_idx - page_idx); - if (!page_is_buddy(page, buddy, order)) -- break; -+ goto done_merging; - /* - * Our buddy is free or it is CONFIG_DEBUG_PAGEALLOC guard page, - * merge with it and move up one order. -@@ -704,6 +698,32 @@ static inline void __free_one_page(struct page *page, - page_idx = combined_idx; - order++; - } -+ if (max_order < MAX_ORDER) { -+ /* If we are here, it means order is >= pageblock_order. -+ * We want to prevent merge between freepages on isolate -+ * pageblock and normal pageblock. Without this, pageblock -+ * isolation could cause incorrect freepage or CMA accounting. -+ * -+ * We don't want to hit this code for the more frequent -+ * low-order merging. -+ */ -+ if (unlikely(has_isolate_pageblock(zone))) { -+ int buddy_mt; ++static bool atmel_use_fifo(struct uart_port *port) ++{ ++ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + -+ buddy_idx = __find_buddy_index(page_idx, order); -+ buddy = page + (buddy_idx - page_idx); -+ buddy_mt = get_pageblock_migratetype(buddy); ++ return atmel_port->fifo_size; ++} + -+ if (migratetype != buddy_mt -+ && (is_migrate_isolate(migratetype) || -+ is_migrate_isolate(buddy_mt))) -+ goto done_merging; + static unsigned int atmel_get_lines_status(struct uart_port *port) + { + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); +@@ -2082,7 +2089,12 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + mode |= ATMEL_US_USMODE_RS485; + } else if (termios->c_cflag & CRTSCTS) { + /* RS232 with hardware handshake (RTS/CTS) */ +- mode |= ATMEL_US_USMODE_HWHS; ++ if (atmel_use_dma_rx(port) && !atmel_use_fifo(port)) { ++ dev_info(port->dev, "not enabling hardware flow control because DMA is used"); ++ termios->c_cflag &= ~CRTSCTS; ++ } else { ++ mode |= ATMEL_US_USMODE_HWHS; + } -+ max_order++; -+ goto continue_merging; -+ } + } else { + /* RS232 without hadware handshake */ + mode |= ATMEL_US_USMODE_NORMAL; +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index d72cd736bdc6..8320173af846 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -1263,6 +1263,8 @@ static void s3c24xx_serial_set_termios(struct uart_port *port, + /* check to see if we need to change clock source */ + + if (ourport->baudclk != clk) { ++ clk_prepare_enable(clk); + -+done_merging: - set_page_order(page, order); + s3c24xx_serial_setsource(port, clk_sel); - /* -@@ -6194,7 +6214,7 @@ int __meminit init_per_zone_wmark_min(void) - setup_per_zone_inactive_ratio(); - return 0; - } --module_init(init_per_zone_wmark_min) -+core_initcall(init_per_zone_wmark_min) + if (!IS_ERR(ourport->baudclk)) { +@@ -1270,8 +1272,6 @@ static void s3c24xx_serial_set_termios(struct uart_port *port, + ourport->baudclk = ERR_PTR(-EINVAL); + } - /* - * min_free_kbytes_sysctl_handler - just a wrapper around proc_dointvec() so -diff --git a/mm/page_isolation.c b/mm/page_isolation.c -index 92c4c36501e7..31555b689eb9 100644 ---- a/mm/page_isolation.c -+++ b/mm/page_isolation.c -@@ -289,11 +289,11 @@ struct page *alloc_migrate_target(struct page *page, unsigned long private, - * now as a simple work-around, we use the next node for destination. - */ - if (PageHuge(page)) { -- nodemask_t src = nodemask_of_node(page_to_nid(page)); -- nodemask_t dst; -- nodes_complement(dst, src); -+ int node = next_online_node(page_to_nid(page)); -+ if (node == MAX_NUMNODES) -+ node = first_online_node; - return alloc_huge_page_node(page_hstate(compound_head(page)), -- next_node(page_to_nid(page), dst)); -+ node); +- clk_prepare_enable(clk); +- + ourport->baudclk = clk; + ourport->baudclk_rate = clk ? clk_get_rate(clk) : 0; } +diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c +index 3cd31e0d4bd9..fb31eecb708d 100644 +--- a/drivers/tty/tty_buffer.c ++++ b/drivers/tty/tty_buffer.c +@@ -37,29 +37,6 @@ - if (PageHighMem(page)) -diff --git a/mm/slub.c b/mm/slub.c -index d8fbd4a6ed59..2a722e141958 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -2815,6 +2815,7 @@ struct detached_freelist { - void *tail; - void *freelist; - int cnt; -+ struct kmem_cache *s; - }; - - /* -@@ -2829,8 +2830,9 @@ struct detached_freelist { - * synchronization primitive. Look ahead in the array is limited due - * to performance reasons. - */ --static int build_detached_freelist(struct kmem_cache *s, size_t size, -- void **p, struct detached_freelist *df) -+static inline -+int build_detached_freelist(struct kmem_cache *s, size_t size, -+ void **p, struct detached_freelist *df) - { - size_t first_skipped_index = 0; - int lookahead = 3; -@@ -2846,8 +2848,11 @@ static int build_detached_freelist(struct kmem_cache *s, size_t size, - if (!object) - return 0; + #define TTY_BUFFER_PAGE (((PAGE_SIZE - sizeof(struct tty_buffer)) / 2) & ~0xFF) -+ /* Support for memcg, compiler can optimize this out */ -+ df->s = cache_from_obj(s, object); -+ - /* Start new detached freelist */ -- set_freepointer(s, object, NULL); -+ set_freepointer(df->s, object, NULL); - df->page = virt_to_head_page(object); - df->tail = object; - df->freelist = object; -@@ -2862,7 +2867,7 @@ static int build_detached_freelist(struct kmem_cache *s, size_t size, - /* df->page is always set at this point */ - if (df->page == virt_to_head_page(object)) { - /* Opportunity build freelist */ -- set_freepointer(s, object, df->freelist); -+ set_freepointer(df->s, object, df->freelist); - df->freelist = object; - df->cnt++; - p[size] = NULL; /* mark object processed */ -@@ -2881,25 +2886,20 @@ static int build_detached_freelist(struct kmem_cache *s, size_t size, - return first_skipped_index; - } +-/* +- * If all tty flip buffers have been processed by flush_to_ldisc() or +- * dropped by tty_buffer_flush(), check if the linked pty has been closed. +- * If so, wake the reader/poll to process +- */ +-static inline void check_other_closed(struct tty_struct *tty) +-{ +- unsigned long flags, old; +- +- /* transition from TTY_OTHER_CLOSED => TTY_OTHER_DONE must be atomic */ +- for (flags = ACCESS_ONCE(tty->flags); +- test_bit(TTY_OTHER_CLOSED, &flags); +- ) { +- old = flags; +- __set_bit(TTY_OTHER_DONE, &flags); +- flags = cmpxchg(&tty->flags, old, flags); +- if (old == flags) { +- wake_up_interruptible(&tty->read_wait); +- break; +- } +- } +-} +- + /** + * tty_buffer_lock_exclusive - gain exclusive access to buffer + * tty_buffer_unlock_exclusive - release exclusive access +@@ -254,8 +231,6 @@ void tty_buffer_flush(struct tty_struct *tty, struct tty_ldisc *ld) + if (ld && ld->ops->flush_buffer) + ld->ops->flush_buffer(tty); +- check_other_closed(tty); - - /* Note that interrupts must be enabled when calling this function. */ --void kmem_cache_free_bulk(struct kmem_cache *orig_s, size_t size, void **p) -+void kmem_cache_free_bulk(struct kmem_cache *s, size_t size, void **p) + atomic_dec(&buf->priority); + mutex_unlock(&buf->lock); + } +@@ -505,10 +480,8 @@ static void flush_to_ldisc(struct work_struct *work) + */ + count = smp_load_acquire(&head->commit) - head->read; + if (!count) { +- if (next == NULL) { +- check_other_closed(tty); ++ if (next == NULL) + break; +- } + buf->head = next; + tty_buffer_free(port, head); + continue; +@@ -597,3 +570,8 @@ bool tty_buffer_cancel_work(struct tty_port *port) { - if (WARN_ON(!size)) - return; + return cancel_work_sync(&port->buf.work); + } ++ ++void tty_buffer_flush_work(struct tty_port *port) ++{ ++ flush_work(&port->buf.work); ++} +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index bd51bdd0a7bf..2b5382ea4842 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -3583,9 +3583,10 @@ static int do_register_con_driver(const struct consw *csw, int first, int last) + goto err; - do { - struct detached_freelist df; -- struct kmem_cache *s; + desc = csw->con_startup(); - -- /* Support for memcg */ -- s = cache_from_obj(orig_s, p[size - 1]); - - size = build_detached_freelist(s, size, p, &df); - if (unlikely(!df.page)) - continue; +- if (!desc) ++ if (!desc) { ++ retval = -ENODEV; + goto err; ++ } -- slab_free(s, df.page, df.freelist, df.tail, df.cnt, _RET_IP_); -+ slab_free(df.s, df.page, df.freelist, df.tail, df.cnt,_RET_IP_); - } while (likely(size)); - } - EXPORT_SYMBOL(kmem_cache_free_bulk); -diff --git a/mm/swapfile.c b/mm/swapfile.c -index d2c37365e2d6..954fd8f72b79 100644 ---- a/mm/swapfile.c -+++ b/mm/swapfile.c -@@ -916,18 +916,19 @@ out: - * to it. And as a side-effect, free up its swap: because the old content - * on disk will never be read, and seeking back there to write new content - * later would only waste time away from clustering. -+ * -+ * NOTE: total_mapcount should not be relied upon by the caller if -+ * reuse_swap_page() returns false, but it may be always overwritten -+ * (see the other implementation for CONFIG_SWAP=n). - */ --int reuse_swap_page(struct page *page) -+bool reuse_swap_page(struct page *page, int *total_mapcount) - { - int count; - - VM_BUG_ON_PAGE(!PageLocked(page), page); - if (unlikely(PageKsm(page))) -- return 0; -- /* The page is part of THP and cannot be reused */ -- if (PageTransCompound(page)) -- return 0; -- count = page_mapcount(page); -+ return false; -+ count = page_trans_huge_mapcount(page, total_mapcount); - if (count <= 1 && PageSwapCache(page)) { - count += page_swapcount(page); - if (count == 1 && !PageWriteback(page)) { -diff --git a/mm/vmscan.c b/mm/vmscan.c -index 71b1c29948db..c712b016e0ab 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -2561,7 +2561,7 @@ static bool shrink_zones(struct zonelist *zonelist, struct scan_control *sc) - sc->gfp_mask |= __GFP_HIGHMEM; - - for_each_zone_zonelist_nodemask(zone, z, zonelist, -- requested_highidx, sc->nodemask) { -+ gfp_zone(sc->gfp_mask), sc->nodemask) { - enum zone_type classzone_idx; - - if (!populated_zone(zone)) -diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c -index 2d7c4c11fc63..336149ffd07d 100644 ---- a/mm/zsmalloc.c -+++ b/mm/zsmalloc.c -@@ -1732,10 +1732,13 @@ static struct page *isolate_source_page(struct size_class *class) - static unsigned long zs_can_compact(struct size_class *class) - { - unsigned long obj_wasted; -+ unsigned long obj_allocated = zs_stat_get(class, OBJ_ALLOCATED); -+ unsigned long obj_used = zs_stat_get(class, OBJ_USED); + retval = -EINVAL; -- obj_wasted = zs_stat_get(class, OBJ_ALLOCATED) - -- zs_stat_get(class, OBJ_USED); -+ if (obj_allocated <= obj_used) -+ return 0; +diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c +index 2057d91d8336..dadd1e8dfe09 100644 +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -284,7 +284,7 @@ static int usb_probe_interface(struct device *dev) + struct usb_device *udev = interface_to_usbdev(intf); + const struct usb_device_id *id; + int error = -ENODEV; +- int lpm_disable_error; ++ int lpm_disable_error = -ENODEV; -+ obj_wasted = obj_allocated - obj_used; - obj_wasted /= get_maxobj_per_zspage(class->size, - class->pages_per_zspage); - -diff --git a/mm/zswap.c b/mm/zswap.c -index bf14508afd64..340261946fda 100644 ---- a/mm/zswap.c -+++ b/mm/zswap.c -@@ -170,6 +170,8 @@ static struct zswap_tree *zswap_trees[MAX_SWAPFILES]; - static LIST_HEAD(zswap_pools); - /* protects zswap_pools list modification */ - static DEFINE_SPINLOCK(zswap_pools_lock); -+/* pool counter to provide unique names to zpool */ -+static atomic_t zswap_pools_count = ATOMIC_INIT(0); - - /* used by param callback function */ - static bool zswap_init_started; -@@ -565,6 +567,7 @@ static struct zswap_pool *zswap_pool_find_get(char *type, char *compressor) - static struct zswap_pool *zswap_pool_create(char *type, char *compressor) - { - struct zswap_pool *pool; -+ char name[38]; /* 'zswap' + 32 char (max) num + \0 */ - gfp_t gfp = __GFP_NORETRY | __GFP_NOWARN | __GFP_KSWAPD_RECLAIM; + dev_dbg(dev, "%s\n", __func__); - pool = kzalloc(sizeof(*pool), GFP_KERNEL); -@@ -573,7 +576,10 @@ static struct zswap_pool *zswap_pool_create(char *type, char *compressor) - return NULL; +@@ -336,12 +336,14 @@ static int usb_probe_interface(struct device *dev) + * setting during probe, that should also be fine. usb_set_interface() + * will attempt to disable LPM, and fail if it can't disable it. + */ +- lpm_disable_error = usb_unlocked_disable_lpm(udev); +- if (lpm_disable_error && driver->disable_hub_initiated_lpm) { +- dev_err(&intf->dev, "%s Failed to disable LPM for driver %s\n.", +- __func__, driver->name); +- error = lpm_disable_error; +- goto err; ++ if (driver->disable_hub_initiated_lpm) { ++ lpm_disable_error = usb_unlocked_disable_lpm(udev); ++ if (lpm_disable_error) { ++ dev_err(&intf->dev, "%s Failed to disable LPM for driver %s\n.", ++ __func__, driver->name); ++ error = lpm_disable_error; ++ goto err; ++ } } -- pool->zpool = zpool_create_pool(type, "zswap", gfp, &zswap_zpool_ops); -+ /* unique name for each pool specifically required by zsmalloc */ -+ snprintf(name, 38, "zswap%x", atomic_inc_return(&zswap_pools_count)); -+ -+ pool->zpool = zpool_create_pool(type, name, gfp, &zswap_zpool_ops); - if (!pool->zpool) { - pr_err("%s zpool not available\n", type); - goto error; -diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c -index b563a3f5f2a8..2fa3be965101 100644 ---- a/net/ax25/ax25_ip.c -+++ b/net/ax25/ax25_ip.c -@@ -228,8 +228,23 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb) - } - #endif + /* Carry out a deferred switch to altsetting 0 */ +@@ -391,7 +393,8 @@ static int usb_unbind_interface(struct device *dev) + struct usb_interface *intf = to_usb_interface(dev); + struct usb_host_endpoint *ep, **eps = NULL; + struct usb_device *udev; +- int i, j, error, r, lpm_disable_error; ++ int i, j, error, r; ++ int lpm_disable_error = -ENODEV; -+static bool ax25_validate_header(const char *header, unsigned int len) -+{ -+ ax25_digi digi; -+ -+ if (!len) -+ return false; -+ -+ if (header[0]) -+ return true; -+ -+ return ax25_addr_parse(header + 1, len - 1, NULL, NULL, &digi, NULL, -+ NULL); -+} -+ - const struct header_ops ax25_header_ops = { - .create = ax25_hard_header, -+ .validate = ax25_validate_header, - }; + intf->condition = USB_INTERFACE_UNBINDING; - EXPORT_SYMBOL(ax25_header_ops); -diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c -index a49c705fb86b..5f19133c5530 100644 ---- a/net/batman-adv/distributed-arp-table.c -+++ b/net/batman-adv/distributed-arp-table.c -@@ -553,6 +553,7 @@ static void batadv_choose_next_candidate(struct batadv_priv *bat_priv, - * be sent to - * @bat_priv: the bat priv with all the soft interface information - * @ip_dst: ipv4 to look up in the DHT -+ * @vid: VLAN identifier - * - * An originator O is selected if and only if its DHT_ID value is one of three - * closest values (from the LEFT, with wrap around if needed) then the hash -@@ -561,7 +562,8 @@ static void batadv_choose_next_candidate(struct batadv_priv *bat_priv, - * Returns the candidate array of size BATADV_DAT_CANDIDATE_NUM. - */ - static struct batadv_dat_candidate * --batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst) -+batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst, -+ unsigned short vid) - { - int select; - batadv_dat_addr_t last_max = BATADV_DAT_ADDR_MAX, ip_key; -@@ -577,7 +579,7 @@ batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst) - return NULL; - - dat.ip = ip_dst; -- dat.vid = 0; -+ dat.vid = vid; - ip_key = (batadv_dat_addr_t)batadv_hash_dat(&dat, - BATADV_DAT_ADDR_MAX); - -@@ -597,6 +599,7 @@ batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst) - * @bat_priv: the bat priv with all the soft interface information - * @skb: payload to send - * @ip: the DHT key -+ * @vid: VLAN identifier - * @packet_subtype: unicast4addr packet subtype to use - * - * This function copies the skb with pskb_copy() and is sent as unicast packet -@@ -607,7 +610,7 @@ batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst) - */ - static bool batadv_dat_send_data(struct batadv_priv *bat_priv, - struct sk_buff *skb, __be32 ip, -- int packet_subtype) -+ unsigned short vid, int packet_subtype) - { - int i; - bool ret = false; -@@ -616,7 +619,7 @@ static bool batadv_dat_send_data(struct batadv_priv *bat_priv, - struct sk_buff *tmp_skb; - struct batadv_dat_candidate *cand; - -- cand = batadv_dat_select_candidates(bat_priv, ip); -+ cand = batadv_dat_select_candidates(bat_priv, ip, vid); - if (!cand) - goto out; +@@ -399,12 +402,13 @@ static int usb_unbind_interface(struct device *dev) + udev = interface_to_usbdev(intf); + error = usb_autoresume_device(udev); -@@ -1004,7 +1007,7 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv, - ret = true; - } else { - /* Send the request to the DHT */ -- ret = batadv_dat_send_data(bat_priv, skb, ip_dst, -+ ret = batadv_dat_send_data(bat_priv, skb, ip_dst, vid, - BATADV_P_DAT_DHT_GET); - } - out: -@@ -1132,8 +1135,8 @@ void batadv_dat_snoop_outgoing_arp_reply(struct batadv_priv *bat_priv, - /* Send the ARP reply to the candidates for both the IP addresses that - * the node obtained from the ARP reply +- /* Hub-initiated LPM policy may change, so attempt to disable LPM until ++ /* If hub-initiated LPM policy may change, attempt to disable LPM until + * the driver is unbound. If LPM isn't disabled, that's fine because it + * wouldn't be enabled unless all the bound interfaces supported + * hub-initiated LPM. */ -- batadv_dat_send_data(bat_priv, skb, ip_src, BATADV_P_DAT_DHT_PUT); -- batadv_dat_send_data(bat_priv, skb, ip_dst, BATADV_P_DAT_DHT_PUT); -+ batadv_dat_send_data(bat_priv, skb, ip_src, vid, BATADV_P_DAT_DHT_PUT); -+ batadv_dat_send_data(bat_priv, skb, ip_dst, vid, BATADV_P_DAT_DHT_PUT); - } +- lpm_disable_error = usb_unlocked_disable_lpm(udev); ++ if (driver->disable_hub_initiated_lpm) ++ lpm_disable_error = usb_unlocked_disable_lpm(udev); - /** -diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c -index e4f2646d9246..43d15d6c4b6a 100644 ---- a/net/batman-adv/routing.c -+++ b/net/batman-adv/routing.c -@@ -104,6 +104,15 @@ static void _batadv_update_route(struct batadv_priv *bat_priv, - neigh_node = NULL; - - spin_lock_bh(&orig_node->neigh_list_lock); -+ /* curr_router used earlier may not be the current orig_ifinfo->router -+ * anymore because it was dereferenced outside of the neigh_list_lock -+ * protected region. After the new best neighbor has replace the current -+ * best neighbor the reference counter needs to decrease. Consequently, -+ * the code needs to ensure the curr_router variable contains a pointer -+ * to the replaced best neighbor. -+ */ -+ curr_router = rcu_dereference_protected(orig_ifinfo->router, true); -+ - rcu_assign_pointer(orig_ifinfo->router, neigh_node); - spin_unlock_bh(&orig_node->neigh_list_lock); - batadv_orig_ifinfo_free_ref(orig_ifinfo); -diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c -index 782fa33ec296..45bfdefa15a5 100644 ---- a/net/batman-adv/send.c -+++ b/net/batman-adv/send.c -@@ -629,6 +629,9 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv, - - if (pending) { - hlist_del(&forw_packet->list); -+ if (!forw_packet->own) -+ atomic_inc(&bat_priv->bcast_queue_left); -+ - batadv_forw_packet_free(forw_packet); - } - } -@@ -656,6 +659,9 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv, + /* + * Terminate all URBs for this interface unless the driver +@@ -505,7 +509,7 @@ int usb_driver_claim_interface(struct usb_driver *driver, + struct device *dev; + struct usb_device *udev; + int retval = 0; +- int lpm_disable_error; ++ int lpm_disable_error = -ENODEV; - if (pending) { - hlist_del(&forw_packet->list); -+ if (!forw_packet->own) -+ atomic_inc(&bat_priv->batman_queue_left); -+ - batadv_forw_packet_free(forw_packet); - } - } -diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c -index ac4d08de5df4..720f1a5b81ac 100644 ---- a/net/batman-adv/soft-interface.c -+++ b/net/batman-adv/soft-interface.c -@@ -407,11 +407,17 @@ void batadv_interface_rx(struct net_device *soft_iface, - */ - nf_reset(skb); + if (!iface) + return -ENODEV; +@@ -526,12 +530,14 @@ int usb_driver_claim_interface(struct usb_driver *driver, -+ if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) -+ goto dropped; -+ - vid = batadv_get_vid(skb, 0); - ethhdr = eth_hdr(skb); + iface->condition = USB_INTERFACE_BOUND; - switch (ntohs(ethhdr->h_proto)) { - case ETH_P_8021Q: -+ if (!pskb_may_pull(skb, VLAN_ETH_HLEN)) -+ goto dropped; -+ - vhdr = (struct vlan_ethhdr *)skb->data; +- /* Disable LPM until this driver is bound. */ +- lpm_disable_error = usb_unlocked_disable_lpm(udev); +- if (lpm_disable_error && driver->disable_hub_initiated_lpm) { +- dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.", +- __func__, driver->name); +- return -ENOMEM; ++ /* See the comment about disabling LPM in usb_probe_interface(). */ ++ if (driver->disable_hub_initiated_lpm) { ++ lpm_disable_error = usb_unlocked_disable_lpm(udev); ++ if (lpm_disable_error) { ++ dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.", ++ __func__, driver->name); ++ return -ENOMEM; ++ } + } - if (vhdr->h_vlan_encapsulated_proto != ethertype) -@@ -423,8 +429,6 @@ void batadv_interface_rx(struct net_device *soft_iface, + /* Claimed interfaces are initially inactive (suspended) and +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 79d895c2dd71..97ef75af9632 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -651,7 +651,7 @@ static void ffs_user_copy_worker(struct work_struct *work) + if (io_data->read && ret > 0) { + use_mm(io_data->mm); + ret = copy_to_iter(io_data->buf, ret, &io_data->data); +- if (iov_iter_count(&io_data->data)) ++ if (ret != io_data->req->actual && iov_iter_count(&io_data->data)) + ret = -EFAULT; + unuse_mm(io_data->mm); } +diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c +index 223ccf89d226..a4f664062e0c 100644 +--- a/drivers/usb/gadget/function/f_mass_storage.c ++++ b/drivers/usb/gadget/function/f_mass_storage.c +@@ -2977,25 +2977,6 @@ void fsg_common_set_inquiry_string(struct fsg_common *common, const char *vn, + } + EXPORT_SYMBOL_GPL(fsg_common_set_inquiry_string); - /* skb->dev & skb->pkt_type are set here */ -- if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) -- goto dropped; - skb->protocol = eth_type_trans(skb, soft_iface); - - /* should not be necessary anymore as we use skb_pull_rcsum() -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index 5a5089cb6570..1363b8ffd89c 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -5979,6 +5979,10 @@ static int add_advertising(struct sock *sk, struct hci_dev *hdev, - return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, - MGMT_STATUS_INVALID_PARAMS); - -+ if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) -+ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, -+ MGMT_STATUS_INVALID_PARAMS); -+ - flags = __le32_to_cpu(cp->flags); - timeout = __le16_to_cpu(cp->timeout); - duration = __le16_to_cpu(cp->duration); -diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c -index 263b4de4de57..60a3dbfca8a1 100644 ---- a/net/bridge/br_ioctl.c -+++ b/net/bridge/br_ioctl.c -@@ -21,18 +21,19 @@ - #include - #include "br_private.h" - --/* called with RTNL */ - static int get_bridge_ifindices(struct net *net, int *indices, int num) +-int fsg_common_run_thread(struct fsg_common *common) +-{ +- common->state = FSG_STATE_IDLE; +- /* Tell the thread to start working */ +- common->thread_task = +- kthread_create(fsg_main_thread, common, "file-storage"); +- if (IS_ERR(common->thread_task)) { +- common->state = FSG_STATE_TERMINATED; +- return PTR_ERR(common->thread_task); +- } +- +- DBG(common, "I/O thread pid: %d\n", task_pid_nr(common->thread_task)); +- +- wake_up_process(common->thread_task); +- +- return 0; +-} +-EXPORT_SYMBOL_GPL(fsg_common_run_thread); +- + static void fsg_common_release(struct kref *ref) { - struct net_device *dev; - int i = 0; - -- for_each_netdev(net, dev) { -+ rcu_read_lock(); -+ for_each_netdev_rcu(net, dev) { - if (i >= num) - break; - if (dev->priv_flags & IFF_EBRIDGE) - indices[i++] = dev->ifindex; + struct fsg_common *common = container_of(ref, struct fsg_common, ref); +@@ -3005,6 +2986,7 @@ static void fsg_common_release(struct kref *ref) + if (common->state != FSG_STATE_TERMINATED) { + raise_exception(common, FSG_STATE_EXIT); + wait_for_completion(&common->thread_notifier); ++ common->thread_task = NULL; } -+ rcu_read_unlock(); - return i; - } -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index 03661d97463c..ea9893743a0f 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -1270,6 +1270,7 @@ static int br_ip4_multicast_query(struct net_bridge *br, - struct br_ip saddr; - unsigned long max_delay; - unsigned long now = jiffies; -+ unsigned int offset = skb_transport_offset(skb); - __be32 group; - int err = 0; - -@@ -1280,14 +1281,14 @@ static int br_ip4_multicast_query(struct net_bridge *br, - - group = ih->group; - -- if (skb->len == sizeof(*ih)) { -+ if (skb->len == offset + sizeof(*ih)) { - max_delay = ih->code * (HZ / IGMP_TIMER_SCALE); - - if (!max_delay) { - max_delay = 10 * HZ; - group = 0; - } -- } else if (skb->len >= sizeof(*ih3)) { -+ } else if (skb->len >= offset + sizeof(*ih3)) { - ih3 = igmpv3_query_hdr(skb); - if (ih3->nsrcs) - goto out; -@@ -1348,6 +1349,7 @@ static int br_ip6_multicast_query(struct net_bridge *br, - struct br_ip saddr; - unsigned long max_delay; - unsigned long now = jiffies; -+ unsigned int offset = skb_transport_offset(skb); - const struct in6_addr *group = NULL; - bool is_general_query; - int err = 0; -@@ -1357,8 +1359,8 @@ static int br_ip6_multicast_query(struct net_bridge *br, - (port && port->state == BR_STATE_DISABLED)) - goto out; + for (i = 0; i < ARRAY_SIZE(common->luns); ++i) { +@@ -3050,9 +3032,21 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f) + if (ret) + return ret; + fsg_common_set_inquiry_string(fsg->common, NULL, NULL); +- ret = fsg_common_run_thread(fsg->common); +- if (ret) ++ } ++ ++ if (!common->thread_task) { ++ common->state = FSG_STATE_IDLE; ++ common->thread_task = ++ kthread_create(fsg_main_thread, common, "file-storage"); ++ if (IS_ERR(common->thread_task)) { ++ int ret = PTR_ERR(common->thread_task); ++ common->thread_task = NULL; ++ common->state = FSG_STATE_TERMINATED; + return ret; ++ } ++ DBG(common, "I/O thread pid: %d\n", ++ task_pid_nr(common->thread_task)); ++ wake_up_process(common->thread_task); + } -- if (skb->len == sizeof(*mld)) { -- if (!pskb_may_pull(skb, sizeof(*mld))) { -+ if (skb->len == offset + sizeof(*mld)) { -+ if (!pskb_may_pull(skb, offset + sizeof(*mld))) { - err = -EINVAL; - goto out; - } -@@ -1367,7 +1369,7 @@ static int br_ip6_multicast_query(struct net_bridge *br, - if (max_delay) - group = &mld->mld_mca; - } else { -- if (!pskb_may_pull(skb, sizeof(*mld2q))) { -+ if (!pskb_may_pull(skb, offset + sizeof(*mld2q))) { - err = -EINVAL; - goto out; - } -diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c -index b3cca126b103..e2670c5baafd 100644 ---- a/net/bridge/br_stp.c -+++ b/net/bridge/br_stp.c -@@ -568,6 +568,14 @@ int br_set_max_age(struct net_bridge *br, unsigned long val) + fsg->gadget = gadget; +diff --git a/drivers/usb/gadget/function/f_mass_storage.h b/drivers/usb/gadget/function/f_mass_storage.h +index 445df6775609..b6a9918eaefb 100644 +--- a/drivers/usb/gadget/function/f_mass_storage.h ++++ b/drivers/usb/gadget/function/f_mass_storage.h +@@ -153,8 +153,6 @@ int fsg_common_create_luns(struct fsg_common *common, struct fsg_config *cfg); + void fsg_common_set_inquiry_string(struct fsg_common *common, const char *vn, + const char *pn); - } +-int fsg_common_run_thread(struct fsg_common *common); +- + void fsg_config_from_params(struct fsg_config *cfg, + const struct fsg_module_parameters *params, + unsigned int fsg_num_buffers); +diff --git a/drivers/usb/gadget/legacy/acm_ms.c b/drivers/usb/gadget/legacy/acm_ms.c +index c16089efc322..c39de65a448b 100644 +--- a/drivers/usb/gadget/legacy/acm_ms.c ++++ b/drivers/usb/gadget/legacy/acm_ms.c +@@ -133,10 +133,6 @@ static int acm_ms_do_config(struct usb_configuration *c) + if (status < 0) + goto put_msg; -+/* Set time interval that dynamic forwarding entries live -+ * For pure software bridge, allow values outside the 802.1 -+ * standard specification for special cases: -+ * 0 - entry never ages (all permanant) -+ * 1 - entry disappears (no persistance) -+ * -+ * Offloaded switch entries maybe more restrictive -+ */ - int br_set_ageing_time(struct net_bridge *br, u32 ageing_time) - { - struct switchdev_attr attr = { -@@ -579,11 +587,8 @@ int br_set_ageing_time(struct net_bridge *br, u32 ageing_time) - unsigned long t = clock_t_to_jiffies(ageing_time); - int err; +- status = fsg_common_run_thread(opts->common); +- if (status) +- goto remove_acm; +- + status = usb_add_function(c, f_msg); + if (status) + goto remove_acm; +diff --git a/drivers/usb/gadget/legacy/mass_storage.c b/drivers/usb/gadget/legacy/mass_storage.c +index e61af53c7d2b..125974f32f50 100644 +--- a/drivers/usb/gadget/legacy/mass_storage.c ++++ b/drivers/usb/gadget/legacy/mass_storage.c +@@ -132,10 +132,6 @@ static int msg_do_config(struct usb_configuration *c) + if (IS_ERR(f_msg)) + return PTR_ERR(f_msg); -- if (t < BR_MIN_AGEING_TIME || t > BR_MAX_AGEING_TIME) -- return -ERANGE; +- ret = fsg_common_run_thread(opts->common); +- if (ret) +- goto put_func; - - err = switchdev_port_attr_set(br->dev, &attr); -- if (err) -+ if (err && err != -EOPNOTSUPP) - return err; - - br->ageing_time = t; -diff --git a/net/core/filter.c b/net/core/filter.c -index bba502f7cd57..fb2951c3532d 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -1147,7 +1147,8 @@ void bpf_prog_destroy(struct bpf_prog *fp) - } - EXPORT_SYMBOL_GPL(bpf_prog_destroy); + ret = usb_add_function(c, f_msg); + if (ret) + goto put_func; +diff --git a/drivers/usb/gadget/legacy/multi.c b/drivers/usb/gadget/legacy/multi.c +index 229d704a620b..a70a406580ea 100644 +--- a/drivers/usb/gadget/legacy/multi.c ++++ b/drivers/usb/gadget/legacy/multi.c +@@ -137,7 +137,6 @@ static struct usb_function *f_msg_rndis; --static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk) -+static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk, -+ bool locked) + static int rndis_do_config(struct usb_configuration *c) { - struct sk_filter *fp, *old_fp; +- struct fsg_opts *fsg_opts; + int ret; -@@ -1163,10 +1164,8 @@ static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk) - return -ENOMEM; + if (gadget_is_otg(c->cdev->gadget)) { +@@ -169,11 +168,6 @@ static int rndis_do_config(struct usb_configuration *c) + goto err_fsg; } -- old_fp = rcu_dereference_protected(sk->sk_filter, -- sock_owned_by_user(sk)); -+ old_fp = rcu_dereference_protected(sk->sk_filter, locked); - rcu_assign_pointer(sk->sk_filter, fp); +- fsg_opts = fsg_opts_from_func_inst(fi_msg); +- ret = fsg_common_run_thread(fsg_opts->common); +- if (ret) +- goto err_run; - - if (old_fp) - sk_filter_uncharge(sk, old_fp); + ret = usb_add_function(c, f_msg_rndis); + if (ret) + goto err_run; +@@ -225,7 +219,6 @@ static struct usb_function *f_msg_multi; -@@ -1245,7 +1244,8 @@ struct bpf_prog *__get_filter(struct sock_fprog *fprog, struct sock *sk) - * occurs or there is insufficient memory for the filter a negative - * errno code is returned. On success the return is zero. - */ --int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) -+int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk, -+ bool locked) + static int cdc_do_config(struct usb_configuration *c) { - struct bpf_prog *prog = __get_filter(fprog, sk); - int err; -@@ -1253,7 +1253,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) - if (IS_ERR(prog)) - return PTR_ERR(prog); +- struct fsg_opts *fsg_opts; + int ret; -- err = __sk_attach_prog(prog, sk); -+ err = __sk_attach_prog(prog, sk, locked); - if (err < 0) { - __bpf_prog_release(prog); - return err; -@@ -1261,7 +1261,12 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) + if (gadget_is_otg(c->cdev->gadget)) { +@@ -258,11 +251,6 @@ static int cdc_do_config(struct usb_configuration *c) + goto err_fsg; + } - return 0; - } --EXPORT_SYMBOL_GPL(sk_attach_filter); -+EXPORT_SYMBOL_GPL(__sk_attach_filter); -+ -+int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) -+{ -+ return __sk_attach_filter(fprog, sk, sock_owned_by_user(sk)); -+} +- fsg_opts = fsg_opts_from_func_inst(fi_msg); +- ret = fsg_common_run_thread(fsg_opts->common); +- if (ret) +- goto err_run; +- + ret = usb_add_function(c, f_msg_multi); + if (ret) + goto err_run; +diff --git a/drivers/usb/gadget/legacy/nokia.c b/drivers/usb/gadget/legacy/nokia.c +index 09975046c694..b1e535f4022e 100644 +--- a/drivers/usb/gadget/legacy/nokia.c ++++ b/drivers/usb/gadget/legacy/nokia.c +@@ -152,7 +152,6 @@ static int nokia_bind_config(struct usb_configuration *c) + struct usb_function *f_ecm; + struct usb_function *f_obex2 = NULL; + struct usb_function *f_msg; +- struct fsg_opts *fsg_opts; + int status = 0; + int obex1_stat = -1; + int obex2_stat = -1; +@@ -222,12 +221,6 @@ static int nokia_bind_config(struct usb_configuration *c) + goto err_ecm; + } - int sk_reuseport_attach_filter(struct sock_fprog *fprog, struct sock *sk) - { -@@ -1307,7 +1312,7 @@ int sk_attach_bpf(u32 ufd, struct sock *sk) - if (IS_ERR(prog)) - return PTR_ERR(prog); - -- err = __sk_attach_prog(prog, sk); -+ err = __sk_attach_prog(prog, sk, sock_owned_by_user(sk)); - if (err < 0) { - bpf_prog_put(prog); - return err; -@@ -2105,7 +2110,7 @@ static int __init register_sk_filter_ops(void) - } - late_initcall(register_sk_filter_ops); +- fsg_opts = fsg_opts_from_func_inst(fi_msg); +- +- status = fsg_common_run_thread(fsg_opts->common); +- if (status) +- goto err_msg; +- + status = usb_add_function(c, f_msg); + if (status) + goto err_msg; +diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c +index b86a6f03592e..e272b3ba1d14 100644 +--- a/drivers/usb/gadget/udc/udc-core.c ++++ b/drivers/usb/gadget/udc/udc-core.c +@@ -75,7 +75,7 @@ int usb_gadget_map_request(struct usb_gadget *gadget, + mapped = dma_map_sg(dev, req->sg, req->num_sgs, + is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE); + if (mapped == 0) { +- dev_err(&gadget->dev, "failed to map SGs\n"); ++ dev_err(dev, "failed to map SGs\n"); + return -EFAULT; + } --int sk_detach_filter(struct sock *sk) -+int __sk_detach_filter(struct sock *sk, bool locked) +diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c +index 92fdb6e9faff..c78ff95a43be 100644 +--- a/drivers/usb/misc/usbtest.c ++++ b/drivers/usb/misc/usbtest.c +@@ -529,6 +529,7 @@ static struct scatterlist * + alloc_sglist(int nents, int max, int vary, struct usbtest_dev *dev, int pipe) { - int ret = -ENOENT; - struct sk_filter *filter; -@@ -2113,8 +2118,7 @@ int sk_detach_filter(struct sock *sk) - if (sock_flag(sk, SOCK_FILTER_LOCKED)) - return -EPERM; - -- filter = rcu_dereference_protected(sk->sk_filter, -- sock_owned_by_user(sk)); -+ filter = rcu_dereference_protected(sk->sk_filter, locked); - if (filter) { - RCU_INIT_POINTER(sk->sk_filter, NULL); - sk_filter_uncharge(sk, filter); -@@ -2123,7 +2127,12 @@ int sk_detach_filter(struct sock *sk) + struct scatterlist *sg; ++ unsigned int n_size = 0; + unsigned i; + unsigned size = max; + unsigned maxpacket = +@@ -561,7 +562,8 @@ alloc_sglist(int nents, int max, int vary, struct usbtest_dev *dev, int pipe) + break; + case 1: + for (j = 0; j < size; j++) +- *buf++ = (u8) ((j % maxpacket) % 63); ++ *buf++ = (u8) (((j + n_size) % maxpacket) % 63); ++ n_size += size; + break; + } - return ret; - } --EXPORT_SYMBOL_GPL(sk_detach_filter); -+EXPORT_SYMBOL_GPL(__sk_detach_filter); -+ -+int sk_detach_filter(struct sock *sk) -+{ -+ return __sk_detach_filter(sk, sock_owned_by_user(sk)); -+} +diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c +index f49327d20ee8..0a935b1e5475 100644 +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -2849,14 +2849,16 @@ static int edge_startup(struct usb_serial *serial) + /* not set up yet, so do it now */ + edge_serial->interrupt_read_urb = + usb_alloc_urb(0, GFP_KERNEL); +- if (!edge_serial->interrupt_read_urb) +- return -ENOMEM; ++ if (!edge_serial->interrupt_read_urb) { ++ response = -ENOMEM; ++ break; ++ } - int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf, - unsigned int len) -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 8261d95dd846..482c3717a45e 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -905,6 +905,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev, - + rtnl_link_get_af_size(dev, ext_filter_mask) /* IFLA_AF_SPEC */ - + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_PORT_ID */ - + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_SWITCH_ID */ -+ + nla_total_size(IFNAMSIZ) /* IFLA_PHYS_PORT_NAME */ - + nla_total_size(1); /* IFLA_PROTO_DOWN */ + edge_serial->interrupt_in_buffer = + kmalloc(buffer_size, GFP_KERNEL); + if (!edge_serial->interrupt_in_buffer) { +- usb_free_urb(edge_serial->interrupt_read_urb); +- return -ENOMEM; ++ response = -ENOMEM; ++ break; + } + edge_serial->interrupt_in_endpoint = + endpoint->bEndpointAddress; +@@ -2884,14 +2886,16 @@ static int edge_startup(struct usb_serial *serial) + /* not set up yet, so do it now */ + edge_serial->read_urb = + usb_alloc_urb(0, GFP_KERNEL); +- if (!edge_serial->read_urb) +- return -ENOMEM; ++ if (!edge_serial->read_urb) { ++ response = -ENOMEM; ++ break; ++ } - } -@@ -1175,14 +1176,16 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb, + edge_serial->bulk_in_buffer = + kmalloc(buffer_size, GFP_KERNEL); + if (!edge_serial->bulk_in_buffer) { +- usb_free_urb(edge_serial->read_urb); +- return -ENOMEM; ++ response = -ENOMEM; ++ break; + } + edge_serial->bulk_in_endpoint = + endpoint->bEndpointAddress; +@@ -2917,9 +2921,22 @@ static int edge_startup(struct usb_serial *serial) + } + } - static int rtnl_fill_link_ifmap(struct sk_buff *skb, struct net_device *dev) - { -- struct rtnl_link_ifmap map = { -- .mem_start = dev->mem_start, -- .mem_end = dev->mem_end, -- .base_addr = dev->base_addr, -- .irq = dev->irq, -- .dma = dev->dma, -- .port = dev->if_port, -- }; -+ struct rtnl_link_ifmap map; -+ -+ memset(&map, 0, sizeof(map)); -+ map.mem_start = dev->mem_start; -+ map.mem_end = dev->mem_end; -+ map.base_addr = dev->base_addr; -+ map.irq = dev->irq; -+ map.dma = dev->dma; -+ map.port = dev->if_port; +- if (!interrupt_in_found || !bulk_in_found || !bulk_out_found) { +- dev_err(ddev, "Error - the proper endpoints were not found!\n"); +- return -ENODEV; ++ if (response || !interrupt_in_found || !bulk_in_found || ++ !bulk_out_found) { ++ if (!response) { ++ dev_err(ddev, "expected endpoints not found\n"); ++ response = -ENODEV; ++ } + - if (nla_put(skb, IFLA_MAP, sizeof(map), &map)) - return -EMSGSIZE; - -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 8616d1147c93..9835d9a8a7a4 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -4427,15 +4427,16 @@ int skb_vlan_push(struct sk_buff *skb, __be16 vlan_proto, u16 vlan_tci) - __skb_push(skb, offset); - err = __vlan_insert_tag(skb, skb->vlan_proto, - skb_vlan_tag_get(skb)); -- if (err) -+ if (err) { -+ __skb_pull(skb, offset); - return err; -+ } ++ usb_free_urb(edge_serial->interrupt_read_urb); ++ kfree(edge_serial->interrupt_in_buffer); + - skb->protocol = skb->vlan_proto; - skb->mac_len += VLAN_HLEN; -- __skb_pull(skb, offset); - -- if (skb->ip_summed == CHECKSUM_COMPLETE) -- skb->csum = csum_add(skb->csum, csum_partial(skb->data -- + (2 * ETH_ALEN), VLAN_HLEN, 0)); -+ skb_postpush_rcsum(skb, skb->data + (2 * ETH_ALEN), VLAN_HLEN); -+ __skb_pull(skb, offset); - } - __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci); - return 0; -diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c -index 902d606324a0..8be8f27bfacc 100644 ---- a/net/dccp/ipv4.c -+++ b/net/dccp/ipv4.c -@@ -204,8 +204,6 @@ void dccp_req_err(struct sock *sk, u64 seq) - * ICMPs are not backlogged, hence we cannot get an established - * socket here. - */ -- WARN_ON(req->sk); -- - if (!between48(seq, dccp_rsk(req)->dreq_iss, dccp_rsk(req)->dreq_gss)) { - NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS); - } else { -diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c -index 607a14f20d88..b1dc096d22f8 100644 ---- a/net/decnet/dn_route.c -+++ b/net/decnet/dn_route.c -@@ -1034,10 +1034,13 @@ source_ok: - if (!fld.daddr) { - fld.daddr = fld.saddr; - -- err = -EADDRNOTAVAIL; - if (dev_out) - dev_put(dev_out); -+ err = -EINVAL; - dev_out = init_net.loopback_dev; -+ if (!dev_out->dn_ptr) -+ goto out; -+ err = -EADDRNOTAVAIL; - dev_hold(dev_out); - if (!fld.daddr) { - fld.daddr = -@@ -1110,6 +1113,8 @@ source_ok: - if (dev_out == NULL) - goto out; - dn_db = rcu_dereference_raw(dev_out->dn_ptr); -+ if (!dn_db) -+ goto e_inval; - /* Possible improvement - check all devices for local addr */ - if (dn_dev_islocal(dev_out, fld.daddr)) { - dev_put(dev_out); -@@ -1151,6 +1156,8 @@ select_source: - dev_put(dev_out); - dev_out = init_net.loopback_dev; - dev_hold(dev_out); -+ if (!dev_out->dn_ptr) -+ goto e_inval; - fld.flowidn_oif = dev_out->ifindex; - if (res.fi) - dn_fib_info_put(res.fi); -diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c -index fa4daba8db55..d8fb47fcad05 100644 ---- a/net/dsa/dsa.c -+++ b/net/dsa/dsa.c -@@ -935,6 +935,14 @@ static void dsa_remove_dst(struct dsa_switch_tree *dst) - { - int i; - -+ dst->master_netdev->dsa_ptr = NULL; ++ usb_free_urb(edge_serial->read_urb); ++ kfree(edge_serial->bulk_in_buffer); + -+ /* If we used a tagging format that doesn't have an ethertype -+ * field, make sure that all packets from this point get sent -+ * without the tag and go through the regular receive path. -+ */ -+ wmb(); ++ kfree(edge_serial); + - for (i = 0; i < dst->pd->nr_chips; i++) { - struct dsa_switch *ds = dst->ds[i]; ++ return response; + } -@@ -988,14 +996,6 @@ static int dsa_suspend(struct device *d) - struct dsa_switch_tree *dst = platform_get_drvdata(pdev); - int i, ret = 0; + /* start interrupt read for this edgeport this interrupt will +@@ -2942,16 +2959,9 @@ static void edge_disconnect(struct usb_serial *serial) + { + struct edgeport_serial *edge_serial = usb_get_serial_data(serial); -- dst->master_netdev->dsa_ptr = NULL; -- -- /* If we used a tagging format that doesn't have an ethertype -- * field, make sure that all packets from this point get sent -- * without the tag and go through the regular receive path. -- */ -- wmb(); +- /* stop reads and writes on all ports */ +- /* free up our endpoint stuff */ + if (edge_serial->is_epic) { + usb_kill_urb(edge_serial->interrupt_read_urb); +- usb_free_urb(edge_serial->interrupt_read_urb); +- kfree(edge_serial->interrupt_in_buffer); - - for (i = 0; i < dst->pd->nr_chips; i++) { - struct dsa_switch *ds = dst->ds[i]; - -diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c -index f6303b17546b..0212591b0077 100644 ---- a/net/ipv4/devinet.c -+++ b/net/ipv4/devinet.c -@@ -334,6 +334,9 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap, - - ASSERT_RTNL(); - -+ if (in_dev->dead) -+ goto no_promotions; -+ - /* 1. Deleting primary ifaddr forces deletion all secondaries - * unless alias promotion is set - **/ -@@ -380,6 +383,7 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap, - fib_del_ifaddr(ifa, ifa1); - } - -+no_promotions: - /* 2. Unlink it */ - - *ifap = ifa1->ifa_next; -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index 473447593060..63566ec54794 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -280,7 +280,6 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) - struct in_device *in_dev; - struct fib_result res; - struct rtable *rt; -- struct flowi4 fl4; - struct net *net; - int scope; - -@@ -296,14 +295,13 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) - - scope = RT_SCOPE_UNIVERSE; - if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) { -- fl4.flowi4_oif = 0; -- fl4.flowi4_iif = LOOPBACK_IFINDEX; -- fl4.daddr = ip_hdr(skb)->saddr; -- fl4.saddr = 0; -- fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos); -- fl4.flowi4_scope = scope; -- fl4.flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0; -- fl4.flowi4_tun_key.tun_id = 0; -+ struct flowi4 fl4 = { -+ .flowi4_iif = LOOPBACK_IFINDEX, -+ .daddr = ip_hdr(skb)->saddr, -+ .flowi4_tos = RT_TOS(ip_hdr(skb)->tos), -+ .flowi4_scope = scope, -+ .flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0, -+ }; - if (!fib_lookup(net, &fl4, &res, 0)) - return FIB_RES_PREFSRC(net, res); - } else { -@@ -906,7 +904,11 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) - if (ifa->ifa_flags & IFA_F_SECONDARY) { - prim = inet_ifa_byprefix(in_dev, any, ifa->ifa_mask); - if (!prim) { -- pr_warn("%s: bug: prim == NULL\n", __func__); -+ /* if the device has been deleted, we don't perform -+ * address promotion -+ */ -+ if (!in_dev->dead) -+ pr_warn("%s: bug: prim == NULL\n", __func__); - return; - } - if (iprim && iprim != prim) { -@@ -922,6 +924,9 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) - subnet = 1; - } - -+ if (in_dev->dead) -+ goto no_promotions; -+ - /* Deletion is more complicated than add. - * We should take care of not to delete too much :-) - * -@@ -997,6 +1002,7 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) - } + usb_kill_urb(edge_serial->read_urb); +- usb_free_urb(edge_serial->read_urb); +- kfree(edge_serial->bulk_in_buffer); } - -+no_promotions: - if (!(ok & BRD_OK)) - fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim); - if (subnet && ifa->ifa_prefixlen < 31) { -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index d97268e8ff10..2b68418c7198 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -975,6 +975,8 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg) - val = 65535 - 40; - if (type == RTAX_MTU && val > 65535 - 15) - val = 65535 - 15; -+ if (type == RTAX_HOPLIMIT && val > 255) -+ val = 255; - if (type == RTAX_FEATURES && (val & ~RTAX_FEATURE_MASK)) - return -EINVAL; - fi->fib_metrics[type - 1] = val; -diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c -index 41ba68de46d8..d0c1e7766214 100644 ---- a/net/ipv4/ip_gre.c -+++ b/net/ipv4/ip_gre.c -@@ -179,6 +179,7 @@ static __be16 tnl_flags_to_gre_flags(__be16 tflags) - return flags; } -+/* Fills in tpi and returns header length to be pulled. */ - static int parse_gre_header(struct sk_buff *skb, struct tnl_ptk_info *tpi, - bool *csum_err) +@@ -2964,6 +2974,16 @@ static void edge_release(struct usb_serial *serial) { -@@ -238,7 +239,7 @@ static int parse_gre_header(struct sk_buff *skb, struct tnl_ptk_info *tpi, - return -EINVAL; - } - } -- return iptunnel_pull_header(skb, hdr_len, tpi->proto); -+ return hdr_len; + struct edgeport_serial *edge_serial = usb_get_serial_data(serial); + ++ if (edge_serial->is_epic) { ++ usb_kill_urb(edge_serial->interrupt_read_urb); ++ usb_free_urb(edge_serial->interrupt_read_urb); ++ kfree(edge_serial->interrupt_in_buffer); ++ ++ usb_kill_urb(edge_serial->read_urb); ++ usb_free_urb(edge_serial->read_urb); ++ kfree(edge_serial->bulk_in_buffer); ++ } ++ + kfree(edge_serial); } - static void ipgre_err(struct sk_buff *skb, u32 info, -@@ -341,7 +342,7 @@ static void gre_err(struct sk_buff *skb, u32 info) - struct tnl_ptk_info tpi; - bool csum_err = false; - -- if (parse_gre_header(skb, &tpi, &csum_err)) { -+ if (parse_gre_header(skb, &tpi, &csum_err) < 0) { - if (!csum_err) /* ignore csum errors. */ - return; - } -@@ -419,6 +420,7 @@ static int gre_rcv(struct sk_buff *skb) - { - struct tnl_ptk_info tpi; - bool csum_err = false; -+ int hdr_len; +diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c +index e07b15ed5814..7faa901ee47f 100644 +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -2376,6 +2376,10 @@ static void keyspan_release(struct usb_serial *serial) - #ifdef CONFIG_NET_IPGRE_BROADCAST - if (ipv4_is_multicast(ip_hdr(skb)->daddr)) { -@@ -428,7 +430,10 @@ static int gre_rcv(struct sk_buff *skb) - } - #endif + s_priv = usb_get_serial_data(serial); -- if (parse_gre_header(skb, &tpi, &csum_err) < 0) -+ hdr_len = parse_gre_header(skb, &tpi, &csum_err); -+ if (hdr_len < 0) -+ goto drop; -+ if (iptunnel_pull_header(skb, hdr_len, tpi.proto) < 0) - goto drop; - - if (ipgre_rcv(skb, &tpi) == PACKET_RCVD) -diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c -index c6eb42100e9a..ea91058b5f6f 100644 ---- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c -+++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c -@@ -108,10 +108,18 @@ static int masq_inet_event(struct notifier_block *this, - unsigned long event, - void *ptr) - { -- struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev; -+ struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev; - struct netdev_notifier_info info; - -- netdev_notifier_info_init(&info, dev); -+ /* The masq_dev_notifier will catch the case of the device going -+ * down. So if the inetdev is dead and being destroyed we have -+ * no work to do. Otherwise this is an individual address removal -+ * and we have to perform the flush. -+ */ -+ if (idev->dead) -+ return NOTIFY_DONE; ++ /* Make sure to unlink the URBs submitted in attach. */ ++ usb_kill_urb(s_priv->instat_urb); ++ usb_kill_urb(s_priv->indat_urb); + -+ netdev_notifier_info_init(&info, idev->dev); - return masq_device_event(this, event, &info); + usb_free_urb(s_priv->instat_urb); + usb_free_urb(s_priv->indat_urb); + usb_free_urb(s_priv->glocont_urb); +diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c +index 31a8b47f1ac6..c6596cbcc4b6 100644 +--- a/drivers/usb/serial/mxuport.c ++++ b/drivers/usb/serial/mxuport.c +@@ -1259,6 +1259,15 @@ static int mxuport_attach(struct usb_serial *serial) + return 0; } -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 02c62299d717..b050cf980a57 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -2045,6 +2045,18 @@ static struct rtable *__mkroute_output(const struct fib_result *res, - */ - if (fi && res->prefixlen < 4) - fi = NULL; -+ } else if ((type == RTN_LOCAL) && (orig_oif != 0) && -+ (orig_oif != dev_out->ifindex)) { -+ /* For local routes that require a particular output interface -+ * we do not want to cache the result. Caching the result -+ * causes incorrect behaviour when there are multiple source -+ * addresses on the interface, the end result being that if the -+ * intended recipient is waiting on that interface for the -+ * packet he won't receive it because it will be delivered on -+ * the loopback interface and the IP_PKTINFO ipi_ifindex will -+ * be set to the loopback interface as well. -+ */ -+ fi = NULL; - } - - fnhe = NULL; -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 487ac67059e2..a7b1a905580b 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -319,8 +319,6 @@ void tcp_req_err(struct sock *sk, u32 seq, bool abort) - /* ICMPs are not backlogged, hence we cannot get - * an established socket here. - */ -- WARN_ON(req->sk); -- - if (seq != tcp_rsk(req)->snt_isn) { - NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS); - } else if (abort) { -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index fda379cd600d..b6876f2f4cf2 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2625,8 +2625,10 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb) - */ - if (unlikely((NET_IP_ALIGN && ((unsigned long)skb->data & 3)) || - skb_headroom(skb) >= 0xFFFF)) { -- struct sk_buff *nskb = __pskb_copy(skb, MAX_TCP_HEADER, -- GFP_ATOMIC); -+ struct sk_buff *nskb; ++static void mxuport_release(struct usb_serial *serial) ++{ ++ struct usb_serial_port *port0 = serial->port[0]; ++ struct usb_serial_port *port1 = serial->port[1]; + -+ skb_mstamp_get(&skb->skb_mstamp); -+ nskb = __pskb_copy(skb, MAX_TCP_HEADER, GFP_ATOMIC); - err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) : - -ENOBUFS; - } else { -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 95d2f198017e..56218ff388c7 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -339,8 +339,13 @@ found: - - hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash); - spin_lock(&hslot2->lock); -- hlist_nulls_add_head_rcu(&udp_sk(sk)->udp_portaddr_node, -- &hslot2->head); -+ if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport && -+ sk->sk_family == AF_INET6) -+ hlist_nulls_add_tail_rcu(&udp_sk(sk)->udp_portaddr_node, -+ &hslot2->head); -+ else -+ hlist_nulls_add_head_rcu(&udp_sk(sk)->udp_portaddr_node, -+ &hslot2->head); - hslot2->count++; - spin_unlock(&hslot2->lock); - } -@@ -2082,10 +2087,14 @@ void udp_v4_early_demux(struct sk_buff *skb) - if (!in_dev) - return; - -- ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr, -- iph->protocol); -- if (!ours) -- return; -+ /* we are supposed to accept bcast packets */ -+ if (skb->pkt_type == PACKET_MULTICAST) { -+ ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr, -+ iph->protocol); -+ if (!ours) -+ return; -+ } ++ usb_serial_generic_close(port1); ++ usb_serial_generic_close(port0); ++} + - sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr, - uh->source, iph->saddr, dif); - } else if (skb->pkt_type == PACKET_HOST) { -diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c -index 2ae3c4fd8aab..41f18de5dcc2 100644 ---- a/net/ipv6/ila/ila_lwt.c -+++ b/net/ipv6/ila/ila_lwt.c -@@ -120,8 +120,7 @@ nla_put_failure: - - static int ila_encap_nlsize(struct lwtunnel_state *lwtstate) + static int mxuport_open(struct tty_struct *tty, struct usb_serial_port *port) { -- /* No encapsulation overhead */ -- return 0; -+ return nla_total_size(sizeof(u64)); /* ILA_ATTR_LOCATOR */ - } + struct mxuport_port *mxport = usb_get_serial_port_data(port); +@@ -1361,6 +1370,7 @@ static struct usb_serial_driver mxuport_device = { + .probe = mxuport_probe, + .port_probe = mxuport_port_probe, + .attach = mxuport_attach, ++ .release = mxuport_release, + .calc_num_ports = mxuport_calc_num_ports, + .open = mxuport_open, + .close = mxuport_close, +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index c6f497f16526..d96d423d00e6 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -375,18 +375,22 @@ static void option_instat_callback(struct urb *urb); + #define HAIER_PRODUCT_CE81B 0x10f8 + #define HAIER_PRODUCT_CE100 0x2009 + +-/* Cinterion (formerly Siemens) products */ +-#define SIEMENS_VENDOR_ID 0x0681 +-#define CINTERION_VENDOR_ID 0x1e2d ++/* Gemalto's Cinterion products (formerly Siemens) */ ++#define SIEMENS_VENDOR_ID 0x0681 ++#define CINTERION_VENDOR_ID 0x1e2d ++#define CINTERION_PRODUCT_HC25_MDMNET 0x0040 + #define CINTERION_PRODUCT_HC25_MDM 0x0047 +-#define CINTERION_PRODUCT_HC25_MDMNET 0x0040 ++#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */ + #define CINTERION_PRODUCT_HC28_MDM 0x004C +-#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */ + #define CINTERION_PRODUCT_EU3_E 0x0051 + #define CINTERION_PRODUCT_EU3_P 0x0052 + #define CINTERION_PRODUCT_PH8 0x0053 + #define CINTERION_PRODUCT_AHXX 0x0055 + #define CINTERION_PRODUCT_PLXX 0x0060 ++#define CINTERION_PRODUCT_PH8_2RMNET 0x0082 ++#define CINTERION_PRODUCT_PH8_AUDIO 0x0083 ++#define CINTERION_PRODUCT_AHXX_2RMNET 0x0084 ++#define CINTERION_PRODUCT_AHXX_AUDIO 0x0085 - static int ila_encap_cmp(struct lwtunnel_state *a, struct lwtunnel_state *b) -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index a163102f1803..2a6606c935cc 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1091,8 +1091,8 @@ static inline int ip6_ufo_append_data(struct sock *sk, - int getfrag(void *from, char *to, int offset, int len, - int odd, struct sk_buff *skb), - void *from, int length, int hh_len, int fragheaderlen, -- int transhdrlen, int mtu, unsigned int flags, -- const struct flowi6 *fl6) -+ int exthdrlen, int transhdrlen, int mtu, -+ unsigned int flags, const struct flowi6 *fl6) + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c +@@ -633,6 +637,10 @@ static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = { + .reserved = BIT(1) | BIT(2) | BIT(3), + }; - { - struct sk_buff *skb; -@@ -1117,7 +1117,7 @@ static inline int ip6_ufo_append_data(struct sock *sk, - skb_put(skb, fragheaderlen + transhdrlen); - - /* initialize network header pointer */ -- skb_reset_network_header(skb); -+ skb_set_network_header(skb, exthdrlen); - - /* initialize protocol header pointer */ - skb->transport_header = skb->network_header + fragheaderlen; -@@ -1359,7 +1359,7 @@ emsgsize: - (rt->dst.dev->features & NETIF_F_UFO) && - (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) { - err = ip6_ufo_append_data(sk, queue, getfrag, from, length, -- hh_len, fragheaderlen, -+ hh_len, fragheaderlen, exthdrlen, - transhdrlen, mtu, flags, fl6); - if (err) - goto error; -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 6c5dfec7a377..3991b21e24ad 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -343,12 +343,12 @@ static int ip6_tnl_create2(struct net_device *dev) - - t = netdev_priv(dev); - -+ dev->rtnl_link_ops = &ip6_link_ops; - err = register_netdevice(dev); - if (err < 0) - goto out; ++static const struct option_blacklist_info cinterion_rmnet2_blacklist = { ++ .reserved = BIT(4) | BIT(5), ++}; ++ + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, +@@ -1602,7 +1610,79 @@ static const struct usb_device_id option_ids[] = { + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff42, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff43, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff44, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff45, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff46, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff47, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff48, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff49, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4a, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4b, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4c, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4d, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4e, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff50, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff51, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff52, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff53, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff54, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff55, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff56, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff57, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff58, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff59, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5a, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5b, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5c, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5d, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5e, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff60, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff61, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff62, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff63, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff64, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff65, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff66, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff67, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff68, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff69, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6a, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6b, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6c, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6d, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6e, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff70, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff71, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff72, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff73, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff74, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff75, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff76, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff77, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff78, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff79, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7a, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7b, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7c, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7d, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7e, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff80, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff81, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff82, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff83, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff84, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff85, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff86, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff87, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff88, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff89, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8a, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) }, +@@ -1613,6 +1693,61 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff9f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa0, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa1, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa2, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa3, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa4, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa5, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa6, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa7, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa8, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa9, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffaa, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffab, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffac, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffae, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffaf, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb0, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb1, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb2, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb3, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb4, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb5, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb6, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb7, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb8, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb9, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffba, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbb, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbc, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbd, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbe, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbf, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc0, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc1, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc2, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc3, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc4, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc5, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc6, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc7, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc8, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc9, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffca, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcb, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcc, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcd, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffce, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcf, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd0, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd1, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd2, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd3, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd4, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd5, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffec, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffee, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xfff6, 0xff, 0xff, 0xff) }, +@@ -1712,7 +1847,13 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, +- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_2RMNET, 0xff), ++ .driver_info = (kernel_ulong_t)&cinterion_rmnet2_blacklist }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_AUDIO, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_2RMNET, 0xff) }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) }, ++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) }, +diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c +index 504f5bff79c0..b18974cbd995 100644 +--- a/drivers/usb/serial/quatech2.c ++++ b/drivers/usb/serial/quatech2.c +@@ -141,6 +141,7 @@ static void qt2_release(struct usb_serial *serial) - strcpy(t->parms.name, dev->name); -- dev->rtnl_link_ops = &ip6_link_ops; - - dev_hold(dev); - ip6_tnl_link(ip6n, t); -diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c -index 18f3498a6c80..e2ea31175ef9 100644 ---- a/net/ipv6/reassembly.c -+++ b/net/ipv6/reassembly.c -@@ -496,10 +496,8 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, - IP6CB(head)->flags |= IP6SKB_FRAGMENTED; - - /* Yes, and fold redundant checksum back. 8) */ -- if (head->ip_summed == CHECKSUM_COMPLETE) -- head->csum = csum_partial(skb_network_header(head), -- skb_network_header_len(head), -- head->csum); -+ skb_postpush_rcsum(head, skb_network_header(head), -+ skb_network_header_len(head)); + serial_priv = usb_get_serial_data(serial); - rcu_read_lock(); - IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS); -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index ed446639219c..18e29e2f8877 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -1737,6 +1737,8 @@ static int ip6_convert_metrics(struct mx6_config *mxc, - } else { - val = nla_get_u32(nla); - } -+ if (type == RTAX_HOPLIMIT && val > 255) -+ val = 255; - if (type == RTAX_FEATURES && (val & ~RTAX_FEATURE_MASK)) - goto err; - -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 422dd014aa2c..6794120f53b8 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -883,8 +883,8 @@ start_lookup: - flush_stack(stack, count, skb, count - 1); - } else { - if (!inner_flushed) -- UDP_INC_STATS_BH(net, UDP_MIB_IGNOREDMULTI, -- proto == IPPROTO_UDPLITE); -+ UDP6_INC_STATS_BH(net, UDP_MIB_IGNOREDMULTI, -+ proto == IPPROTO_UDPLITE); - consume_skb(skb); - } - return 0; -diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c -index ec22078b0914..42de4ccd159f 100644 ---- a/net/l2tp/l2tp_ip.c -+++ b/net/l2tp/l2tp_ip.c -@@ -123,12 +123,11 @@ static int l2tp_ip_recv(struct sk_buff *skb) - struct l2tp_tunnel *tunnel = NULL; - int length; - -- /* Point to L2TP header */ -- optr = ptr = skb->data; -- - if (!pskb_may_pull(skb, 4)) - goto discard; - -+ /* Point to L2TP header */ -+ optr = ptr = skb->data; - session_id = ntohl(*((__be32 *) ptr)); - ptr += 4; - -@@ -156,6 +155,9 @@ static int l2tp_ip_recv(struct sk_buff *skb) - if (!pskb_may_pull(skb, length)) - goto discard; - -+ /* Point to L2TP header */ -+ optr = ptr = skb->data; -+ ptr += 4; - pr_debug("%s: ip recv\n", tunnel->name); - print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); - } -diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c -index a2c8747d2936..9ee4ddb6b397 100644 ---- a/net/l2tp/l2tp_ip6.c -+++ b/net/l2tp/l2tp_ip6.c -@@ -135,12 +135,11 @@ static int l2tp_ip6_recv(struct sk_buff *skb) - struct l2tp_tunnel *tunnel = NULL; - int length; - -- /* Point to L2TP header */ -- optr = ptr = skb->data; -- - if (!pskb_may_pull(skb, 4)) - goto discard; - -+ /* Point to L2TP header */ -+ optr = ptr = skb->data; - session_id = ntohl(*((__be32 *) ptr)); - ptr += 4; - -@@ -168,6 +167,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb) - if (!pskb_may_pull(skb, length)) - goto discard; - -+ /* Point to L2TP header */ -+ optr = ptr = skb->data; -+ ptr += 4; - pr_debug("%s: ip recv\n", tunnel->name); - print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); - } -diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c -index 8dab4e569571..bb8edb9ef506 100644 ---- a/net/llc/af_llc.c -+++ b/net/llc/af_llc.c -@@ -626,6 +626,7 @@ static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb) - if (llc->cmsg_flags & LLC_CMSG_PKTINFO) { - struct llc_pktinfo info; - -+ memset(&info, 0, sizeof(info)); - info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex; - llc_pdu_decode_dsap(skb, &info.lpi_sap); - llc_pdu_decode_da(skb, info.lpi_mac); -diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c -index 978d3bc31df7..1b33d89906e1 100644 ---- a/net/mac80211/ibss.c -+++ b/net/mac80211/ibss.c -@@ -7,6 +7,7 @@ - * Copyright 2007, Michael Wu - * Copyright 2009, Johannes Berg - * Copyright 2013-2014 Intel Mobile Communications GmbH -+ * Copyright(c) 2016 Intel Deutschland GmbH - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 as -@@ -1485,14 +1486,21 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata) - - sdata_info(sdata, "Trigger new scan to find an IBSS to join\n"); - -- num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy, -- &ifibss->chandef, -- channels, -- ARRAY_SIZE(channels)); - scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef); -- ieee80211_request_ibss_scan(sdata, ifibss->ssid, -- ifibss->ssid_len, channels, num, -- scan_width); ++ usb_kill_urb(serial_priv->read_urb); + usb_free_urb(serial_priv->read_urb); + kfree(serial_priv->read_buffer); + kfree(serial_priv); +diff --git a/drivers/watchdog/sp5100_tco.c b/drivers/watchdog/sp5100_tco.c +index 6467b91f2245..028618c5eeba 100644 +--- a/drivers/watchdog/sp5100_tco.c ++++ b/drivers/watchdog/sp5100_tco.c +@@ -73,6 +73,13 @@ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started." + /* + * Some TCO specific functions + */ + -+ if (ifibss->fixed_channel) { -+ num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy, -+ &ifibss->chandef, -+ channels, -+ ARRAY_SIZE(channels)); -+ ieee80211_request_ibss_scan(sdata, ifibss->ssid, -+ ifibss->ssid_len, channels, -+ num, scan_width); -+ } else { -+ ieee80211_request_ibss_scan(sdata, ifibss->ssid, -+ ifibss->ssid_len, NULL, -+ 0, scan_width); -+ } - } else { - int interval = IEEE80211_SCAN_INTERVAL; - -diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c -index c9e325d2e120..bcb0a1b64556 100644 ---- a/net/mac80211/iface.c -+++ b/net/mac80211/iface.c -@@ -977,7 +977,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, - if (sdata->vif.txq) { - struct txq_info *txqi = to_txq_info(sdata->vif.txq); - -+ spin_lock_bh(&txqi->queue.lock); - ieee80211_purge_tx_queue(&local->hw, &txqi->queue); -+ spin_unlock_bh(&txqi->queue.lock); ++static bool tco_has_sp5100_reg_layout(struct pci_dev *dev) ++{ ++ return dev->device == PCI_DEVICE_ID_ATI_SBX00_SMBUS && ++ dev->revision < 0x40; ++} + - atomic_set(&sdata->txqs_len[txqi->txq.ac], 0); - } - -@@ -1747,7 +1750,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name, - - ret = dev_alloc_name(ndev, ndev->name); - if (ret < 0) { -- free_netdev(ndev); -+ ieee80211_if_free(ndev); - return ret; - } - -@@ -1833,7 +1836,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name, - - ret = register_netdevice(ndev); - if (ret) { -- free_netdev(ndev); -+ ieee80211_if_free(ndev); - return ret; - } - } -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 60d093f40f1d..261df74eaf38 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -2249,7 +2249,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) - struct ieee80211_local *local = rx->local; - struct ieee80211_sub_if_data *sdata = rx->sdata; - struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; -- u16 q, hdrlen; -+ u16 ac, q, hdrlen; - - hdr = (struct ieee80211_hdr *) skb->data; - hdrlen = ieee80211_hdrlen(hdr->frame_control); -@@ -2318,7 +2318,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) - ether_addr_equal(sdata->vif.addr, hdr->addr3)) - return RX_CONTINUE; - -- q = ieee80211_select_queue_80211(sdata, skb, hdr); -+ ac = ieee80211_select_queue_80211(sdata, skb, hdr); -+ q = sdata->vif.hw_queue[ac]; - if (ieee80211_queue_stopped(&local->hw, q)) { - IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); - return RX_DROP_MONITOR; -diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c -index a4a4f89d3ba0..23ed038cf7f9 100644 ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -257,11 +257,11 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta) - } - - /* Caller must hold local->sta_mtx */ --static void sta_info_hash_add(struct ieee80211_local *local, -- struct sta_info *sta) -+static int sta_info_hash_add(struct ieee80211_local *local, -+ struct sta_info *sta) - { -- rhashtable_insert_fast(&local->sta_hash, &sta->hash_node, -- sta_rht_params); -+ return rhashtable_insert_fast(&local->sta_hash, &sta->hash_node, -+ sta_rht_params); - } - - static void sta_deliver_ps_frames(struct work_struct *wk) -@@ -498,11 +498,17 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) + static void tco_timer_start(void) { - struct ieee80211_local *local = sta->local; - struct ieee80211_sub_if_data *sdata = sta->sdata; -- struct station_info sinfo; -+ struct station_info *sinfo; - int err = 0; - - lockdep_assert_held(&local->sta_mtx); - -+ sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL); -+ if (!sinfo) { -+ err = -ENOMEM; -+ goto out_err; -+ } -+ - /* check if STA exists already */ - if (sta_info_get_bss(sdata, sta->sta.addr)) { - err = -EEXIST; -@@ -517,7 +523,9 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) - set_sta_flag(sta, WLAN_STA_BLOCK_BA); - - /* make the station visible */ -- sta_info_hash_add(local, sta); -+ err = sta_info_hash_add(local, sta); -+ if (err) -+ goto out_drop_sta; - - list_add_tail_rcu(&sta->list, &local->sta_list); - -@@ -534,10 +542,9 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) - ieee80211_sta_debugfs_add(sta); - rate_control_add_sta_debugfs(sta); - -- memset(&sinfo, 0, sizeof(sinfo)); -- sinfo.filled = 0; -- sinfo.generation = local->sta_generation; -- cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL); -+ sinfo->generation = local->sta_generation; -+ cfg80211_new_sta(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL); -+ kfree(sinfo); - - sta_dbg(sdata, "Inserted STA %pM\n", sta->sta.addr); - -@@ -552,6 +559,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) - out_remove: - sta_info_hash_del(local, sta); - list_del_rcu(&sta->list); -+ out_drop_sta: - local->num_sta--; - synchronize_net(); - __cleanup_single_sta(sta); -@@ -898,7 +906,7 @@ static void __sta_info_destroy_part2(struct sta_info *sta) + u32 val; +@@ -129,7 +136,7 @@ static void tco_timer_enable(void) { - struct ieee80211_local *local = sta->local; - struct ieee80211_sub_if_data *sdata = sta->sdata; -- struct station_info sinfo = {}; -+ struct station_info *sinfo; - int ret; + int val; +- if (sp5100_tco_pci->revision >= 0x40) { ++ if (!tco_has_sp5100_reg_layout(sp5100_tco_pci)) { + /* For SB800 or later */ + /* Set the Watchdog timer resolution to 1 sec */ + outb(SB800_PM_WATCHDOG_CONFIG, SB800_IO_PM_INDEX_REG); +@@ -342,8 +349,7 @@ static unsigned char sp5100_tco_setupdevice(void) /* -@@ -936,8 +944,11 @@ static void __sta_info_destroy_part2(struct sta_info *sta) - - sta_dbg(sdata, "Removed STA %pM\n", sta->sta.addr); - -- sta_set_sinfo(sta, &sinfo); -- cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL); -+ sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL); -+ if (sinfo) -+ sta_set_sinfo(sta, sinfo); -+ cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL); -+ kfree(sinfo); - - rate_control_remove_sta_debugfs(sta); - ieee80211_sta_debugfs_remove(sta); -diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c -index b18c5ed42d95..0b80a7140cc4 100644 ---- a/net/mpls/af_mpls.c -+++ b/net/mpls/af_mpls.c -@@ -543,6 +543,9 @@ static struct net_device *find_outdev(struct net *net, - if (!dev) - return ERR_PTR(-ENODEV); - -+ if (IS_ERR(dev)) -+ return dev; -+ - /* The caller is holding rtnl anyways, so release the dev reference */ - dev_put(dev); - -diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c -index f57b4dcdb233..4da560005b0e 100644 ---- a/net/netfilter/ipvs/ip_vs_core.c -+++ b/net/netfilter/ipvs/ip_vs_core.c -@@ -1757,15 +1757,34 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int - cp = pp->conn_in_get(ipvs, af, skb, &iph); - - conn_reuse_mode = sysctl_conn_reuse_mode(ipvs); -- if (conn_reuse_mode && !iph.fragoffs && -- is_new_conn(skb, &iph) && cp && -- ((unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest && -- unlikely(!atomic_read(&cp->dest->weight))) || -- unlikely(is_new_conn_expected(cp, conn_reuse_mode)))) { -- if (!atomic_read(&cp->n_control)) -- ip_vs_conn_expire_now(cp); -- __ip_vs_conn_put(cp); -- cp = NULL; -+ if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) { -+ bool uses_ct = false, resched = false; -+ -+ if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest && -+ unlikely(!atomic_read(&cp->dest->weight))) { -+ resched = true; -+ uses_ct = ip_vs_conn_uses_conntrack(cp, skb); -+ } else if (is_new_conn_expected(cp, conn_reuse_mode)) { -+ uses_ct = ip_vs_conn_uses_conntrack(cp, skb); -+ if (!atomic_read(&cp->n_control)) { -+ resched = true; -+ } else { -+ /* Do not reschedule controlling connection -+ * that uses conntrack while it is still -+ * referenced by controlled connection(s). -+ */ -+ resched = !uses_ct; -+ } + * Determine type of southbridge chipset. + */ +- if (sp5100_tco_pci->device == PCI_DEVICE_ID_ATI_SBX00_SMBUS && +- sp5100_tco_pci->revision < 0x40) { ++ if (tco_has_sp5100_reg_layout(sp5100_tco_pci)) { + dev_name = SP5100_DEVNAME; + index_reg = SP5100_IO_PM_INDEX_REG; + data_reg = SP5100_IO_PM_DATA_REG; +@@ -388,8 +394,7 @@ static unsigned char sp5100_tco_setupdevice(void) + * Secondly, Find the watchdog timer MMIO address + * from SBResource_MMIO register. + */ +- if (sp5100_tco_pci->device == PCI_DEVICE_ID_ATI_SBX00_SMBUS && +- sp5100_tco_pci->revision < 0x40) { ++ if (tco_has_sp5100_reg_layout(sp5100_tco_pci)) { + /* Read SBResource_MMIO from PCI config(PCI_Reg: 9Ch) */ + pci_read_config_dword(sp5100_tco_pci, + SP5100_SB_RESOURCE_MMIO_BASE, &val); +diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c +index 59727e32ed0f..af0ec2d5ad0e 100644 +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -400,19 +400,27 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer, + sec_blob->LmChallengeResponse.MaximumLength = 0; + + sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer); +- rc = setup_ntlmv2_rsp(ses, nls_cp); +- if (rc) { +- cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); +- goto setup_ntlmv2_ret; ++ if (ses->user_name != NULL) { ++ rc = setup_ntlmv2_rsp(ses, nls_cp); ++ if (rc) { ++ cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); ++ goto setup_ntlmv2_ret; + } ++ memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, ++ ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; + -+ if (resched) { -+ if (!atomic_read(&cp->n_control)) -+ ip_vs_conn_expire_now(cp); -+ __ip_vs_conn_put(cp); -+ if (uses_ct) -+ return NF_DROP; -+ cp = NULL; -+ } ++ sec_blob->NtChallengeResponse.Length = ++ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ sec_blob->NtChallengeResponse.MaximumLength = ++ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ } else { ++ /* ++ * don't send an NT Response for anonymous access ++ */ ++ sec_blob->NtChallengeResponse.Length = 0; ++ sec_blob->NtChallengeResponse.MaximumLength = 0; } - - if (unlikely(!cp)) { -diff --git a/net/netfilter/ipvs/ip_vs_pe_sip.c b/net/netfilter/ipvs/ip_vs_pe_sip.c -index 1b8d594e493a..0a6eb5c0d9e9 100644 ---- a/net/netfilter/ipvs/ip_vs_pe_sip.c -+++ b/net/netfilter/ipvs/ip_vs_pe_sip.c -@@ -70,10 +70,10 @@ ip_vs_sip_fill_param(struct ip_vs_conn_param *p, struct sk_buff *skb) - const char *dptr; - int retc; - -- ip_vs_fill_iph_skb(p->af, skb, false, &iph); -+ retc = ip_vs_fill_iph_skb(p->af, skb, false, &iph); - - /* Only useful with UDP */ -- if (iph.protocol != IPPROTO_UDP) -+ if (!retc || iph.protocol != IPPROTO_UDP) - return -EINVAL; - /* todo: IPv6 fragments: - * I think this only should be done for the first fragment. /HS -@@ -88,7 +88,7 @@ ip_vs_sip_fill_param(struct ip_vs_conn_param *p, struct sk_buff *skb) - dptr = skb->data + dataoff; - datalen = skb->len - dataoff; - -- if (get_callid(dptr, dataoff, datalen, &matchoff, &matchlen)) -+ if (get_callid(dptr, 0, datalen, &matchoff, &matchlen)) - return -EINVAL; - - /* N.B: pe_data is only set on success, -diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index f60b4fdeeb8c..6b94f0bc11b8 100644 ---- a/net/netfilter/nf_conntrack_core.c -+++ b/net/netfilter/nf_conntrack_core.c -@@ -1780,6 +1780,7 @@ void nf_conntrack_init_end(void) - - int nf_conntrack_init_net(struct net *net) - { -+ static atomic64_t unique_id; - int ret = -ENOMEM; - int cpu; - -@@ -1802,7 +1803,8 @@ int nf_conntrack_init_net(struct net *net) - if (!net->ct.stat) - goto err_pcpu_lists; - -- net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net); -+ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%llu", -+ (u64)atomic64_inc_return(&unique_id)); - if (!net->ct.slabname) - goto err_slabname; - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index f1ffb34e253f..d2bc03f0b4d7 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -1305,7 +1305,7 @@ static int netlink_release(struct socket *sock) - - skb_queue_purge(&sk->sk_write_queue); - -- if (nlk->portid) { -+ if (nlk->portid && nlk->bound) { - struct netlink_notify n = { - .net = sock_net(sk), - .protocol = sk->sk_protocol, -diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c -index 2d59df521915..879185fe183f 100644 ---- a/net/openvswitch/actions.c -+++ b/net/openvswitch/actions.c -@@ -158,9 +158,7 @@ static int push_mpls(struct sk_buff *skb, struct sw_flow_key *key, - new_mpls_lse = (__be32 *)skb_mpls_header(skb); - *new_mpls_lse = mpls->mpls_lse; - -- if (skb->ip_summed == CHECKSUM_COMPLETE) -- skb->csum = csum_add(skb->csum, csum_partial(new_mpls_lse, -- MPLS_HLEN, 0)); -+ skb_postpush_rcsum(skb, new_mpls_lse, MPLS_HLEN); - - hdr = eth_hdr(skb); - hdr->h_proto = mpls->mpls_ethertype; -@@ -280,7 +278,7 @@ static int set_eth_addr(struct sk_buff *skb, struct sw_flow_key *flow_key, - ether_addr_copy_masked(eth_hdr(skb)->h_dest, key->eth_dst, - mask->eth_dst); - -- ovs_skb_postpush_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2); -+ skb_postpush_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2); - - ether_addr_copy(flow_key->eth.src, eth_hdr(skb)->h_source); - ether_addr_copy(flow_key->eth.dst, eth_hdr(skb)->h_dest); -@@ -463,7 +461,7 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key, - mask_ipv6_addr(saddr, key->ipv6_src, mask->ipv6_src, masked); - - if (unlikely(memcmp(saddr, masked, sizeof(masked)))) { -- set_ipv6_addr(skb, key->ipv6_proto, saddr, masked, -+ set_ipv6_addr(skb, flow_key->ip.proto, saddr, masked, - true); - memcpy(&flow_key->ipv6.addr.src, masked, - sizeof(flow_key->ipv6.addr.src)); -@@ -485,7 +483,7 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key, - NULL, &flags) - != NEXTHDR_ROUTING); - -- set_ipv6_addr(skb, key->ipv6_proto, daddr, masked, -+ set_ipv6_addr(skb, flow_key->ip.proto, daddr, masked, - recalc_csum); - memcpy(&flow_key->ipv6.addr.dst, masked, - sizeof(flow_key->ipv6.addr.dst)); -@@ -639,7 +637,7 @@ static int ovs_vport_output(struct net *net, struct sock *sk, struct sk_buff *sk - /* Reconstruct the MAC header. */ - skb_push(skb, data->l2_len); - memcpy(skb->data, &data->l2_data, data->l2_len); -- ovs_skb_postpush_rcsum(skb, skb->data, data->l2_len); -+ skb_postpush_rcsum(skb, skb->data, data->l2_len); - skb_reset_mac_header(skb); - - ovs_vport_send(vport, skb); -diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c -index ee6ff8ffc12d..9e5b9fc805fb 100644 ---- a/net/openvswitch/conntrack.c -+++ b/net/openvswitch/conntrack.c -@@ -320,6 +320,7 @@ static int handle_fragments(struct net *net, struct sw_flow_key *key, - } else if (key->eth.type == htons(ETH_P_IPV6)) { - enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone; - -+ skb_orphan(skb); - memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); - err = nf_ct_frag6_gather(net, skb, user); - if (err) -diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c -index 6a6adf314363..4e3972344aa6 100644 ---- a/net/openvswitch/vport-netdev.c -+++ b/net/openvswitch/vport-netdev.c -@@ -58,7 +58,7 @@ static void netdev_port_receive(struct sk_buff *skb) - return; - - skb_push(skb, ETH_HLEN); -- ovs_skb_postpush_rcsum(skb, skb->data, ETH_HLEN); -+ skb_postpush_rcsum(skb, skb->data, ETH_HLEN); - ovs_vport_receive(vport, skb, skb_tunnel_info(skb)); - return; - error: -diff --git a/net/openvswitch/vport.h b/net/openvswitch/vport.h -index c10899cb9040..f01f28a567ad 100644 ---- a/net/openvswitch/vport.h -+++ b/net/openvswitch/vport.h -@@ -185,13 +185,6 @@ static inline struct vport *vport_from_priv(void *priv) - int ovs_vport_receive(struct vport *, struct sk_buff *, - const struct ip_tunnel_info *); - --static inline void ovs_skb_postpush_rcsum(struct sk_buff *skb, -- const void *start, unsigned int len) --{ -- if (skb->ip_summed == CHECKSUM_COMPLETE) -- skb->csum = csum_add(skb->csum, csum_partial(start, len, 0)); --} +- memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, +- ses->auth_key.len - CIFS_SESS_KEY_SIZE); +- tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; - - static inline const char *ovs_vport_name(struct vport *vport) - { - return vport->dev->name; -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 992396aa635c..9cc7b512b472 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -1916,6 +1916,10 @@ retry: - goto retry; - } +- sec_blob->NtChallengeResponse.Length = +- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); +- sec_blob->NtChallengeResponse.MaximumLength = +- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); -+ if (!dev_validate_header(dev, skb->data, len)) { -+ err = -EINVAL; -+ goto out_unlock; -+ } - if (len > (dev->mtu + dev->hard_header_len + extra_len) && - !packet_extra_vlan_len_allowed(dev, skb)) { - err = -EMSGSIZE; -@@ -2326,18 +2330,6 @@ static void tpacket_destruct_skb(struct sk_buff *skb) - sock_wfree(skb); - } + if (ses->domainName == NULL) { + sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer); +@@ -670,20 +678,24 @@ sess_auth_lanman(struct sess_data *sess_data) --static bool ll_header_truncated(const struct net_device *dev, int len) --{ -- /* net device doesn't like empty head */ -- if (unlikely(len < dev->hard_header_len)) { -- net_warn_ratelimited("%s: packet size is too short (%d < %d)\n", -- current->comm, len, dev->hard_header_len); -- return true; -- } + pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE; + +- /* no capabilities flags in old lanman negotiation */ +- pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE); - -- return false; --} +- /* Calculate hash with password and copy into bcc_ptr. +- * Encryption Key (stored as in cryptkey) gets used if the +- * security mode bit in Negottiate Protocol response states +- * to use challenge/response method (i.e. Password bit is 1). +- */ +- rc = calc_lanman_hash(ses->password, ses->server->cryptkey, +- ses->server->sec_mode & SECMODE_PW_ENCRYPT ? +- true : false, lnm_session_key); - - static void tpacket_set_protocol(const struct net_device *dev, - struct sk_buff *skb) - { -@@ -2420,19 +2412,19 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, - if (unlikely(err < 0)) - return -EINVAL; - } else if (dev->hard_header_len) { -- if (ll_header_truncated(dev, tp_len)) -- return -EINVAL; -+ int hdrlen = min_t(int, dev->hard_header_len, tp_len); - - skb_push(skb, dev->hard_header_len); -- err = skb_store_bits(skb, 0, data, -- dev->hard_header_len); -+ err = skb_store_bits(skb, 0, data, hdrlen); - if (unlikely(err)) - return err; -+ if (!dev_validate_header(dev, skb->data, hdrlen)) -+ return -EINVAL; - if (!skb->protocol) - tpacket_set_protocol(dev, skb); - -- data += dev->hard_header_len; -- to_write -= dev->hard_header_len; -+ data += hdrlen; -+ to_write -= hdrlen; - } - - offset = offset_in_page(data); -@@ -2763,9 +2755,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - offset = dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len); - if (unlikely(offset < 0)) - goto out_free; -- } else { -- if (ll_header_truncated(dev, len)) -- goto out_free; - } - - /* Returns -EFAULT on error */ -@@ -2773,6 +2762,12 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - if (err) - goto out_free; - -+ if (sock->type == SOCK_RAW && -+ !dev_validate_header(dev, skb->data, len)) { -+ err = -EINVAL; -+ goto out_free; -+ } +- memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE); +- bcc_ptr += CIFS_AUTH_RESP_SIZE; ++ if (ses->user_name != NULL) { ++ /* no capabilities flags in old lanman negotiation */ ++ pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE); + - sock_tx_timestamp(sk, &skb_shinfo(skb)->tx_flags); - - if (!gso_type && (len > dev->mtu + reserve + extra_len) && -@@ -3441,6 +3436,7 @@ static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq) - i->ifindex = mreq->mr_ifindex; - i->alen = mreq->mr_alen; - memcpy(i->addr, mreq->mr_address, i->alen); -+ memset(i->addr + i->alen, 0, sizeof(i->addr) - i->alen); - i->count = 1; - i->next = po->mclist; - po->mclist = i; -diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c -index af1acf009866..95b560f0b253 100644 ---- a/net/sched/sch_api.c -+++ b/net/sched/sch_api.c -@@ -744,14 +744,15 @@ static u32 qdisc_alloc_handle(struct net_device *dev) - return 0; - } - --void qdisc_tree_decrease_qlen(struct Qdisc *sch, unsigned int n) -+void qdisc_tree_reduce_backlog(struct Qdisc *sch, unsigned int n, -+ unsigned int len) - { - const struct Qdisc_class_ops *cops; - unsigned long cl; - u32 parentid; - int drops; - -- if (n == 0) -+ if (n == 0 && len == 0) - return; - drops = max_t(int, n, 0); - rcu_read_lock(); -@@ -774,11 +775,12 @@ void qdisc_tree_decrease_qlen(struct Qdisc *sch, unsigned int n) - cops->put(sch, cl); - } - sch->q.qlen -= n; -+ sch->qstats.backlog -= len; - __qdisc_qstats_drop(sch, drops); - } - rcu_read_unlock(); - } --EXPORT_SYMBOL(qdisc_tree_decrease_qlen); -+EXPORT_SYMBOL(qdisc_tree_reduce_backlog); - - static void notify_and_destroy(struct net *net, struct sk_buff *skb, - struct nlmsghdr *n, u32 clid, -diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c -index c538d9e4a8f6..baafddf229ce 100644 ---- a/net/sched/sch_cbq.c -+++ b/net/sched/sch_cbq.c -@@ -1624,13 +1624,8 @@ static int cbq_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, - new->reshape_fail = cbq_reshape_fail; - #endif - } -- sch_tree_lock(sch); -- *old = cl->q; -- cl->q = new; -- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen); -- qdisc_reset(*old); -- sch_tree_unlock(sch); - -+ *old = qdisc_replace(sch, new, &cl->q); - return 0; - } - -@@ -1914,7 +1909,7 @@ static int cbq_delete(struct Qdisc *sch, unsigned long arg) - { - struct cbq_sched_data *q = qdisc_priv(sch); - struct cbq_class *cl = (struct cbq_class *)arg; -- unsigned int qlen; -+ unsigned int qlen, backlog; - - if (cl->filters || cl->children || cl == &q->link) - return -EBUSY; -@@ -1922,8 +1917,9 @@ static int cbq_delete(struct Qdisc *sch, unsigned long arg) - sch_tree_lock(sch); - - qlen = cl->q->q.qlen; -+ backlog = cl->q->qstats.backlog; - qdisc_reset(cl->q); -- qdisc_tree_decrease_qlen(cl->q, qlen); -+ qdisc_tree_reduce_backlog(cl->q, qlen, backlog); - - if (cl->next_alive) - cbq_deactivate_class(cl); -diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c -index 5ffb8b8337c7..0a08c860eee4 100644 ---- a/net/sched/sch_choke.c -+++ b/net/sched/sch_choke.c -@@ -128,8 +128,8 @@ static void choke_drop_by_idx(struct Qdisc *sch, unsigned int idx) - choke_zap_tail_holes(q); - - qdisc_qstats_backlog_dec(sch, skb); -+ qdisc_tree_reduce_backlog(sch, 1, qdisc_pkt_len(skb)); - qdisc_drop(skb, sch); -- qdisc_tree_decrease_qlen(sch, 1); - --sch->q.qlen; - } - -@@ -456,6 +456,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt) - old = q->tab; - if (old) { - unsigned int oqlen = sch->q.qlen, tail = 0; -+ unsigned dropped = 0; - - while (q->head != q->tail) { - struct sk_buff *skb = q->tab[q->head]; -@@ -467,11 +468,12 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt) - ntab[tail++] = skb; - continue; - } -+ dropped += qdisc_pkt_len(skb); - qdisc_qstats_backlog_dec(sch, skb); - --sch->q.qlen; - qdisc_drop(skb, sch); - } -- qdisc_tree_decrease_qlen(sch, oqlen - sch->q.qlen); -+ qdisc_tree_reduce_backlog(sch, oqlen - sch->q.qlen, dropped); - q->head = 0; - q->tail = tail; - } -diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c -index 535007d5f0b5..9b7e2980ee5c 100644 ---- a/net/sched/sch_codel.c -+++ b/net/sched/sch_codel.c -@@ -79,12 +79,13 @@ static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch) - - skb = codel_dequeue(sch, &q->params, &q->vars, &q->stats, dequeue); - -- /* We cant call qdisc_tree_decrease_qlen() if our qlen is 0, -+ /* We cant call qdisc_tree_reduce_backlog() if our qlen is 0, - * or HTB crashes. Defer it for next round. - */ - if (q->stats.drop_count && sch->q.qlen) { -- qdisc_tree_decrease_qlen(sch, q->stats.drop_count); -+ qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len); - q->stats.drop_count = 0; -+ q->stats.drop_len = 0; - } - if (skb) - qdisc_bstats_update(sch, skb); -@@ -116,7 +117,7 @@ static int codel_change(struct Qdisc *sch, struct nlattr *opt) - { - struct codel_sched_data *q = qdisc_priv(sch); - struct nlattr *tb[TCA_CODEL_MAX + 1]; -- unsigned int qlen; -+ unsigned int qlen, dropped = 0; - int err; - - if (!opt) -@@ -156,10 +157,11 @@ static int codel_change(struct Qdisc *sch, struct nlattr *opt) - while (sch->q.qlen > sch->limit) { - struct sk_buff *skb = __skb_dequeue(&sch->q); - -+ dropped += qdisc_pkt_len(skb); - qdisc_qstats_backlog_dec(sch, skb); - qdisc_drop(skb, sch); - } -- qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen); -+ qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, dropped); - - sch_tree_unlock(sch); - return 0; -diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c -index a1cd778240cd..a63e879e8975 100644 ---- a/net/sched/sch_drr.c -+++ b/net/sched/sch_drr.c -@@ -53,9 +53,10 @@ static struct drr_class *drr_find_class(struct Qdisc *sch, u32 classid) - static void drr_purge_queue(struct drr_class *cl) - { - unsigned int len = cl->qdisc->q.qlen; -+ unsigned int backlog = cl->qdisc->qstats.backlog; - - qdisc_reset(cl->qdisc); -- qdisc_tree_decrease_qlen(cl->qdisc, len); -+ qdisc_tree_reduce_backlog(cl->qdisc, len, backlog); - } - - static const struct nla_policy drr_policy[TCA_DRR_MAX + 1] = { -@@ -226,11 +227,7 @@ static int drr_graft_class(struct Qdisc *sch, unsigned long arg, - new = &noop_qdisc; - } - -- sch_tree_lock(sch); -- drr_purge_queue(cl); -- *old = cl->qdisc; -- cl->qdisc = new; -- sch_tree_unlock(sch); -+ *old = qdisc_replace(sch, new, &cl->qdisc); - return 0; - } - -diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c -index f357f34d02d2..d0dff0cd8186 100644 ---- a/net/sched/sch_dsmark.c -+++ b/net/sched/sch_dsmark.c -@@ -73,13 +73,7 @@ static int dsmark_graft(struct Qdisc *sch, unsigned long arg, - new = &noop_qdisc; - } - -- sch_tree_lock(sch); -- *old = p->q; -- p->q = new; -- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen); -- qdisc_reset(*old); -- sch_tree_unlock(sch); -- -+ *old = qdisc_replace(sch, new, &p->q); - return 0; - } - -@@ -264,6 +258,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch) - return err; - } - -+ qdisc_qstats_backlog_inc(sch, skb); - sch->q.qlen++; - - return NET_XMIT_SUCCESS; -@@ -286,6 +281,7 @@ static struct sk_buff *dsmark_dequeue(struct Qdisc *sch) - return NULL; - - qdisc_bstats_update(sch, skb); -+ qdisc_qstats_backlog_dec(sch, skb); - sch->q.qlen--; - - index = skb->tc_index & (p->indices - 1); -@@ -401,6 +397,7 @@ static void dsmark_reset(struct Qdisc *sch) - - pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p); - qdisc_reset(p->q); -+ sch->qstats.backlog = 0; - sch->q.qlen = 0; - } - -diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c -index 109b2322778f..3c6a47d66a04 100644 ---- a/net/sched/sch_fq.c -+++ b/net/sched/sch_fq.c -@@ -662,6 +662,7 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt) - struct fq_sched_data *q = qdisc_priv(sch); - struct nlattr *tb[TCA_FQ_MAX + 1]; - int err, drop_count = 0; -+ unsigned drop_len = 0; - u32 fq_log; - - if (!opt) -@@ -736,10 +737,11 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt) - - if (!skb) - break; -+ drop_len += qdisc_pkt_len(skb); - kfree_skb(skb); - drop_count++; - } -- qdisc_tree_decrease_qlen(sch, drop_count); -+ qdisc_tree_reduce_backlog(sch, drop_count, drop_len); ++ /* Calculate hash with password and copy into bcc_ptr. ++ * Encryption Key (stored as in cryptkey) gets used if the ++ * security mode bit in Negottiate Protocol response states ++ * to use challenge/response method (i.e. Password bit is 1). ++ */ ++ rc = calc_lanman_hash(ses->password, ses->server->cryptkey, ++ ses->server->sec_mode & SECMODE_PW_ENCRYPT ? ++ true : false, lnm_session_key); ++ ++ memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE); ++ bcc_ptr += CIFS_AUTH_RESP_SIZE; ++ } else { ++ pSMB->old_req.PasswordLength = 0; ++ } - sch_tree_unlock(sch); - return err; -diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c -index 4c834e93dafb..d3fc8f9dd3d4 100644 ---- a/net/sched/sch_fq_codel.c -+++ b/net/sched/sch_fq_codel.c -@@ -175,7 +175,7 @@ static unsigned int fq_codel_qdisc_drop(struct Qdisc *sch) - static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch) - { - struct fq_codel_sched_data *q = qdisc_priv(sch); -- unsigned int idx; -+ unsigned int idx, prev_backlog; - struct fq_codel_flow *flow; - int uninitialized_var(ret); - -@@ -203,6 +203,7 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch) - if (++sch->q.qlen <= sch->limit) - return NET_XMIT_SUCCESS; - -+ prev_backlog = sch->qstats.backlog; - q->drop_overlimit++; - /* Return Congestion Notification only if we dropped a packet - * from this flow. -@@ -211,7 +212,7 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch) - return NET_XMIT_CN; - - /* As we dropped a packet, better let upper stack know this */ -- qdisc_tree_decrease_qlen(sch, 1); -+ qdisc_tree_reduce_backlog(sch, 1, prev_backlog - sch->qstats.backlog); - return NET_XMIT_SUCCESS; - } + /* + * can not sign if LANMAN negotiated so no need +@@ -769,26 +781,31 @@ sess_auth_ntlm(struct sess_data *sess_data) + capabilities = cifs_ssetup_hdr(ses, pSMB); -@@ -241,6 +242,7 @@ static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch) - struct fq_codel_flow *flow; - struct list_head *head; - u32 prev_drop_count, prev_ecn_mark; -+ unsigned int prev_backlog; + pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities); +- pSMB->req_no_secext.CaseInsensitivePasswordLength = +- cpu_to_le16(CIFS_AUTH_RESP_SIZE); +- pSMB->req_no_secext.CaseSensitivePasswordLength = +- cpu_to_le16(CIFS_AUTH_RESP_SIZE); +- +- /* calculate ntlm response and session key */ +- rc = setup_ntlm_response(ses, sess_data->nls_cp); +- if (rc) { +- cifs_dbg(VFS, "Error %d during NTLM authentication\n", +- rc); +- goto out; +- } ++ if (ses->user_name != NULL) { ++ pSMB->req_no_secext.CaseInsensitivePasswordLength = ++ cpu_to_le16(CIFS_AUTH_RESP_SIZE); ++ pSMB->req_no_secext.CaseSensitivePasswordLength = ++ cpu_to_le16(CIFS_AUTH_RESP_SIZE); ++ ++ /* calculate ntlm response and session key */ ++ rc = setup_ntlm_response(ses, sess_data->nls_cp); ++ if (rc) { ++ cifs_dbg(VFS, "Error %d during NTLM authentication\n", ++ rc); ++ goto out; ++ } - begin: - head = &q->new_flows; -@@ -259,6 +261,7 @@ begin: +- /* copy ntlm response */ +- memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, +- CIFS_AUTH_RESP_SIZE); +- bcc_ptr += CIFS_AUTH_RESP_SIZE; +- memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, +- CIFS_AUTH_RESP_SIZE); +- bcc_ptr += CIFS_AUTH_RESP_SIZE; ++ /* copy ntlm response */ ++ memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, ++ CIFS_AUTH_RESP_SIZE); ++ bcc_ptr += CIFS_AUTH_RESP_SIZE; ++ memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, ++ CIFS_AUTH_RESP_SIZE); ++ bcc_ptr += CIFS_AUTH_RESP_SIZE; ++ } else { ++ pSMB->req_no_secext.CaseInsensitivePasswordLength = 0; ++ pSMB->req_no_secext.CaseSensitivePasswordLength = 0; ++ } - prev_drop_count = q->cstats.drop_count; - prev_ecn_mark = q->cstats.ecn_mark; -+ prev_backlog = sch->qstats.backlog; + if (ses->capabilities & CAP_UNICODE) { + /* unicode strings must be word aligned */ +@@ -878,22 +895,26 @@ sess_auth_ntlmv2(struct sess_data *sess_data) + /* LM2 password would be here if we supported it */ + pSMB->req_no_secext.CaseInsensitivePasswordLength = 0; - skb = codel_dequeue(sch, &q->cparams, &flow->cvars, &q->cstats, - dequeue); -@@ -276,12 +279,14 @@ begin: - } - qdisc_bstats_update(sch, skb); - flow->deficit -= qdisc_pkt_len(skb); -- /* We cant call qdisc_tree_decrease_qlen() if our qlen is 0, -+ /* We cant call qdisc_tree_reduce_backlog() if our qlen is 0, - * or HTB crashes. Defer it for next round. - */ - if (q->cstats.drop_count && sch->q.qlen) { -- qdisc_tree_decrease_qlen(sch, q->cstats.drop_count); -+ qdisc_tree_reduce_backlog(sch, q->cstats.drop_count, -+ q->cstats.drop_len); - q->cstats.drop_count = 0; -+ q->cstats.drop_len = 0; - } - return skb; - } -@@ -372,11 +377,13 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt) - while (sch->q.qlen > sch->limit) { - struct sk_buff *skb = fq_codel_dequeue(sch); +- /* calculate nlmv2 response and session key */ +- rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp); +- if (rc) { +- cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc); +- goto out; +- } ++ if (ses->user_name != NULL) { ++ /* calculate nlmv2 response and session key */ ++ rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp); ++ if (rc) { ++ cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc); ++ goto out; ++ } -+ q->cstats.drop_len += qdisc_pkt_len(skb); - kfree_skb(skb); - q->cstats.drop_count++; - } -- qdisc_tree_decrease_qlen(sch, q->cstats.drop_count); -+ qdisc_tree_reduce_backlog(sch, q->cstats.drop_count, q->cstats.drop_len); - q->cstats.drop_count = 0; -+ q->cstats.drop_len = 0; +- memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, +- ses->auth_key.len - CIFS_SESS_KEY_SIZE); +- bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE; ++ memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, ++ ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE; - sch_tree_unlock(sch); - return 0; -diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c -index 16bc83b2842a..aa4725038f94 100644 ---- a/net/sched/sch_generic.c -+++ b/net/sched/sch_generic.c -@@ -159,12 +159,15 @@ int sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q, - if (validate) - skb = validate_xmit_skb_list(skb, dev); - -- if (skb) { -+ if (likely(skb)) { - HARD_TX_LOCK(dev, txq, smp_processor_id()); - if (!netif_xmit_frozen_or_stopped(txq)) - skb = dev_hard_start_xmit(skb, dev, txq, &ret); - - HARD_TX_UNLOCK(dev, txq); +- /* set case sensitive password length after tilen may get +- * assigned, tilen is 0 otherwise. +- */ +- pSMB->req_no_secext.CaseSensitivePasswordLength = +- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ /* set case sensitive password length after tilen may get ++ * assigned, tilen is 0 otherwise. ++ */ ++ pSMB->req_no_secext.CaseSensitivePasswordLength = ++ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); + } else { -+ spin_lock(root_lock); -+ return qdisc_qlen(q); - } - spin_lock(root_lock); - -diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c -index b7ebe2c87586..d783d7cc3348 100644 ---- a/net/sched/sch_hfsc.c -+++ b/net/sched/sch_hfsc.c -@@ -895,9 +895,10 @@ static void - hfsc_purge_queue(struct Qdisc *sch, struct hfsc_class *cl) - { - unsigned int len = cl->qdisc->q.qlen; -+ unsigned int backlog = cl->qdisc->qstats.backlog; - - qdisc_reset(cl->qdisc); -- qdisc_tree_decrease_qlen(cl->qdisc, len); -+ qdisc_tree_reduce_backlog(cl->qdisc, len, backlog); - } ++ pSMB->req_no_secext.CaseSensitivePasswordLength = 0; ++ } - static void -@@ -1215,11 +1216,7 @@ hfsc_graft_class(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, - new = &noop_qdisc; - } + if (ses->capabilities & CAP_UNICODE) { + if (sess_data->iov[0].iov_len % 2) { +diff --git a/fs/cifs/smb2glob.h b/fs/cifs/smb2glob.h +index bc0bb9c34f72..0ffa18094335 100644 +--- a/fs/cifs/smb2glob.h ++++ b/fs/cifs/smb2glob.h +@@ -44,6 +44,7 @@ + #define SMB2_OP_DELETE 7 + #define SMB2_OP_HARDLINK 8 + #define SMB2_OP_SET_EOF 9 ++#define SMB2_OP_RMDIR 10 -- sch_tree_lock(sch); -- hfsc_purge_queue(sch, cl); -- *old = cl->qdisc; -- cl->qdisc = new; -- sch_tree_unlock(sch); -+ *old = qdisc_replace(sch, new, &cl->qdisc); - return 0; + /* Used when constructing chained read requests. */ + #define CHAINED_REQUEST 1 +diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c +index 899bbc86f73e..4f0231e685a9 100644 +--- a/fs/cifs/smb2inode.c ++++ b/fs/cifs/smb2inode.c +@@ -80,6 +80,10 @@ smb2_open_op_close(const unsigned int xid, struct cifs_tcon *tcon, + * SMB2_open() call. + */ + break; ++ case SMB2_OP_RMDIR: ++ tmprc = SMB2_rmdir(xid, tcon, fid.persistent_fid, ++ fid.volatile_fid); ++ break; + case SMB2_OP_RENAME: + tmprc = SMB2_rename(xid, tcon, fid.persistent_fid, + fid.volatile_fid, (__le16 *)data); +@@ -191,8 +195,8 @@ smb2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, const char *name, + struct cifs_sb_info *cifs_sb) + { + return smb2_open_op_close(xid, tcon, cifs_sb, name, DELETE, FILE_OPEN, +- CREATE_NOT_FILE | CREATE_DELETE_ON_CLOSE, +- NULL, SMB2_OP_DELETE); ++ CREATE_NOT_FILE, ++ NULL, SMB2_OP_RMDIR); } -diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c -index 86b04e31e60b..13d6f83ec491 100644 ---- a/net/sched/sch_hhf.c -+++ b/net/sched/sch_hhf.c -@@ -382,6 +382,7 @@ static int hhf_enqueue(struct sk_buff *skb, struct Qdisc *sch) - struct hhf_sched_data *q = qdisc_priv(sch); - enum wdrr_bucket_idx idx; - struct wdrr_bucket *bucket; -+ unsigned int prev_backlog; - - idx = hhf_classify(skb, sch); - -@@ -409,6 +410,7 @@ static int hhf_enqueue(struct sk_buff *skb, struct Qdisc *sch) - if (++sch->q.qlen <= sch->limit) - return NET_XMIT_SUCCESS; - -+ prev_backlog = sch->qstats.backlog; - q->drop_overlimit++; - /* Return Congestion Notification only if we dropped a packet from this - * bucket. -@@ -417,7 +419,7 @@ static int hhf_enqueue(struct sk_buff *skb, struct Qdisc *sch) - return NET_XMIT_CN; - - /* As we dropped a packet, better let upper stack know this. */ -- qdisc_tree_decrease_qlen(sch, 1); -+ qdisc_tree_reduce_backlog(sch, 1, prev_backlog - sch->qstats.backlog); - return NET_XMIT_SUCCESS; + int +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 42e1f440eb1e..8f38e33d365b 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2575,6 +2575,22 @@ SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon, } -@@ -527,7 +529,7 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt) + int ++SMB2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, ++ u64 persistent_fid, u64 volatile_fid) ++{ ++ __u8 delete_pending = 1; ++ void *data; ++ unsigned int size; ++ ++ data = &delete_pending; ++ size = 1; /* sizeof __u8 */ ++ ++ return send_set_info(xid, tcon, persistent_fid, volatile_fid, ++ current->tgid, FILE_DISPOSITION_INFORMATION, 1, &data, ++ &size); ++} ++ ++int + SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon, + u64 persistent_fid, u64 volatile_fid, __le16 *target_file) { - struct hhf_sched_data *q = qdisc_priv(sch); - struct nlattr *tb[TCA_HHF_MAX + 1]; -- unsigned int qlen; -+ unsigned int qlen, prev_backlog; - int err; - u64 non_hh_quantum; - u32 new_quantum = q->quantum; -@@ -577,12 +579,14 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt) - } +diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h +index 4f07dc93608d..eb2cde2f64ba 100644 +--- a/fs/cifs/smb2proto.h ++++ b/fs/cifs/smb2proto.h +@@ -141,6 +141,8 @@ extern int SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, + extern int SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon, + u64 persistent_fid, u64 volatile_fid, + __le16 *target_file); ++extern int SMB2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, ++ u64 persistent_fid, u64 volatile_fid); + extern int SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon, + u64 persistent_fid, u64 volatile_fid, + __le16 *target_file); +diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c +index 458cf463047b..82067ca22f2b 100644 +--- a/fs/hpfs/super.c ++++ b/fs/hpfs/super.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include - qlen = sch->q.qlen; -+ prev_backlog = sch->qstats.backlog; - while (sch->q.qlen > sch->limit) { - struct sk_buff *skb = hhf_dequeue(sch); + /* Mark the filesystem dirty, so that chkdsk checks it when os/2 booted */ - kfree_skb(skb); - } -- qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen); -+ qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, -+ prev_backlog - sch->qstats.backlog); +@@ -453,10 +454,6 @@ static int hpfs_remount_fs(struct super_block *s, int *flags, char *data) + int lowercase, eas, chk, errs, chkdsk, timeshift; + int o; + struct hpfs_sb_info *sbi = hpfs_sb(s); +- char *new_opts = kstrdup(data, GFP_KERNEL); +- +- if (!new_opts) +- return -ENOMEM; - sch_tree_unlock(sch); - return 0; -diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c -index 15ccd7f8fb2a..87b02ed3d5f2 100644 ---- a/net/sched/sch_htb.c -+++ b/net/sched/sch_htb.c -@@ -600,6 +600,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch) - htb_activate(q, cl); - } + sync_filesystem(s); -+ qdisc_qstats_backlog_inc(sch, skb); - sch->q.qlen++; - return NET_XMIT_SUCCESS; - } -@@ -889,6 +890,7 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch) - ok: - qdisc_bstats_update(sch, skb); - qdisc_unthrottled(sch); -+ qdisc_qstats_backlog_dec(sch, skb); - sch->q.qlen--; - return skb; - } -@@ -955,6 +957,7 @@ static unsigned int htb_drop(struct Qdisc *sch) - unsigned int len; - if (cl->un.leaf.q->ops->drop && - (len = cl->un.leaf.q->ops->drop(cl->un.leaf.q))) { -+ sch->qstats.backlog -= len; - sch->q.qlen--; - if (!cl->un.leaf.q->q.qlen) - htb_deactivate(q, cl); -@@ -984,12 +987,12 @@ static void htb_reset(struct Qdisc *sch) - } - cl->prio_activity = 0; - cl->cmode = HTB_CAN_SEND; -- - } - } - qdisc_watchdog_cancel(&q->watchdog); - __skb_queue_purge(&q->direct_queue); - sch->q.qlen = 0; -+ sch->qstats.backlog = 0; - memset(q->hlevel, 0, sizeof(q->hlevel)); - memset(q->row_mask, 0, sizeof(q->row_mask)); - for (i = 0; i < TC_HTB_NUMPRIO; i++) -@@ -1163,14 +1166,7 @@ static int htb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, - cl->common.classid)) == NULL) - return -ENOBUFS; - -- sch_tree_lock(sch); -- *old = cl->un.leaf.q; -- cl->un.leaf.q = new; -- if (*old != NULL) { -- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen); -- qdisc_reset(*old); -- } -- sch_tree_unlock(sch); -+ *old = qdisc_replace(sch, new, &cl->un.leaf.q); - return 0; - } +@@ -493,17 +490,44 @@ static int hpfs_remount_fs(struct super_block *s, int *flags, char *data) -@@ -1272,7 +1268,6 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg) - { - struct htb_sched *q = qdisc_priv(sch); - struct htb_class *cl = (struct htb_class *)arg; -- unsigned int qlen; - struct Qdisc *new_q = NULL; - int last_child = 0; - -@@ -1292,9 +1287,11 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg) - sch_tree_lock(sch); - - if (!cl->level) { -- qlen = cl->un.leaf.q->q.qlen; -+ unsigned int qlen = cl->un.leaf.q->q.qlen; -+ unsigned int backlog = cl->un.leaf.q->qstats.backlog; -+ - qdisc_reset(cl->un.leaf.q); -- qdisc_tree_decrease_qlen(cl->un.leaf.q, qlen); -+ qdisc_tree_reduce_backlog(cl->un.leaf.q, qlen, backlog); - } + if (!(*flags & MS_RDONLY)) mark_dirty(s, 1); - /* delete from hash and active; remainder in destroy_class */ -@@ -1428,10 +1425,11 @@ static int htb_change_class(struct Qdisc *sch, u32 classid, - sch_tree_lock(sch); - if (parent && !parent->level) { - unsigned int qlen = parent->un.leaf.q->q.qlen; -+ unsigned int backlog = parent->un.leaf.q->qstats.backlog; - - /* turn parent into inner node */ - qdisc_reset(parent->un.leaf.q); -- qdisc_tree_decrease_qlen(parent->un.leaf.q, qlen); -+ qdisc_tree_reduce_backlog(parent->un.leaf.q, qlen, backlog); - qdisc_destroy(parent->un.leaf.q); - if (parent->prio_activity) - htb_deactivate(q, parent); -diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c -index 4e904ca0af9d..bcdd54bb101c 100644 ---- a/net/sched/sch_multiq.c -+++ b/net/sched/sch_multiq.c -@@ -218,7 +218,8 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt) - if (q->queues[i] != &noop_qdisc) { - struct Qdisc *child = q->queues[i]; - q->queues[i] = &noop_qdisc; -- qdisc_tree_decrease_qlen(child, child->q.qlen); -+ qdisc_tree_reduce_backlog(child, child->q.qlen, -+ child->qstats.backlog); - qdisc_destroy(child); - } - } -@@ -238,8 +239,9 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt) - q->queues[i] = child; - - if (old != &noop_qdisc) { -- qdisc_tree_decrease_qlen(old, -- old->q.qlen); -+ qdisc_tree_reduce_backlog(old, -+ old->q.qlen, -+ old->qstats.backlog); - qdisc_destroy(old); - } - sch_tree_unlock(sch); -@@ -303,13 +305,7 @@ static int multiq_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, - if (new == NULL) - new = &noop_qdisc; - -- sch_tree_lock(sch); -- *old = q->queues[band]; -- q->queues[band] = new; -- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen); -- qdisc_reset(*old); -- sch_tree_unlock(sch); +- replace_mount_options(s, new_opts); - -+ *old = qdisc_replace(sch, new, &q->queues[band]); + hpfs_unlock(s); return 0; - } -diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c -index 5abd1d9de989..4befe97a9034 100644 ---- a/net/sched/sch_netem.c -+++ b/net/sched/sch_netem.c -@@ -395,6 +395,25 @@ static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch) - sch->q.qlen++; + out_err: + hpfs_unlock(s); +- kfree(new_opts); + return -EINVAL; } -+/* netem can't properly corrupt a megapacket (like we get from GSO), so instead -+ * when we statistically choose to corrupt one, we instead segment it, returning -+ * the first packet to be corrupted, and re-enqueue the remaining frames -+ */ -+static struct sk_buff *netem_segment(struct sk_buff *skb, struct Qdisc *sch) ++static int hpfs_show_options(struct seq_file *seq, struct dentry *root) +{ -+ struct sk_buff *segs; -+ netdev_features_t features = netif_skb_features(skb); -+ -+ segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK); -+ -+ if (IS_ERR_OR_NULL(segs)) { -+ qdisc_reshape_fail(skb, sch); -+ return NULL; -+ } -+ consume_skb(skb); -+ return segs; -+} -+ - /* - * Insert one skb into qdisc. - * Note: parent depends on return value to account for queue length. -@@ -407,7 +426,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch) - /* We don't fill cb now as skb_unshare() may invalidate it */ - struct netem_skb_cb *cb; - struct sk_buff *skb2; -+ struct sk_buff *segs = NULL; -+ unsigned int len = 0, last_len, prev_len = qdisc_pkt_len(skb); -+ int nb = 0; - int count = 1; -+ int rc = NET_XMIT_SUCCESS; - - /* Random duplication */ - if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor)) -@@ -453,10 +476,23 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch) - * do it now in software before we mangle it. - */ - if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) { -+ if (skb_is_gso(skb)) { -+ segs = netem_segment(skb, sch); -+ if (!segs) -+ return NET_XMIT_DROP; -+ } else { -+ segs = skb; -+ } -+ -+ skb = segs; -+ segs = segs->next; ++ struct hpfs_sb_info *sbi = hpfs_sb(root->d_sb); + - if (!(skb = skb_unshare(skb, GFP_ATOMIC)) || - (skb->ip_summed == CHECKSUM_PARTIAL && -- skb_checksum_help(skb))) -- return qdisc_drop(skb, sch); -+ skb_checksum_help(skb))) { -+ rc = qdisc_drop(skb, sch); -+ goto finish_segs; -+ } - - skb->data[prandom_u32() % skb_headlen(skb)] ^= - 1<<(prandom_u32() % 8); -@@ -516,6 +552,27 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch) - sch->qstats.requeues++; - } - -+finish_segs: -+ if (segs) { -+ while (segs) { -+ skb2 = segs->next; -+ segs->next = NULL; -+ qdisc_skb_cb(segs)->pkt_len = segs->len; -+ last_len = segs->len; -+ rc = qdisc_enqueue(segs, sch); -+ if (rc != NET_XMIT_SUCCESS) { -+ if (net_xmit_drop_count(rc)) -+ qdisc_qstats_drop(sch); -+ } else { -+ nb++; -+ len += last_len; -+ } -+ segs = skb2; -+ } -+ sch->q.qlen += nb; -+ if (nb > 1) -+ qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len); -+ } - return NET_XMIT_SUCCESS; - } - -@@ -598,7 +655,8 @@ deliver: - if (unlikely(err != NET_XMIT_SUCCESS)) { - if (net_xmit_drop_count(err)) { - qdisc_qstats_drop(sch); -- qdisc_tree_decrease_qlen(sch, 1); -+ qdisc_tree_reduce_backlog(sch, 1, -+ qdisc_pkt_len(skb)); - } - } - goto tfifo_dequeue; -@@ -1037,15 +1095,7 @@ static int netem_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, - { - struct netem_sched_data *q = qdisc_priv(sch); - -- sch_tree_lock(sch); -- *old = q->qdisc; -- q->qdisc = new; -- if (*old) { -- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen); -- qdisc_reset(*old); -- } -- sch_tree_unlock(sch); -- -+ *old = qdisc_replace(sch, new, &q->qdisc); - return 0; - } ++ seq_printf(seq, ",uid=%u", from_kuid_munged(&init_user_ns, sbi->sb_uid)); ++ seq_printf(seq, ",gid=%u", from_kgid_munged(&init_user_ns, sbi->sb_gid)); ++ seq_printf(seq, ",umask=%03o", (~sbi->sb_mode & 0777)); ++ if (sbi->sb_lowercase) ++ seq_printf(seq, ",case=lower"); ++ if (!sbi->sb_chk) ++ seq_printf(seq, ",check=none"); ++ if (sbi->sb_chk == 2) ++ seq_printf(seq, ",check=strict"); ++ if (!sbi->sb_err) ++ seq_printf(seq, ",errors=continue"); ++ if (sbi->sb_err == 2) ++ seq_printf(seq, ",errors=panic"); ++ if (!sbi->sb_chkdsk) ++ seq_printf(seq, ",chkdsk=no"); ++ if (sbi->sb_chkdsk == 2) ++ seq_printf(seq, ",chkdsk=always"); ++ if (!sbi->sb_eas) ++ seq_printf(seq, ",eas=no"); ++ if (sbi->sb_eas == 1) ++ seq_printf(seq, ",eas=ro"); ++ if (sbi->sb_timeshift) ++ seq_printf(seq, ",timeshift=%d", sbi->sb_timeshift); ++ return 0; ++} ++ + /* Super operations */ -diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c -index b783a446d884..71ae3b9629f9 100644 ---- a/net/sched/sch_pie.c -+++ b/net/sched/sch_pie.c -@@ -183,7 +183,7 @@ static int pie_change(struct Qdisc *sch, struct nlattr *opt) - { - struct pie_sched_data *q = qdisc_priv(sch); - struct nlattr *tb[TCA_PIE_MAX + 1]; -- unsigned int qlen; -+ unsigned int qlen, dropped = 0; - int err; + static const struct super_operations hpfs_sops = +@@ -514,7 +538,7 @@ static const struct super_operations hpfs_sops = + .put_super = hpfs_put_super, + .statfs = hpfs_statfs, + .remount_fs = hpfs_remount_fs, +- .show_options = generic_show_options, ++ .show_options = hpfs_show_options, + }; - if (!opt) -@@ -232,10 +232,11 @@ static int pie_change(struct Qdisc *sch, struct nlattr *opt) - while (sch->q.qlen > sch->limit) { - struct sk_buff *skb = __skb_dequeue(&sch->q); + static int hpfs_fill_super(struct super_block *s, void *options, int silent) +@@ -537,8 +561,6 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent) -+ dropped += qdisc_pkt_len(skb); - qdisc_qstats_backlog_dec(sch, skb); - qdisc_drop(skb, sch); - } -- qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen); -+ qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, dropped); + int o; - sch_tree_unlock(sch); - return 0; -diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c -index ba6487f2741f..fee1b15506b2 100644 ---- a/net/sched/sch_prio.c -+++ b/net/sched/sch_prio.c -@@ -191,7 +191,7 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt) - struct Qdisc *child = q->queues[i]; - q->queues[i] = &noop_qdisc; - if (child != &noop_qdisc) { -- qdisc_tree_decrease_qlen(child, child->q.qlen); -+ qdisc_tree_reduce_backlog(child, child->q.qlen, child->qstats.backlog); - qdisc_destroy(child); - } - } -@@ -210,8 +210,9 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt) - q->queues[i] = child; - - if (old != &noop_qdisc) { -- qdisc_tree_decrease_qlen(old, -- old->q.qlen); -+ qdisc_tree_reduce_backlog(old, -+ old->q.qlen, -+ old->qstats.backlog); - qdisc_destroy(old); - } - sch_tree_unlock(sch); -@@ -268,13 +269,7 @@ static int prio_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, - if (new == NULL) - new = &noop_qdisc; - -- sch_tree_lock(sch); -- *old = q->queues[band]; -- q->queues[band] = new; -- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen); -- qdisc_reset(*old); -- sch_tree_unlock(sch); +- save_mount_options(s, options); - -+ *old = qdisc_replace(sch, new, &q->queues[band]); - return 0; - } - -diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c -index 3dc3a6e56052..8d2d8d953432 100644 ---- a/net/sched/sch_qfq.c -+++ b/net/sched/sch_qfq.c -@@ -220,9 +220,10 @@ static struct qfq_class *qfq_find_class(struct Qdisc *sch, u32 classid) - static void qfq_purge_queue(struct qfq_class *cl) + sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); + if (!sbi) { + return -ENOMEM; +diff --git a/include/asm-generic/qspinlock.h b/include/asm-generic/qspinlock.h +index 39e1cb201b8e..332da3ad8eb5 100644 +--- a/include/asm-generic/qspinlock.h ++++ b/include/asm-generic/qspinlock.h +@@ -28,7 +28,30 @@ + */ + static __always_inline int queued_spin_is_locked(struct qspinlock *lock) { - unsigned int len = cl->qdisc->q.qlen; -+ unsigned int backlog = cl->qdisc->qstats.backlog; - - qdisc_reset(cl->qdisc); -- qdisc_tree_decrease_qlen(cl->qdisc, len); -+ qdisc_tree_reduce_backlog(cl->qdisc, len, backlog); - } - - static const struct nla_policy qfq_policy[TCA_QFQ_MAX + 1] = { -@@ -617,11 +618,7 @@ static int qfq_graft_class(struct Qdisc *sch, unsigned long arg, - new = &noop_qdisc; - } - -- sch_tree_lock(sch); -- qfq_purge_queue(cl); -- *old = cl->qdisc; -- cl->qdisc = new; -- sch_tree_unlock(sch); -+ *old = qdisc_replace(sch, new, &cl->qdisc); - return 0; - } - -diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c -index 6c0534cc7758..8c0508c0e287 100644 ---- a/net/sched/sch_red.c -+++ b/net/sched/sch_red.c -@@ -210,7 +210,8 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt) - q->flags = ctl->flags; - q->limit = ctl->limit; - if (child) { -- qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen); -+ qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen, -+ q->qdisc->qstats.backlog); - qdisc_destroy(q->qdisc); - q->qdisc = child; - } -@@ -313,12 +314,7 @@ static int red_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, - if (new == NULL) - new = &noop_qdisc; - -- sch_tree_lock(sch); -- *old = q->qdisc; -- q->qdisc = new; -- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen); -- qdisc_reset(*old); -- sch_tree_unlock(sch); -+ *old = qdisc_replace(sch, new, &q->qdisc); - return 0; - } - -diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c -index 5bbb6332ec57..c69611640fa5 100644 ---- a/net/sched/sch_sfb.c -+++ b/net/sched/sch_sfb.c -@@ -510,7 +510,8 @@ static int sfb_change(struct Qdisc *sch, struct nlattr *opt) - - sch_tree_lock(sch); - -- qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen); -+ qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen, -+ q->qdisc->qstats.backlog); - qdisc_destroy(q->qdisc); - q->qdisc = child; - -@@ -606,12 +607,7 @@ static int sfb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, - if (new == NULL) - new = &noop_qdisc; - -- sch_tree_lock(sch); -- *old = q->qdisc; -- q->qdisc = new; -- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen); -- qdisc_reset(*old); -- sch_tree_unlock(sch); -+ *old = qdisc_replace(sch, new, &q->qdisc); - return 0; +- return atomic_read(&lock->val); ++ /* ++ * queued_spin_lock_slowpath() can ACQUIRE the lock before ++ * issuing the unordered store that sets _Q_LOCKED_VAL. ++ * ++ * See both smp_cond_acquire() sites for more detail. ++ * ++ * This however means that in code like: ++ * ++ * spin_lock(A) spin_lock(B) ++ * spin_unlock_wait(B) spin_is_locked(A) ++ * do_something() do_something() ++ * ++ * Both CPUs can end up running do_something() because the store ++ * setting _Q_LOCKED_VAL will pass through the loads in ++ * spin_unlock_wait() and/or spin_is_locked(). ++ * ++ * Avoid this by issuing a full memory barrier between the spin_lock() ++ * and the loads in spin_unlock_wait() and spin_is_locked(). ++ * ++ * Note that regular mutual exclusion doesn't care about this ++ * delayed store. ++ */ ++ smp_mb(); ++ return atomic_read(&lock->val) & _Q_LOCKED_MASK; } -diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c -index 3abab534eb5c..498f0a2cb47f 100644 ---- a/net/sched/sch_sfq.c -+++ b/net/sched/sch_sfq.c -@@ -346,7 +346,7 @@ static int - sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch) + /** +@@ -108,6 +131,8 @@ static __always_inline void queued_spin_unlock(struct qspinlock *lock) + */ + static inline void queued_spin_unlock_wait(struct qspinlock *lock) { - struct sfq_sched_data *q = qdisc_priv(sch); -- unsigned int hash; -+ unsigned int hash, dropped; - sfq_index x, qlen; - struct sfq_slot *slot; - int uninitialized_var(ret); -@@ -461,7 +461,7 @@ enqueue: - return NET_XMIT_SUCCESS; - - qlen = slot->qlen; -- sfq_drop(sch); -+ dropped = sfq_drop(sch); - /* Return Congestion Notification only if we dropped a packet - * from this flow. - */ -@@ -469,7 +469,7 @@ enqueue: - return NET_XMIT_CN; - - /* As we dropped a packet, better let upper stack know this */ -- qdisc_tree_decrease_qlen(sch, 1); -+ qdisc_tree_reduce_backlog(sch, 1, dropped); - return NET_XMIT_SUCCESS; - } - -@@ -537,6 +537,7 @@ static void sfq_rehash(struct Qdisc *sch) - struct sfq_slot *slot; - struct sk_buff_head list; - int dropped = 0; -+ unsigned int drop_len = 0; - - __skb_queue_head_init(&list); - -@@ -565,6 +566,7 @@ static void sfq_rehash(struct Qdisc *sch) - if (x >= SFQ_MAX_FLOWS) { - drop: - qdisc_qstats_backlog_dec(sch, skb); -+ drop_len += qdisc_pkt_len(skb); - kfree_skb(skb); - dropped++; - continue; -@@ -594,7 +596,7 @@ drop: - } - } - sch->q.qlen -= dropped; -- qdisc_tree_decrease_qlen(sch, dropped); -+ qdisc_tree_reduce_backlog(sch, dropped, drop_len); ++ /* See queued_spin_is_locked() */ ++ smp_mb(); + while (atomic_read(&lock->val) & _Q_LOCKED_MASK) + cpu_relax(); } +diff --git a/include/asm-generic/siginfo.h b/include/asm-generic/siginfo.h +index 3d1a3af5cf59..a2508a8f9a9c 100644 +--- a/include/asm-generic/siginfo.h ++++ b/include/asm-generic/siginfo.h +@@ -17,21 +17,6 @@ + struct siginfo; + void do_schedule_next_timer(struct siginfo *info); - static void sfq_perturbation(unsigned long arg) -@@ -618,7 +620,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) - struct sfq_sched_data *q = qdisc_priv(sch); - struct tc_sfq_qopt *ctl = nla_data(opt); - struct tc_sfq_qopt_v1 *ctl_v1 = NULL; -- unsigned int qlen; -+ unsigned int qlen, dropped = 0; - struct red_parms *p = NULL; - - if (opt->nla_len < nla_attr_size(sizeof(*ctl))) -@@ -667,8 +669,8 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) - - qlen = sch->q.qlen; - while (sch->q.qlen > q->limit) -- sfq_drop(sch); -- qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen); -+ dropped += sfq_drop(sch); -+ qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, dropped); - - del_timer(&q->perturb_timer); - if (q->perturb_period) { -diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c -index a4afde14e865..c2fbde742f37 100644 ---- a/net/sched/sch_tbf.c -+++ b/net/sched/sch_tbf.c -@@ -160,6 +160,7 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch) - struct tbf_sched_data *q = qdisc_priv(sch); - struct sk_buff *segs, *nskb; - netdev_features_t features = netif_skb_features(skb); -+ unsigned int len = 0, prev_len = qdisc_pkt_len(skb); - int ret, nb; - - segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK); -@@ -172,6 +173,7 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch) - nskb = segs->next; - segs->next = NULL; - qdisc_skb_cb(segs)->pkt_len = segs->len; -+ len += segs->len; - ret = qdisc_enqueue(segs, q->qdisc); - if (ret != NET_XMIT_SUCCESS) { - if (net_xmit_drop_count(ret)) -@@ -183,7 +185,7 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch) - } - sch->q.qlen += nb; - if (nb > 1) -- qdisc_tree_decrease_qlen(sch, 1 - nb); -+ qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len); - consume_skb(skb); - return nb > 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP; - } -@@ -399,7 +401,8 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt) - - sch_tree_lock(sch); - if (child) { -- qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen); -+ qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen, -+ q->qdisc->qstats.backlog); - qdisc_destroy(q->qdisc); - q->qdisc = child; - } -@@ -502,13 +505,7 @@ static int tbf_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, - if (new == NULL) - new = &noop_qdisc; - -- sch_tree_lock(sch); -- *old = q->qdisc; -- q->qdisc = new; -- qdisc_tree_decrease_qlen(*old, (*old)->q.qlen); -- qdisc_reset(*old); -- sch_tree_unlock(sch); +-#ifndef HAVE_ARCH_COPY_SIGINFO - -+ *old = qdisc_replace(sch, new, &q->qdisc); - return 0; - } +-#include +- +-static inline void copy_siginfo(struct siginfo *to, struct siginfo *from) +-{ +- if (from->si_code < 0) +- memcpy(to, from, sizeof(*to)); +- else +- /* _sigchld is currently the largest know union member */ +- memcpy(to, from, __ARCH_SI_PREAMBLE_SIZE + sizeof(from->_sifields._sigchld)); +-} +- +-#endif +- + extern int copy_siginfo_to_user(struct siginfo __user *to, const struct siginfo *from); -diff --git a/net/socket.c b/net/socket.c -index c044d1e8508c..db13ae893dce 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -2240,31 +2240,31 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, - cond_resched(); - } + #endif +diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h +index 735f9f8c4e43..5261751f6bd4 100644 +--- a/include/linux/can/dev.h ++++ b/include/linux/can/dev.h +@@ -40,8 +40,11 @@ struct can_priv { + struct can_clock clock; --out_put: -- fput_light(sock->file, fput_needed); -- - if (err == 0) -- return datagrams; -+ goto out_put; - -- if (datagrams != 0) { -+ if (datagrams == 0) { -+ datagrams = err; -+ goto out_put; -+ } + enum can_state state; +- u32 ctrlmode; +- u32 ctrlmode_supported; + -+ /* -+ * We may return less entries than requested (vlen) if the -+ * sock is non block and there aren't enough datagrams... -+ */ -+ if (err != -EAGAIN) { - /* -- * We may return less entries than requested (vlen) if the -- * sock is non block and there aren't enough datagrams... -+ * ... or if recvmsg returns an error after we -+ * received some datagrams, where we record the -+ * error to return on the next call or if the -+ * app asks about it using getsockopt(SO_ERROR). - */ -- if (err != -EAGAIN) { -- /* -- * ... or if recvmsg returns an error after we -- * received some datagrams, where we record the -- * error to return on the next call or if the -- * app asks about it using getsockopt(SO_ERROR). -- */ -- sock->sk->sk_err = -err; -- } -- -- return datagrams; -+ sock->sk->sk_err = -err; - } -+out_put: -+ fput_light(sock->file, fput_needed); ++ /* CAN controller features - see include/uapi/linux/can/netlink.h */ ++ u32 ctrlmode; /* current options setting */ ++ u32 ctrlmode_supported; /* options that can be modified by netlink */ ++ u32 ctrlmode_static; /* static enabled options for driver/hardware */ -- return err; -+ return datagrams; + int restart_ms; + struct timer_list restart_timer; +@@ -108,6 +111,21 @@ static inline bool can_is_canfd_skb(const struct sk_buff *skb) + return skb->len == CANFD_MTU; } - SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg, -diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c -index 273bc3a35425..008c25d1b9f9 100644 ---- a/net/sunrpc/cache.c -+++ b/net/sunrpc/cache.c -@@ -1182,14 +1182,14 @@ int sunrpc_cache_pipe_upcall(struct cache_detail *detail, struct cache_head *h) - } ++/* helper to define static CAN controller features at device creation time */ ++static inline void can_set_static_ctrlmode(struct net_device *dev, ++ u32 static_mode) ++{ ++ struct can_priv *priv = netdev_priv(dev); ++ ++ /* alloc_candev() succeeded => netdev_priv() is valid at this point */ ++ priv->ctrlmode = static_mode; ++ priv->ctrlmode_static = static_mode; ++ ++ /* override MTU which was set by default in can_setup()? */ ++ if (static_mode & CAN_CTRLMODE_FD) ++ dev->mtu = CANFD_MTU; ++} ++ + /* get data length from can_dlc with sanitized can_dlc */ + u8 can_dlc2len(u8 can_dlc); - crq->q.reader = 0; -- crq->item = cache_get(h); - crq->buf = buf; - crq->len = 0; - crq->readers = 0; - spin_lock(&queue_lock); -- if (test_bit(CACHE_PENDING, &h->flags)) -+ if (test_bit(CACHE_PENDING, &h->flags)) { -+ crq->item = cache_get(h); - list_add_tail(&crq->q.list, &detail->queue); -- else -+ } else - /* Lost a race, no longer PENDING, so don't enqueue */ - ret = -EAGAIN; - spin_unlock(&queue_lock); -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index bbe65dcb9738..c93e67beaea7 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -1789,27 +1789,8 @@ vsock_stream_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - else if (sk->sk_shutdown & RCV_SHUTDOWN) - err = 0; - -- if (copied > 0) { -- /* We only do these additional bookkeeping/notification steps -- * if we actually copied something out of the queue pair -- * instead of just peeking ahead. -- */ -- -- if (!(flags & MSG_PEEK)) { -- /* If the other side has shutdown for sending and there -- * is nothing more to read, then modify the socket -- * state. -- */ -- if (vsk->peer_shutdown & SEND_SHUTDOWN) { -- if (vsock_stream_has_data(vsk) <= 0) { -- sk->sk_state = SS_UNCONNECTED; -- sock_set_flag(sk, SOCK_DONE); -- sk->sk_state_change(sk); -- } -- } -- } -+ if (copied > 0) - err = copied; -- } +diff --git a/include/linux/signal.h b/include/linux/signal.h +index 92557bbce7e7..d80259afb9e5 100644 +--- a/include/linux/signal.h ++++ b/include/linux/signal.h +@@ -28,6 +28,21 @@ struct sigpending { + sigset_t signal; + }; - out: - release_sock(sk); -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 711cb7ad6ae0..ab62d305b48b 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -13201,7 +13201,7 @@ static int nl80211_netlink_notify(struct notifier_block * nb, - struct wireless_dev *wdev; - struct cfg80211_beacon_registration *reg, *tmp; ++#ifndef HAVE_ARCH_COPY_SIGINFO ++ ++#include ++ ++static inline void copy_siginfo(struct siginfo *to, struct siginfo *from) ++{ ++ if (from->si_code < 0) ++ memcpy(to, from, sizeof(*to)); ++ else ++ /* _sigchld is currently the largest know union member */ ++ memcpy(to, from, __ARCH_SI_PREAMBLE_SIZE + sizeof(from->_sifields._sigchld)); ++} ++ ++#endif ++ + /* + * Define some primitives to manipulate sigset_t. + */ +diff --git a/include/linux/tty.h b/include/linux/tty.h +index 19199c26783f..e5b996d887ce 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -338,7 +338,6 @@ struct tty_file_private { + #define TTY_EXCLUSIVE 3 /* Exclusive open mode */ + #define TTY_DEBUG 4 /* Debugging */ + #define TTY_DO_WRITE_WAKEUP 5 /* Call write_wakeup after queuing new */ +-#define TTY_OTHER_DONE 6 /* Closed pty has completed input processing */ + #define TTY_LDISC_OPEN 11 /* Line discipline is open */ + #define TTY_PTY_LOCK 16 /* pty private */ + #define TTY_NO_WRITE_SPLIT 17 /* Preserve write boundaries to driver */ +@@ -464,6 +463,7 @@ extern void tty_buffer_init(struct tty_port *port); + extern void tty_buffer_set_lock_subclass(struct tty_port *port); + extern bool tty_buffer_restart_work(struct tty_port *port); + extern bool tty_buffer_cancel_work(struct tty_port *port); ++extern void tty_buffer_flush_work(struct tty_port *port); + extern speed_t tty_termios_baud_rate(struct ktermios *termios); + extern speed_t tty_termios_input_baud_rate(struct ktermios *termios); + extern void tty_termios_encode_baud_rate(struct ktermios *termios, +diff --git a/include/linux/usb.h b/include/linux/usb.h +index 89533ba38691..f3dbc217ff41 100644 +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -1066,7 +1066,7 @@ struct usbdrv_wrap { + * for interfaces bound to this driver. + * @soft_unbind: if set to 1, the USB core will not kill URBs and disable + * endpoints before calling the driver's disconnect method. +- * @disable_hub_initiated_lpm: if set to 0, the USB core will not allow hubs ++ * @disable_hub_initiated_lpm: if set to 1, the USB core will not allow hubs + * to initiate lower power link state transitions when an idle timeout + * occurs. Device-initiated USB 3.0 link PM will still be allowed. + * +diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h +index ba93c0f69870..a5d31f794cac 100644 +--- a/include/scsi/scsi_device.h ++++ b/include/scsi/scsi_device.h +@@ -240,6 +240,7 @@ scmd_printk(const char *, const struct scsi_cmnd *, const char *, ...); + enum scsi_target_state { + STARGET_CREATED = 1, + STARGET_RUNNING, ++ STARGET_REMOVE, + STARGET_DEL, + }; -- if (state != NETLINK_URELEASE) -+ if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) - return NOTIFY_DONE; +diff --git a/kernel/events/core.c b/kernel/events/core.c +index a0ef98b258d7..477fb6b8ca20 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -1090,6 +1090,7 @@ static void put_ctx(struct perf_event_context *ctx) + * function. + * + * Lock order: ++ * cred_guard_mutex + * task_struct::perf_event_mutex + * perf_event_context::mutex + * perf_event::child_mutex; +@@ -3415,7 +3416,6 @@ static struct task_struct * + find_lively_task_by_vpid(pid_t vpid) + { + struct task_struct *task; +- int err; rcu_read_lock(); -diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c -index 7ecd04c21360..997ff7b2509b 100644 ---- a/net/x25/x25_facilities.c -+++ b/net/x25/x25_facilities.c -@@ -277,6 +277,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk, - - memset(&theirs, 0, sizeof(theirs)); - memcpy(new, ours, sizeof(*new)); -+ memset(dte, 0, sizeof(*dte)); - - len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask); - if (len < 0) -diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c -index ad7f5b3f9b61..1c4ad477ce93 100644 ---- a/net/xfrm/xfrm_input.c -+++ b/net/xfrm/xfrm_input.c -@@ -292,12 +292,15 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) - XFRM_SKB_CB(skb)->seq.input.hi = seq_hi; - - skb_dst_force(skb); -+ dev_hold(skb->dev); - - nexthdr = x->type->input(x, skb); - - if (nexthdr == -EINPROGRESS) - return 0; - resume: -+ dev_put(skb->dev); -+ - spin_lock(&x->lock); - if (nexthdr <= 0) { - if (nexthdr == -EBADMSG) { -diff --git a/samples/bpf/trace_output_kern.c b/samples/bpf/trace_output_kern.c -index 8d8d1ec429eb..9b96f4fb8cea 100644 ---- a/samples/bpf/trace_output_kern.c -+++ b/samples/bpf/trace_output_kern.c -@@ -18,7 +18,6 @@ int bpf_prog1(struct pt_regs *ctx) - u64 cookie; - } data; - -- memset(&data, 0, sizeof(data)); - data.pid = bpf_get_current_pid_tgid(); - data.cookie = 0x12345678; - -diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn -index f9e47a70509c..53449a6ff6aa 100644 ---- a/scripts/Makefile.extrawarn -+++ b/scripts/Makefile.extrawarn -@@ -24,6 +24,7 @@ warning-1 += $(call cc-option, -Wmissing-prototypes) - warning-1 += -Wold-style-definition - warning-1 += $(call cc-option, -Wmissing-include-dirs) - warning-1 += $(call cc-option, -Wunused-but-set-variable) -+warning-1 += $(call cc-option, -Wunused-const-variable) - warning-1 += $(call cc-disable-warning, missing-field-initializers) - warning-1 += $(call cc-disable-warning, sign-compare) - -diff --git a/scripts/coccinelle/iterators/use_after_iter.cocci b/scripts/coccinelle/iterators/use_after_iter.cocci -index f085f5968c52..ce8cc9c006e5 100644 ---- a/scripts/coccinelle/iterators/use_after_iter.cocci -+++ b/scripts/coccinelle/iterators/use_after_iter.cocci -@@ -123,7 +123,7 @@ list_remove_head(x,c,...) - | - sizeof(<+...c...+>) - | --&c->member -+ &c->member - | - c = E - | -diff --git a/scripts/gdb/linux/modules.py b/scripts/gdb/linux/modules.py -index 25db8cff44a2..0a35d6dbfb80 100644 ---- a/scripts/gdb/linux/modules.py -+++ b/scripts/gdb/linux/modules.py -@@ -73,10 +73,11 @@ class LxLsmod(gdb.Command): - " " if utils.get_long_type().sizeof == 8 else "")) - - for module in module_list(): -+ layout = module['core_layout'] - gdb.write("{address} {name:<19} {size:>8} {ref}".format( -- address=str(module['module_core']).split()[0], -+ address=str(layout['base']).split()[0], - name=module['name'].string(), -- size=str(module['core_size']), -+ size=str(layout['size']), - ref=str(module['refcnt']['counter']))) - - source_list = module['source_list'] -diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py -index 627750cb420d..9a0f8923f67c 100644 ---- a/scripts/gdb/linux/symbols.py -+++ b/scripts/gdb/linux/symbols.py -@@ -108,7 +108,7 @@ lx-symbols command.""" - - def load_module_symbols(self, module): - module_name = module['name'].string() -- module_addr = str(module['module_core']).split()[0] -+ module_addr = str(module['core_layout']['base']).split()[0] - - module_file = self._get_module_file(module_name) - if not module_file and not self.module_files_updated: -diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile -index d79cba4ce3eb..ebced77deb9c 100644 ---- a/scripts/kconfig/Makefile -+++ b/scripts/kconfig/Makefile -@@ -96,13 +96,15 @@ savedefconfig: $(obj)/conf - defconfig: $(obj)/conf - ifeq ($(KBUILD_DEFCONFIG),) - $< $(silent) --defconfig $(Kconfig) --else ifneq ($(wildcard $(srctree)/arch/$(SRCARCH)/configs/$(KBUILD_DEFCONFIG)),) -+else -+ifneq ($(wildcard $(srctree)/arch/$(SRCARCH)/configs/$(KBUILD_DEFCONFIG)),) - @$(kecho) "*** Default configuration is based on '$(KBUILD_DEFCONFIG)'" - $(Q)$< $(silent) --defconfig=arch/$(SRCARCH)/configs/$(KBUILD_DEFCONFIG) $(Kconfig) - else - @$(kecho) "*** Default configuration is based on target '$(KBUILD_DEFCONFIG)'" - $(Q)$(MAKE) -f $(srctree)/Makefile $(KBUILD_DEFCONFIG) - endif -+endif - - %_defconfig: $(obj)/conf - $(Q)$< $(silent) --defconfig=arch/$(SRCARCH)/configs/$@ $(Kconfig) -diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c -index 0b7dc2fd7bac..dd243d2abd87 100644 ---- a/scripts/kconfig/confdata.c -+++ b/scripts/kconfig/confdata.c -@@ -267,10 +267,8 @@ int conf_read_simple(const char *name, int def) - if (in) - goto load; - sym_add_change_count(1); -- if (!sym_defconfig_list) { -- sym_calc_value(modules_sym); -+ if (!sym_defconfig_list) - return 1; -- } + if (!vpid) +@@ -3429,16 +3429,7 @@ find_lively_task_by_vpid(pid_t vpid) + if (!task) + return ERR_PTR(-ESRCH); - for_all_defaults(sym_defconfig_list, prop) { - if (expr_calc_value(prop->visible.expr) == no || -@@ -403,7 +401,6 @@ setsym: - } - free(line); - fclose(in); -- sym_calc_value(modules_sym); - return 0; +- /* Reuse ptrace permission checks for now. */ +- err = -EACCES; +- if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) +- goto errout; +- + return task; +-errout: +- put_task_struct(task); +- return ERR_PTR(err); +- } -@@ -414,8 +411,12 @@ int conf_read(const char *name) + /* +@@ -8360,6 +8351,24 @@ SYSCALL_DEFINE5(perf_event_open, - sym_set_change_count(0); + get_online_cpus(); -- if (conf_read_simple(name, S_DEF_USER)) -+ if (conf_read_simple(name, S_DEF_USER)) { -+ sym_calc_value(modules_sym); - return 1; ++ if (task) { ++ err = mutex_lock_interruptible(&task->signal->cred_guard_mutex); ++ if (err) ++ goto err_cpus; ++ ++ /* ++ * Reuse ptrace permission checks for now. ++ * ++ * We must hold cred_guard_mutex across this and any potential ++ * perf_install_in_context() call for this new event to ++ * serialize against exec() altering our credentials (and the ++ * perf_event_exit_task() that could imply). ++ */ ++ err = -EACCES; ++ if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) ++ goto err_cred; + } + -+ sym_calc_value(modules_sym); - - for_all_symbols(i, sym) { - sym_calc_value(sym); -@@ -846,6 +847,7 @@ static int conf_split_config(void) - - name = conf_get_autoconfig_name(); - conf_read_simple(name, S_DEF_AUTO); -+ sym_calc_value(modules_sym); - - if (chdir("include/config")) - return 1; -diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c -index 161dd0d67da8..a9155077feef 100644 ---- a/scripts/mod/file2alias.c -+++ b/scripts/mod/file2alias.c -@@ -371,6 +371,49 @@ static void do_usb_table(void *symval, unsigned long size, - do_usb_entry_multi(symval + i, mod); - } + if (flags & PERF_FLAG_PID_CGROUP) + cgroup_fd = pid; -+static void do_of_entry_multi(void *symval, struct module *mod) -+{ -+ char alias[500]; -+ int len; -+ char *tmp; -+ -+ DEF_FIELD_ADDR(symval, of_device_id, name); -+ DEF_FIELD_ADDR(symval, of_device_id, type); -+ DEF_FIELD_ADDR(symval, of_device_id, compatible); -+ -+ len = sprintf(alias, "of:N%sT%s", (*name)[0] ? *name : "*", -+ (*type)[0] ? *type : "*"); -+ -+ if (compatible[0]) -+ sprintf(&alias[len], "%sC%s", (*type)[0] ? "*" : "", -+ *compatible); -+ -+ /* Replace all whitespace with underscores */ -+ for (tmp = alias; tmp && *tmp; tmp++) -+ if (isspace(*tmp)) -+ *tmp = '_'; -+ -+ buf_printf(&mod->dev_table_buf, "MODULE_ALIAS(\"%s\");\n", alias); -+ strcat(alias, "C"); -+ add_wildcard(alias); -+ buf_printf(&mod->dev_table_buf, "MODULE_ALIAS(\"%s\");\n", alias); -+} -+ -+static void do_of_table(void *symval, unsigned long size, -+ struct module *mod) -+{ -+ unsigned int i; -+ const unsigned long id_size = SIZE_of_device_id; -+ -+ device_id_check(mod->name, "of", size, id_size, symval); -+ -+ /* Leave last one: it's the terminator. */ -+ size -= id_size; -+ -+ for (i = 0; i < size; i += id_size) -+ do_of_entry_multi(symval + i, mod); -+} -+ - /* Looks like: hid:bNvNpN */ - static int do_hid_entry(const char *filename, - void *symval, char *alias) -@@ -684,30 +727,6 @@ static int do_pcmcia_entry(const char *filename, - } - ADD_TO_DEVTABLE("pcmcia", pcmcia_device_id, do_pcmcia_entry); +@@ -8367,7 +8376,7 @@ SYSCALL_DEFINE5(perf_event_open, + NULL, NULL, cgroup_fd); + if (IS_ERR(event)) { + err = PTR_ERR(event); +- goto err_cpus; ++ goto err_cred; + } --static int do_of_entry (const char *filename, void *symval, char *alias) --{ -- int len; -- char *tmp; -- DEF_FIELD_ADDR(symval, of_device_id, name); -- DEF_FIELD_ADDR(symval, of_device_id, type); -- DEF_FIELD_ADDR(symval, of_device_id, compatible); -- -- len = sprintf(alias, "of:N%sT%s", (*name)[0] ? *name : "*", -- (*type)[0] ? *type : "*"); -- -- if (compatible[0]) -- sprintf(&alias[len], "%sC%s", (*type)[0] ? "*" : "", -- *compatible); -- -- /* Replace all whitespace with underscores */ -- for (tmp = alias; tmp && *tmp; tmp++) -- if (isspace (*tmp)) -- *tmp = '_'; -- -- return 1; --} --ADD_TO_DEVTABLE("of", of_device_id, do_of_entry); -- - static int do_vio_entry(const char *filename, void *symval, - char *alias) - { -@@ -1348,6 +1367,8 @@ void handle_moddevtable(struct module *mod, struct elf_info *info, - /* First handle the "special" cases */ - if (sym_is(name, namelen, "usb")) - do_usb_table(symval, sym->st_size, mod); -+ if (sym_is(name, namelen, "of")) -+ do_of_table(symval, sym->st_size, mod); - else if (sym_is(name, namelen, "pnp")) - do_pnp_device_entry(symval, sym->st_size, mod); - else if (sym_is(name, namelen, "pnp_card")) -diff --git a/scripts/package/mkspec b/scripts/package/mkspec -index 71004daefe31..fe44d68e9344 100755 ---- a/scripts/package/mkspec -+++ b/scripts/package/mkspec -@@ -131,11 +131,11 @@ echo 'rm -rf $RPM_BUILD_ROOT' - echo "" - echo "%post" - echo "if [ -x /sbin/installkernel -a -r /boot/vmlinuz-$KERNELRELEASE -a -r /boot/System.map-$KERNELRELEASE ]; then" --echo "cp /boot/vmlinuz-$KERNELRELEASE /boot/vmlinuz-$KERNELRELEASE-rpm" --echo "cp /boot/System.map-$KERNELRELEASE /boot/System.map-$KERNELRELEASE-rpm" -+echo "cp /boot/vmlinuz-$KERNELRELEASE /boot/.vmlinuz-$KERNELRELEASE-rpm" -+echo "cp /boot/System.map-$KERNELRELEASE /boot/.System.map-$KERNELRELEASE-rpm" - echo "rm -f /boot/vmlinuz-$KERNELRELEASE /boot/System.map-$KERNELRELEASE" --echo "/sbin/installkernel $KERNELRELEASE /boot/vmlinuz-$KERNELRELEASE-rpm /boot/System.map-$KERNELRELEASE-rpm" --echo "rm -f /boot/vmlinuz-$KERNELRELEASE-rpm /boot/System.map-$KERNELRELEASE-rpm" -+echo "/sbin/installkernel $KERNELRELEASE /boot/.vmlinuz-$KERNELRELEASE-rpm /boot/.System.map-$KERNELRELEASE-rpm" -+echo "rm -f /boot/.vmlinuz-$KERNELRELEASE-rpm /boot/.System.map-$KERNELRELEASE-rpm" - echo "fi" - echo "" - echo "%files" -diff --git a/security/keys/trusted.c b/security/keys/trusted.c -index 0dcab20cdacd..90d61751ff12 100644 ---- a/security/keys/trusted.c -+++ b/security/keys/trusted.c -@@ -744,6 +744,7 @@ static int getoptions(char *c, struct trusted_key_payload *pay, - unsigned long handle; - unsigned long lock; - unsigned long token_mask = 0; -+ unsigned int digest_len; - int i; - int tpm2; - -@@ -752,7 +753,6 @@ static int getoptions(char *c, struct trusted_key_payload *pay, - return tpm2; - - opt->hash = tpm2 ? HASH_ALGO_SHA256 : HASH_ALGO_SHA1; -- opt->digest_len = hash_digest_size[opt->hash]; - - while ((p = strsep(&c, " \t"))) { - if (*p == '\0' || *p == ' ' || *p == '\t') -@@ -812,8 +812,6 @@ static int getoptions(char *c, struct trusted_key_payload *pay, - for (i = 0; i < HASH_ALGO__LAST; i++) { - if (!strcmp(args[0].from, hash_algo_name[i])) { - opt->hash = i; -- opt->digest_len = -- hash_digest_size[opt->hash]; - break; - } - } -@@ -825,13 +823,14 @@ static int getoptions(char *c, struct trusted_key_payload *pay, - } - break; - case Opt_policydigest: -- if (!tpm2 || -- strlen(args[0].from) != (2 * opt->digest_len)) -+ digest_len = hash_digest_size[opt->hash]; -+ if (!tpm2 || strlen(args[0].from) != (2 * digest_len)) - return -EINVAL; - res = hex2bin(opt->policydigest, args[0].from, -- opt->digest_len); -+ digest_len); - if (res < 0) - return -EINVAL; -+ opt->policydigest_len = digest_len; - break; - case Opt_policyhandle: - if (!tpm2) -diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c -index 6b5a811e01a5..3a9b66c6e09c 100644 ---- a/sound/core/pcm_lib.c -+++ b/sound/core/pcm_lib.c -@@ -322,7 +322,7 @@ static int snd_pcm_update_hw_ptr0(struct snd_pcm_substream *substream, - char name[16]; - snd_pcm_debug_name(substream, name, sizeof(name)); - pcm_err(substream->pcm, -- "BUG: %s, pos = %ld, buffer size = %ld, period size = %ld\n", -+ "invalid position: %s, pos = %ld, buffer size = %ld, period size = %ld\n", - name, pos, runtime->buffer_size, - runtime->period_size); - } -diff --git a/sound/core/timer.c b/sound/core/timer.c -index dca817fc7894..e5e7e4368996 100644 ---- a/sound/core/timer.c -+++ b/sound/core/timer.c -@@ -1041,8 +1041,8 @@ static int snd_timer_s_start(struct snd_timer * timer) - njiff += timer->sticks - priv->correction; - priv->correction = 0; + if (is_sampling_event(event)) { +@@ -8426,11 +8435,6 @@ SYSCALL_DEFINE5(perf_event_open, + goto err_context; } -- priv->last_expires = priv->tlist.expires = njiff; -- add_timer(&priv->tlist); -+ priv->last_expires = njiff; -+ mod_timer(&priv->tlist, njiff); - return 0; - } -diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c -index e361024eabb6..d1a4d6973330 100644 ---- a/sound/hda/hdac_device.c -+++ b/sound/hda/hdac_device.c -@@ -611,6 +611,22 @@ int snd_hdac_power_up_pm(struct hdac_device *codec) - } - EXPORT_SYMBOL_GPL(snd_hdac_power_up_pm); +- if (task) { +- put_task_struct(task); +- task = NULL; +- } +- + /* + * Look up the group leader (we will attach this event to it): + */ +@@ -8528,6 +8532,11 @@ SYSCALL_DEFINE5(perf_event_open, -+/* like snd_hdac_power_up_pm(), but only increment the pm count when -+ * already powered up. Returns -1 if not powered up, 1 if incremented -+ * or 0 if unchanged. Only used in hdac_regmap.c -+ */ -+int snd_hdac_keep_power_up(struct hdac_device *codec) -+{ -+ if (!atomic_inc_not_zero(&codec->in_pm)) { -+ int ret = pm_runtime_get_if_in_use(&codec->dev); -+ if (!ret) -+ return -1; -+ if (ret < 0) -+ return 0; -+ } -+ return 1; -+} + WARN_ON_ONCE(ctx->parent_ctx); + ++ /* ++ * This is the point on no return; we cannot fail hereafter. This is ++ * where we start modifying current state. ++ */ + - /** - * snd_hdac_power_down_pm - power down the codec - * @codec: the codec object -diff --git a/sound/hda/hdac_i915.c b/sound/hda/hdac_i915.c -index f6854dbd7d8d..69ead7150a5c 100644 ---- a/sound/hda/hdac_i915.c -+++ b/sound/hda/hdac_i915.c -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - - static struct i915_audio_component *hdac_acomp; - -@@ -97,26 +98,65 @@ int snd_hdac_display_power(struct hdac_bus *bus, bool enable) - } - EXPORT_SYMBOL_GPL(snd_hdac_display_power); + if (move_group) { + /* + * See perf_event_ctx_lock() for comments on the details +@@ -8599,6 +8608,11 @@ SYSCALL_DEFINE5(perf_event_open, + mutex_unlock(&gctx->mutex); + mutex_unlock(&ctx->mutex); -+#define CONTROLLER_IN_GPU(pci) (((pci)->device == 0x0a0c) || \ -+ ((pci)->device == 0x0c0c) || \ -+ ((pci)->device == 0x0d0c) || \ -+ ((pci)->device == 0x160c)) ++ if (task) { ++ mutex_unlock(&task->signal->cred_guard_mutex); ++ put_task_struct(task); ++ } + - /** -- * snd_hdac_get_display_clk - Get CDCLK in kHz -+ * snd_hdac_i915_set_bclk - Reprogram BCLK for HSW/BDW - * @bus: HDA core bus - * -- * This function is supposed to be used only by a HD-audio controller -- * driver that needs the interaction with i915 graphics. -+ * Intel HSW/BDW display HDA controller is in GPU. Both its power and link BCLK -+ * depends on GPU. Two Extended Mode registers EM4 (M value) and EM5 (N Value) -+ * are used to convert CDClk (Core Display Clock) to 24MHz BCLK: -+ * BCLK = CDCLK * M / N -+ * The values will be lost when the display power well is disabled and need to -+ * be restored to avoid abnormal playback speed. - * -- * This function queries CDCLK value in kHz from the graphics driver and -- * returns the value. A negative code is returned in error. -+ * Call this function at initializing and changing power well, as well as -+ * at ELD notifier for the hotplug. + put_online_cpus(); + + mutex_lock(¤t->perf_event_mutex); +@@ -8631,6 +8645,9 @@ err_alloc: + */ + if (!event_file) + free_event(event); ++err_cred: ++ if (task) ++ mutex_unlock(&task->signal->cred_guard_mutex); + err_cpus: + put_online_cpus(); + err_task: +@@ -8915,6 +8932,9 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn) + + /* + * When a child task exits, feed back event values to parent events. ++ * ++ * Can be called with cred_guard_mutex held when called from ++ * install_exec_creds(). */ --int snd_hdac_get_display_clk(struct hdac_bus *bus) -+void snd_hdac_i915_set_bclk(struct hdac_bus *bus) + void perf_event_exit_task(struct task_struct *child) { - struct i915_audio_component *acomp = bus->audio_component; -+ struct pci_dev *pci = to_pci_dev(bus->dev); -+ int cdclk_freq; -+ unsigned int bclk_m, bclk_n; -+ -+ if (!acomp || !acomp->ops || !acomp->ops->get_cdclk_freq) -+ return; /* only for i915 binding */ -+ if (!CONTROLLER_IN_GPU(pci)) -+ return; /* only HSW/BDW */ -+ -+ cdclk_freq = acomp->ops->get_cdclk_freq(acomp->dev); -+ switch (cdclk_freq) { -+ case 337500: -+ bclk_m = 16; -+ bclk_n = 225; -+ break; -+ -+ case 450000: -+ default: /* default CDCLK 450MHz */ -+ bclk_m = 4; -+ bclk_n = 75; -+ break; +diff --git a/kernel/sched/loadavg.c b/kernel/sched/loadavg.c +index ef7159012cf3..b0b93fd33af9 100644 +--- a/kernel/sched/loadavg.c ++++ b/kernel/sched/loadavg.c +@@ -99,10 +99,13 @@ long calc_load_fold_active(struct rq *this_rq) + static unsigned long + calc_load(unsigned long load, unsigned long exp, unsigned long active) + { +- load *= exp; +- load += active * (FIXED_1 - exp); +- load += 1UL << (FSHIFT - 1); +- return load >> FSHIFT; ++ unsigned long newload; + -+ case 540000: -+ bclk_m = 4; -+ bclk_n = 90; -+ break; ++ newload = load * exp + active * (FIXED_1 - exp); ++ if (active >= load) ++ newload += FIXED_1-1; + -+ case 675000: -+ bclk_m = 8; -+ bclk_n = 225; -+ break; -+ } - -- if (!acomp || !acomp->ops) -- return -ENODEV; -- -- return acomp->ops->get_cdclk_freq(acomp->dev); -+ snd_hdac_chip_writew(bus, HSW_EM4, bclk_m); -+ snd_hdac_chip_writew(bus, HSW_EM5, bclk_n); ++ return newload / FIXED_1; } --EXPORT_SYMBOL_GPL(snd_hdac_get_display_clk); -+EXPORT_SYMBOL_GPL(snd_hdac_i915_set_bclk); - - /* There is a fixed mapping between audio pin node and display port - * on current Intel platforms: -diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c -index eb8f7c30cb09..bdbcd6b75ff6 100644 ---- a/sound/hda/hdac_regmap.c -+++ b/sound/hda/hdac_regmap.c -@@ -21,13 +21,16 @@ - #include - #include - --#ifdef CONFIG_PM --#define codec_is_running(codec) \ -- (atomic_read(&(codec)->in_pm) || \ -- !pm_runtime_suspended(&(codec)->dev)) --#else --#define codec_is_running(codec) true --#endif -+static int codec_pm_lock(struct hdac_device *codec) -+{ -+ return snd_hdac_keep_power_up(codec); -+} -+ -+static void codec_pm_unlock(struct hdac_device *codec, int lock) -+{ -+ if (lock == 1) -+ snd_hdac_power_down_pm(codec); -+} - - #define get_verb(reg) (((reg) >> 8) & 0xfff) -@@ -238,20 +241,28 @@ static int hda_reg_read(void *context, unsigned int reg, unsigned int *val) - struct hdac_device *codec = context; - int verb = get_verb(reg); - int err; -+ int pm_lock = 0; - -- if (!codec_is_running(codec) && verb != AC_VERB_GET_POWER_STATE) -- return -EAGAIN; -+ if (verb != AC_VERB_GET_POWER_STATE) { -+ pm_lock = codec_pm_lock(codec); -+ if (pm_lock < 0) -+ return -EAGAIN; -+ } - reg |= (codec->addr << 28); -- if (is_stereo_amp_verb(reg)) -- return hda_reg_read_stereo_amp(codec, reg, val); -- if (verb == AC_VERB_GET_PROC_COEF) -- return hda_reg_read_coef(codec, reg, val); -+ if (is_stereo_amp_verb(reg)) { -+ err = hda_reg_read_stereo_amp(codec, reg, val); -+ goto out; -+ } -+ if (verb == AC_VERB_GET_PROC_COEF) { -+ err = hda_reg_read_coef(codec, reg, val); -+ goto out; -+ } - if ((verb & 0x700) == AC_VERB_SET_AMP_GAIN_MUTE) - reg &= ~AC_AMP_FAKE_MUTE; - - err = snd_hdac_exec_verb(codec, reg, 0, val); - if (err < 0) -- return err; -+ goto out; - /* special handling for asymmetric reads */ - if (verb == AC_VERB_GET_POWER_STATE) { - if (*val & AC_PWRST_ERROR) -@@ -259,7 +270,9 @@ static int hda_reg_read(void *context, unsigned int reg, unsigned int *val) - else /* take only the actual state */ - *val = (*val >> 4) & 0x0f; - } -- return 0; -+ out: -+ codec_pm_unlock(codec, pm_lock); -+ return err; + #ifdef CONFIG_NO_HZ_COMMON +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 95181e36891a..9c143739b8d7 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -437,7 +437,7 @@ struct ring_buffer_per_cpu { + raw_spinlock_t reader_lock; /* serialize readers */ + arch_spinlock_t lock; + struct lock_class_key lock_key; +- unsigned int nr_pages; ++ unsigned long nr_pages; + unsigned int current_context; + struct list_head *pages; + struct buffer_page *head_page; /* read from head */ +@@ -458,7 +458,7 @@ struct ring_buffer_per_cpu { + u64 write_stamp; + u64 read_stamp; + /* ring buffer pages to update, > 0 to add, < 0 to remove */ +- int nr_pages_to_update; ++ long nr_pages_to_update; + struct list_head new_pages; /* new pages to add */ + struct work_struct update_pages_work; + struct completion update_done; +@@ -1128,10 +1128,10 @@ static int rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer) + return 0; } - static int hda_reg_write(void *context, unsigned int reg, unsigned int val) -@@ -267,6 +280,7 @@ static int hda_reg_write(void *context, unsigned int reg, unsigned int val) - struct hdac_device *codec = context; - unsigned int verb; - int i, bytes, err; -+ int pm_lock = 0; - - if (codec->caps_overwriting) - return 0; -@@ -275,14 +289,21 @@ static int hda_reg_write(void *context, unsigned int reg, unsigned int val) - reg |= (codec->addr << 28); - verb = get_verb(reg); - -- if (!codec_is_running(codec) && verb != AC_VERB_SET_POWER_STATE) -- return codec->lazy_cache ? 0 : -EAGAIN; -+ if (verb != AC_VERB_SET_POWER_STATE) { -+ pm_lock = codec_pm_lock(codec); -+ if (pm_lock < 0) -+ return codec->lazy_cache ? 0 : -EAGAIN; -+ } +-static int __rb_allocate_pages(int nr_pages, struct list_head *pages, int cpu) ++static int __rb_allocate_pages(long nr_pages, struct list_head *pages, int cpu) + { +- int i; + struct buffer_page *bpage, *tmp; ++ long i; -- if (is_stereo_amp_verb(reg)) -- return hda_reg_write_stereo_amp(codec, reg, val); -+ if (is_stereo_amp_verb(reg)) { -+ err = hda_reg_write_stereo_amp(codec, reg, val); -+ goto out; -+ } + for (i = 0; i < nr_pages; i++) { + struct page *page; +@@ -1168,7 +1168,7 @@ free_pages: + } -- if (verb == AC_VERB_SET_PROC_COEF) -- return hda_reg_write_coef(codec, reg, val); -+ if (verb == AC_VERB_SET_PROC_COEF) { -+ err = hda_reg_write_coef(codec, reg, val); -+ goto out; -+ } + static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer, +- unsigned nr_pages) ++ unsigned long nr_pages) + { + LIST_HEAD(pages); - switch (verb & 0xf00) { - case AC_VERB_SET_AMP_GAIN_MUTE: -@@ -319,10 +340,12 @@ static int hda_reg_write(void *context, unsigned int reg, unsigned int val) - reg |= (verb + i) << 8 | ((val >> (8 * i)) & 0xff); - err = snd_hdac_exec_verb(codec, reg, 0, NULL); - if (err < 0) -- return err; -+ goto out; - } +@@ -1193,7 +1193,7 @@ static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer, + } -- return 0; -+ out: -+ codec_pm_unlock(codec, pm_lock); -+ return err; + static struct ring_buffer_per_cpu * +-rb_allocate_cpu_buffer(struct ring_buffer *buffer, int nr_pages, int cpu) ++rb_allocate_cpu_buffer(struct ring_buffer *buffer, long nr_pages, int cpu) + { + struct ring_buffer_per_cpu *cpu_buffer; + struct buffer_page *bpage; +@@ -1293,8 +1293,9 @@ struct ring_buffer *__ring_buffer_alloc(unsigned long size, unsigned flags, + struct lock_class_key *key) + { + struct ring_buffer *buffer; ++ long nr_pages; + int bsize; +- int cpu, nr_pages; ++ int cpu; + + /* keep it in its own cache line */ + buffer = kzalloc(ALIGN(sizeof(*buffer), cache_line_size()), +@@ -1420,12 +1421,12 @@ static inline unsigned long rb_page_write(struct buffer_page *bpage) } - static const struct regmap_config hda_regmap_cfg = { -diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c -index 7ca5b89f088a..dfaf1a93fb8a 100644 ---- a/sound/pci/hda/hda_generic.c -+++ b/sound/pci/hda/hda_generic.c -@@ -826,7 +826,7 @@ static hda_nid_t path_power_update(struct hda_codec *codec, - bool allow_powerdown) - { - hda_nid_t nid, changed = 0; -- int i, state; -+ int i, state, power; - - for (i = 0; i < path->depth; i++) { - nid = path->path[i]; -@@ -838,7 +838,9 @@ static hda_nid_t path_power_update(struct hda_codec *codec, - state = AC_PWRST_D0; - else - state = AC_PWRST_D3; -- if (!snd_hda_check_power_state(codec, nid, state)) { -+ power = snd_hda_codec_read(codec, nid, 0, -+ AC_VERB_GET_POWER_STATE, 0); -+ if (power != (state | (state << 4))) { - snd_hda_codec_write(codec, nid, 0, - AC_VERB_SET_POWER_STATE, state); - changed = nid; -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index e5240cb3749f..c0b772bb49af 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -857,50 +857,6 @@ static int param_set_xint(const char *val, const struct kernel_param *kp) - #define azx_del_card_list(chip) /* NOP */ - #endif /* CONFIG_PM */ - --/* Intel HSW/BDW display HDA controller is in GPU. Both its power and link BCLK -- * depends on GPU. Two Extended Mode registers EM4 (M value) and EM5 (N Value) -- * are used to convert CDClk (Core Display Clock) to 24MHz BCLK: -- * BCLK = CDCLK * M / N -- * The values will be lost when the display power well is disabled and need to -- * be restored to avoid abnormal playback speed. -- */ --static void haswell_set_bclk(struct hda_intel *hda) --{ -- struct azx *chip = &hda->chip; -- int cdclk_freq; -- unsigned int bclk_m, bclk_n; -- -- if (!hda->need_i915_power) -- return; -- -- cdclk_freq = snd_hdac_get_display_clk(azx_bus(chip)); -- switch (cdclk_freq) { -- case 337500: -- bclk_m = 16; -- bclk_n = 225; -- break; -- -- case 450000: -- default: /* default CDCLK 450MHz */ -- bclk_m = 4; -- bclk_n = 75; -- break; -- -- case 540000: -- bclk_m = 4; -- bclk_n = 90; -- break; -- -- case 675000: -- bclk_m = 8; -- bclk_n = 225; -- break; -- } -- -- azx_writew(chip, HSW_EM4, bclk_m); -- azx_writew(chip, HSW_EM5, bclk_n); --} -- - #if defined(CONFIG_PM_SLEEP) || defined(SUPPORT_VGA_SWITCHEROO) - /* - * power management -@@ -958,7 +914,7 @@ static int azx_resume(struct device *dev) - if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL - && hda->need_i915_power) { - snd_hdac_display_power(azx_bus(chip), true); -- haswell_set_bclk(hda); -+ snd_hdac_i915_set_bclk(azx_bus(chip)); - } - if (chip->msi) - if (pci_enable_msi(pci) < 0) -@@ -1058,7 +1014,7 @@ static int azx_runtime_resume(struct device *dev) - bus = azx_bus(chip); - if (hda->need_i915_power) { - snd_hdac_display_power(bus, true); -- haswell_set_bclk(hda); -+ snd_hdac_i915_set_bclk(bus); - } else { - /* toggle codec wakeup bit for STATESTS read */ - snd_hdac_set_codec_wakeup(bus, true); -@@ -1796,12 +1752,8 @@ static int azx_first_init(struct azx *chip) - /* initialize chip */ - azx_init_pci(chip); - -- if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) { -- struct hda_intel *hda; -- -- hda = container_of(chip, struct hda_intel, chip); -- haswell_set_bclk(hda); -- } -+ if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) -+ snd_hdac_i915_set_bclk(bus); - - hda_intel_init_chip(chip, (probe_only[dev] & 2) == 0); - -@@ -2232,6 +2184,9 @@ static const struct pci_device_id azx_ids[] = { - /* Broxton-P(Apollolake) */ - { PCI_DEVICE(0x8086, 0x5a98), - .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON }, -+ /* Broxton-T */ -+ { PCI_DEVICE(0x8086, 0x1a98), -+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON }, - /* Haswell */ - { PCI_DEVICE(0x8086, 0x0a0c), - .driver_data = AZX_DRIVER_HDMI | AZX_DCAPS_INTEL_HASWELL }, -diff --git a/sound/pci/hda/hda_sysfs.c b/sound/pci/hda/hda_sysfs.c -index 64e0d1d81ca5..9739fce9e032 100644 ---- a/sound/pci/hda/hda_sysfs.c -+++ b/sound/pci/hda/hda_sysfs.c -@@ -141,14 +141,6 @@ static int reconfig_codec(struct hda_codec *codec) - err = snd_hda_codec_configure(codec); - if (err < 0) - goto error; -- /* rebuild PCMs */ -- err = snd_hda_codec_build_pcms(codec); -- if (err < 0) -- goto error; -- /* rebuild mixers */ -- err = snd_hda_codec_build_controls(codec); -- if (err < 0) -- goto error; - err = snd_card_register(codec->card); - error: - snd_hda_power_down(codec); -diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c -index c1c855a6c0af..80bbadc83721 100644 ---- a/sound/pci/hda/patch_cirrus.c -+++ b/sound/pci/hda/patch_cirrus.c -@@ -174,8 +174,12 @@ static void cs_automute(struct hda_codec *codec) - snd_hda_gen_update_outputs(codec); - - if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) { -- spec->gpio_data = spec->gen.hp_jack_present ? -- spec->gpio_eapd_hp : spec->gpio_eapd_speaker; -+ if (spec->gen.automute_speaker) -+ spec->gpio_data = spec->gen.hp_jack_present ? -+ spec->gpio_eapd_hp : spec->gpio_eapd_speaker; -+ else -+ spec->gpio_data = -+ spec->gpio_eapd_hp | spec->gpio_eapd_speaker; - snd_hda_codec_write(codec, 0x01, 0, - AC_VERB_SET_GPIO_DATA, spec->gpio_data); - } -@@ -357,6 +361,7 @@ static int cs_parse_auto_config(struct hda_codec *codec) + static int +-rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned int nr_pages) ++rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) { - struct cs_spec *spec = codec->spec; - int err; -+ int i; - - err = snd_hda_parse_pin_defcfg(codec, &spec->gen.autocfg, NULL, 0); - if (err < 0) -@@ -366,6 +371,19 @@ static int cs_parse_auto_config(struct hda_codec *codec) - if (err < 0) - return err; - -+ /* keep the ADCs powered up when it's dynamically switchable */ -+ if (spec->gen.dyn_adc_switch) { -+ unsigned int done = 0; -+ for (i = 0; i < spec->gen.input_mux.num_items; i++) { -+ int idx = spec->gen.dyn_adc_idx[i]; -+ if (done & (1 << idx)) -+ continue; -+ snd_hda_gen_fix_pin_power(codec, -+ spec->gen.adc_nids[idx]); -+ done |= 1 << idx; -+ } -+ } -+ - return 0; - } + struct list_head *tail_page, *to_remove, *next_page; + struct buffer_page *to_remove_page, *tmp_iter_page; + struct buffer_page *last_page, *first_page; +- unsigned int nr_removed; ++ unsigned long nr_removed; + unsigned long head_bit; + int page_entries; -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index 6122b8ca872f..56fefbd85782 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -204,8 +204,13 @@ static void cx_auto_reboot_notify(struct hda_codec *codec) +@@ -1642,7 +1643,7 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, + int cpu_id) { - struct conexant_spec *spec = codec->spec; + struct ring_buffer_per_cpu *cpu_buffer; +- unsigned nr_pages; ++ unsigned long nr_pages; + int cpu, err = 0; -- if (codec->core.vendor_id != 0x14f150f2) -+ switch (codec->core.vendor_id) { -+ case 0x14f150f2: /* CX20722 */ -+ case 0x14f150f4: /* CX20724 */ -+ break; -+ default: - return; -+ } + /* +@@ -1656,14 +1657,13 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, + !cpumask_test_cpu(cpu_id, buffer->cpumask)) + return size; - /* Turn the CX20722 codec into D3 to avoid spurious noises - from the internal speaker during (and after) reboot */ -diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c -index bcbc4ee10130..c98e404afbe0 100644 ---- a/sound/pci/hda/patch_hdmi.c -+++ b/sound/pci/hda/patch_hdmi.c -@@ -152,13 +152,17 @@ struct hdmi_spec { - struct hda_pcm_stream pcm_playback; - - /* i915/powerwell (Haswell+/Valleyview+) specific */ -+ bool use_acomp_notifier; /* use i915 eld_notify callback for hotplug */ - struct i915_audio_component_audio_ops i915_audio_ops; - bool i915_bound; /* was i915 bound in this driver? */ - }; +- size = DIV_ROUND_UP(size, BUF_PAGE_SIZE); +- size *= BUF_PAGE_SIZE; ++ nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); - #ifdef CONFIG_SND_HDA_I915 --#define codec_has_acomp(codec) \ -- ((codec)->bus->core.audio_component != NULL) -+static inline bool codec_has_acomp(struct hda_codec *codec) -+{ -+ struct hdmi_spec *spec = codec->spec; -+ return spec->use_acomp_notifier; -+} - #else - #define codec_has_acomp(codec) false - #endif -@@ -1562,6 +1566,7 @@ static void update_eld(struct hda_codec *codec, - eld->eld_size) != 0) - eld_changed = true; - -+ pin_eld->monitor_present = eld->monitor_present; - pin_eld->eld_valid = eld->eld_valid; - pin_eld->eld_size = eld->eld_size; - if (eld->eld_valid) -@@ -1618,6 +1623,8 @@ static bool hdmi_present_sense_via_verbs(struct hdmi_spec_per_pin *per_pin, - - mutex_lock(&per_pin->lock); - pin_eld->monitor_present = !!(present & AC_PINSENSE_PRESENCE); -+ eld->monitor_present = pin_eld->monitor_present; -+ - if (pin_eld->monitor_present) - eld->eld_valid = !!(present & AC_PINSENSE_ELDV); - else -@@ -1665,11 +1672,10 @@ static void sync_eld_via_acomp(struct hda_codec *codec, - int size; - - mutex_lock(&per_pin->lock); -+ eld->monitor_present = false; - size = snd_hdac_acomp_get_eld(&codec->bus->core, per_pin->pin_nid, - &eld->monitor_present, eld->eld_buffer, - ELD_MAX_SIZE); -- if (size < 0) -- goto unlock; - if (size > 0) { - size = min(size, ELD_MAX_SIZE); - if (snd_hdmi_parse_eld(codec, &eld->info, -@@ -1873,7 +1879,8 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo, - - /* Call sync_audio_rate to set the N/CTS/M manually if necessary */ - /* Todo: add DP1.2 MST audio support later */ -- snd_hdac_sync_audio_rate(&codec->bus->core, pin_nid, runtime->rate); -+ if (codec_has_acomp(codec)) -+ snd_hdac_sync_audio_rate(&codec->bus->core, pin_nid, runtime->rate); - - non_pcm = check_non_pcm_per_cvt(codec, cvt_nid); - mutex_lock(&per_pin->lock); -@@ -2432,6 +2439,10 @@ static void intel_pin_eld_notify(void *audio_ptr, int port) - struct hda_codec *codec = audio_ptr; - int pin_nid = port + 0x04; - -+ /* we assume only from port-B to port-D */ -+ if (port < 1 || port > 3) -+ return; -+ - /* skip notification during system suspend (but not in runtime PM); - * the state will be updated at resume - */ -@@ -2441,6 +2452,7 @@ static void intel_pin_eld_notify(void *audio_ptr, int port) - if (atomic_read(&(codec)->core.in_pm)) - return; + /* we need a minimum of two pages */ +- if (size < BUF_PAGE_SIZE * 2) +- size = BUF_PAGE_SIZE * 2; ++ if (nr_pages < 2) ++ nr_pages = 2; -+ snd_hdac_i915_set_bclk(&codec->bus->core); - check_presence_and_report(codec, pin_nid); - } +- nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); ++ size = nr_pages * BUF_PAGE_SIZE; -@@ -2456,11 +2468,24 @@ static int patch_generic_hdmi(struct hda_codec *codec) - codec->spec = spec; - hdmi_array_init(spec, 4); - -- /* Try to bind with i915 for any Intel codecs (if not done yet) */ -- if (!codec_has_acomp(codec) && -- (codec->core.vendor_id >> 16) == 0x8086) -- if (!snd_hdac_i915_init(&codec->bus->core)) -- spec->i915_bound = true; -+#ifdef CONFIG_SND_HDA_I915 -+ /* Try to bind with i915 for Intel HSW+ codecs (if not done yet) */ -+ if ((codec->core.vendor_id >> 16) == 0x8086 && -+ is_haswell_plus(codec)) { -+#if 0 -+ /* on-demand binding leads to an unbalanced refcount when -+ * both i915 and hda drivers are probed concurrently; -+ * disabled temporarily for now -+ */ -+ if (!codec->bus->core.audio_component) -+ if (!snd_hdac_i915_init(&codec->bus->core)) -+ spec->i915_bound = true; -+#endif -+ /* use i915 audio component notifier for hotplug */ -+ if (codec->bus->core.audio_component) -+ spec->use_acomp_notifier = true; -+ } -+#endif + /* + * Don't succeed if resizing is disabled, as a reader might be +@@ -4640,8 +4640,9 @@ static int rb_cpu_notify(struct notifier_block *self, + struct ring_buffer *buffer = + container_of(self, struct ring_buffer, cpu_notify); + long cpu = (long)hcpu; +- int cpu_i, nr_pages_same; +- unsigned int nr_pages; ++ long nr_pages_same; ++ int cpu_i; ++ unsigned long nr_pages; + + switch (action) { + case CPU_UP_PREPARE: +diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn +index f9e47a70509c..53449a6ff6aa 100644 +--- a/scripts/Makefile.extrawarn ++++ b/scripts/Makefile.extrawarn +@@ -24,6 +24,7 @@ warning-1 += $(call cc-option, -Wmissing-prototypes) + warning-1 += -Wold-style-definition + warning-1 += $(call cc-option, -Wmissing-include-dirs) + warning-1 += $(call cc-option, -Wunused-but-set-variable) ++warning-1 += $(call cc-option, -Wunused-const-variable) + warning-1 += $(call cc-disable-warning, missing-field-initializers) + warning-1 += $(call cc-disable-warning, sign-compare) - if (is_haswell_plus(codec)) { - intel_haswell_enable_all_pins(codec, true); -@@ -3659,6 +3684,7 @@ HDA_CODEC_ENTRY(0x10de0070, "GPU 70 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de0071, "GPU 71 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de0072, "GPU 72 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de007d, "GPU 7d HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de0082, "GPU 82 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de0083, "GPU 83 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI", patch_nvhdmi_2ch), - HDA_CODEC_ENTRY(0x11069f80, "VX900 HDMI/DP", patch_via_hdmi), diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 93d2156b6241..d53c25e7a1c1 100644 +index 4918ffa5ba68..d53c25e7a1c1 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -335,6 +335,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) @@ -31153,44 +3929,7 @@ index 93d2156b6241..d53c25e7a1c1 100644 alc_process_coef_fw(codec, coef0225); msleep(800); val = alc_read_coef_idx(codec, 0x46); -@@ -4759,6 +4774,8 @@ enum { - ALC255_FIXUP_DELL_SPK_NOISE, - ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, - ALC280_FIXUP_HP_HEADSET_MIC, -+ ALC221_FIXUP_HP_FRONT_MIC, -+ ALC292_FIXUP_TPT460, - }; - - static const struct hda_fixup alc269_fixups[] = { -@@ -5401,6 +5418,19 @@ static const struct hda_fixup alc269_fixups[] = { - .chained = true, - .chain_id = ALC269_FIXUP_HEADSET_MIC, - }, -+ [ALC221_FIXUP_HP_FRONT_MIC] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ { 0x19, 0x02a19020 }, /* Front Mic */ -+ { } -+ }, -+ }, -+ [ALC292_FIXUP_TPT460] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc_fixup_tpt440_dock, -+ .chained = true, -+ .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE, -+ }, - }; - - static const struct snd_pci_quirk alc269_fixup_tbl[] = { -@@ -5434,6 +5464,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x0665, "Dell XPS 13", ALC288_FIXUP_DELL_XPS_13), -+ SND_PCI_QUIRK(0x1028, 0x0669, "Dell Optiplex 9020m", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x069a, "Dell Vostro 5480", ALC290_FIXUP_SUBWOOFER_HSJACK), - SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), -@@ -5443,8 +5474,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -5459,8 +5474,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), @@ -31201,42 +3940,7 @@ index 93d2156b6241..d53c25e7a1c1 100644 SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), -@@ -5506,6 +5538,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), - SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), - SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC), -+ SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC), - SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), - SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), - SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), -@@ -5554,8 +5587,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK), - SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK), - SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK), -- SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE), -+ SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460), - SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), -+ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), - SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), - SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), - SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP), -@@ -5566,6 +5600,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x17aa, 0x5034, "Thinkpad T450", ALC292_FIXUP_TPT440_DOCK), - SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK), - SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK), -+ SND_PCI_QUIRK(0x17aa, 0x504a, "ThinkPad X260", ALC292_FIXUP_TPT440_DOCK), - SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE), - SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), - SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K), -@@ -5648,6 +5683,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { - {.id = ALC283_FIXUP_SENSE_COMBO_JACK, .name = "alc283-sense-combo"}, - {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"}, - {.id = ALC292_FIXUP_TPT440, .name = "tpt440"}, -+ {.id = ALC292_FIXUP_TPT460, .name = "tpt460"}, - {} - }; - #define ALC225_STANDARD_PINS \ -@@ -5684,6 +5720,9 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { +@@ -5704,6 +5720,9 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { {0x14, 0x90170110}, {0x21, 0x02211020}), SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, @@ -31246,7 +3950,7 @@ index 93d2156b6241..d53c25e7a1c1 100644 {0x12, 0x90a60140}, {0x14, 0x90170110}, {0x21, 0x02211020}), -@@ -6006,8 +6045,14 @@ static int patch_alc269(struct hda_codec *codec) +@@ -6026,8 +6045,14 @@ static int patch_alc269(struct hda_codec *codec) alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/ break; case 0x10ec0225: @@ -31261,54 +3965,7 @@ index 93d2156b6241..d53c25e7a1c1 100644 } if (snd_hda_codec_read(codec, 0x51, 0, AC_VERB_PARAMETERS, 0) == 0x10ec5505) { -@@ -6405,6 +6450,8 @@ enum { - ALC668_FIXUP_AUTO_MUTE, - ALC668_FIXUP_DELL_DISABLE_AAMIX, - ALC668_FIXUP_DELL_XPS13, -+ ALC662_FIXUP_ASUS_Nx50, -+ ALC668_FIXUP_ASUS_Nx51, - }; - - static const struct hda_fixup alc662_fixups[] = { -@@ -6645,6 +6692,21 @@ static const struct hda_fixup alc662_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc_fixup_bass_chmap, - }, -+ [ALC662_FIXUP_ASUS_Nx50] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc_fixup_auto_mute_via_amp, -+ .chained = true, -+ .chain_id = ALC662_FIXUP_BASS_1A -+ }, -+ [ALC668_FIXUP_ASUS_Nx51] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ {0x1a, 0x90170151}, /* bass speaker */ -+ {} -+ }, -+ .chained = true, -+ .chain_id = ALC662_FIXUP_BASS_CHMAP, -+ }, - }; - - static const struct snd_pci_quirk alc662_fixup_tbl[] = { -@@ -6667,10 +6729,14 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = { - SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800), -- SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A), -+ SND_PCI_QUIRK(0x1043, 0x1080, "Asus UX501VW", ALC668_FIXUP_HEADSET_MODE), -+ SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50), - SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A), -+ SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50), - SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP), - SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16), -+ SND_PCI_QUIRK(0x1043, 0x177d, "ASUS N551", ALC668_FIXUP_ASUS_Nx51), -+ SND_PCI_QUIRK(0x1043, 0x17bd, "ASUS N751", ALC668_FIXUP_ASUS_Nx51), - SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16), - SND_PCI_QUIRK(0x1043, 0x1bf3, "ASUS N76VZ", ALC662_FIXUP_BASS_MODE4_CHMAP), - SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT), -@@ -6901,6 +6967,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { +@@ -6942,6 +6967,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { HDA_CODEC_ENTRY(0x10ec0225, "ALC225", patch_alc269), HDA_CODEC_ENTRY(0x10ec0231, "ALC231", patch_alc269), HDA_CODEC_ENTRY(0x10ec0233, "ALC233", patch_alc269), @@ -31316,7 +3973,7 @@ index 93d2156b6241..d53c25e7a1c1 100644 HDA_CODEC_ENTRY(0x10ec0235, "ALC233", patch_alc269), HDA_CODEC_ENTRY(0x10ec0255, "ALC255", patch_alc269), HDA_CODEC_ENTRY(0x10ec0256, "ALC256", patch_alc269), -@@ -6911,6 +6978,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { +@@ -6952,6 +6978,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { HDA_CODEC_ENTRY(0x10ec0269, "ALC269", patch_alc269), HDA_CODEC_ENTRY(0x10ec0270, "ALC270", patch_alc269), HDA_CODEC_ENTRY(0x10ec0272, "ALC272", patch_alc662), @@ -31324,7 +3981,7 @@ index 93d2156b6241..d53c25e7a1c1 100644 HDA_CODEC_ENTRY(0x10ec0275, "ALC275", patch_alc269), HDA_CODEC_ENTRY(0x10ec0276, "ALC276", patch_alc269), HDA_CODEC_ENTRY(0x10ec0280, "ALC280", patch_alc269), -@@ -6923,6 +6991,8 @@ static const struct hda_device_id snd_hda_id_realtek[] = { +@@ -6964,6 +6991,8 @@ static const struct hda_device_id snd_hda_id_realtek[] = { HDA_CODEC_ENTRY(0x10ec0290, "ALC290", patch_alc269), HDA_CODEC_ENTRY(0x10ec0292, "ALC292", patch_alc269), HDA_CODEC_ENTRY(0x10ec0293, "ALC293", patch_alc269), @@ -31333,860 +3990,3 @@ index 93d2156b6241..d53c25e7a1c1 100644 HDA_CODEC_ENTRY(0x10ec0298, "ALC298", patch_alc269), HDA_CODEC_REV_ENTRY(0x10ec0861, 0x100340, "ALC660", patch_alc861), HDA_CODEC_ENTRY(0x10ec0660, "ALC660-VD", patch_alc861vd), -diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c -index 42bcbac801a3..ccdab29a8b66 100644 ---- a/sound/pci/intel8x0.c -+++ b/sound/pci/intel8x0.c -@@ -2879,6 +2879,7 @@ static void intel8x0_measure_ac97_clock(struct intel8x0 *chip) - - static struct snd_pci_quirk intel8x0_clock_list[] = { - SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000), -+ SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000), - SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100), - SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000), - SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000), -diff --git a/sound/pci/pcxhr/pcxhr_core.c b/sound/pci/pcxhr/pcxhr_core.c -index c5194f5b150a..d7e71f309299 100644 ---- a/sound/pci/pcxhr/pcxhr_core.c -+++ b/sound/pci/pcxhr/pcxhr_core.c -@@ -1341,5 +1341,6 @@ irqreturn_t pcxhr_threaded_irq(int irq, void *dev_id) - } - - pcxhr_msg_thread(mgr); -+ mutex_unlock(&mgr->lock); - return IRQ_HANDLED; - } -diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c -index 11d032cdc658..48dbb2fdeb09 100644 ---- a/sound/soc/codecs/rt5640.c -+++ b/sound/soc/codecs/rt5640.c -@@ -359,7 +359,7 @@ static const DECLARE_TLV_DB_RANGE(bst_tlv, - - /* Interface data select */ - static const char * const rt5640_data_select[] = { -- "Normal", "left copy to right", "right copy to left", "Swap"}; -+ "Normal", "Swap", "left copy to right", "right copy to left"}; - - static SOC_ENUM_SINGLE_DECL(rt5640_if1_dac_enum, RT5640_DIG_INF_DATA, - RT5640_IF1_DAC_SEL_SFT, rt5640_data_select); -diff --git a/sound/soc/codecs/rt5640.h b/sound/soc/codecs/rt5640.h -index 83a7150ddc24..f84231e7d1dd 100644 ---- a/sound/soc/codecs/rt5640.h -+++ b/sound/soc/codecs/rt5640.h -@@ -442,39 +442,39 @@ - #define RT5640_IF1_DAC_SEL_MASK (0x3 << 14) - #define RT5640_IF1_DAC_SEL_SFT 14 - #define RT5640_IF1_DAC_SEL_NOR (0x0 << 14) --#define RT5640_IF1_DAC_SEL_L2R (0x1 << 14) --#define RT5640_IF1_DAC_SEL_R2L (0x2 << 14) --#define RT5640_IF1_DAC_SEL_SWAP (0x3 << 14) -+#define RT5640_IF1_DAC_SEL_SWAP (0x1 << 14) -+#define RT5640_IF1_DAC_SEL_L2R (0x2 << 14) -+#define RT5640_IF1_DAC_SEL_R2L (0x3 << 14) - #define RT5640_IF1_ADC_SEL_MASK (0x3 << 12) - #define RT5640_IF1_ADC_SEL_SFT 12 - #define RT5640_IF1_ADC_SEL_NOR (0x0 << 12) --#define RT5640_IF1_ADC_SEL_L2R (0x1 << 12) --#define RT5640_IF1_ADC_SEL_R2L (0x2 << 12) --#define RT5640_IF1_ADC_SEL_SWAP (0x3 << 12) -+#define RT5640_IF1_ADC_SEL_SWAP (0x1 << 12) -+#define RT5640_IF1_ADC_SEL_L2R (0x2 << 12) -+#define RT5640_IF1_ADC_SEL_R2L (0x3 << 12) - #define RT5640_IF2_DAC_SEL_MASK (0x3 << 10) - #define RT5640_IF2_DAC_SEL_SFT 10 - #define RT5640_IF2_DAC_SEL_NOR (0x0 << 10) --#define RT5640_IF2_DAC_SEL_L2R (0x1 << 10) --#define RT5640_IF2_DAC_SEL_R2L (0x2 << 10) --#define RT5640_IF2_DAC_SEL_SWAP (0x3 << 10) -+#define RT5640_IF2_DAC_SEL_SWAP (0x1 << 10) -+#define RT5640_IF2_DAC_SEL_L2R (0x2 << 10) -+#define RT5640_IF2_DAC_SEL_R2L (0x3 << 10) - #define RT5640_IF2_ADC_SEL_MASK (0x3 << 8) - #define RT5640_IF2_ADC_SEL_SFT 8 - #define RT5640_IF2_ADC_SEL_NOR (0x0 << 8) --#define RT5640_IF2_ADC_SEL_L2R (0x1 << 8) --#define RT5640_IF2_ADC_SEL_R2L (0x2 << 8) --#define RT5640_IF2_ADC_SEL_SWAP (0x3 << 8) -+#define RT5640_IF2_ADC_SEL_SWAP (0x1 << 8) -+#define RT5640_IF2_ADC_SEL_L2R (0x2 << 8) -+#define RT5640_IF2_ADC_SEL_R2L (0x3 << 8) - #define RT5640_IF3_DAC_SEL_MASK (0x3 << 6) - #define RT5640_IF3_DAC_SEL_SFT 6 - #define RT5640_IF3_DAC_SEL_NOR (0x0 << 6) --#define RT5640_IF3_DAC_SEL_L2R (0x1 << 6) --#define RT5640_IF3_DAC_SEL_R2L (0x2 << 6) --#define RT5640_IF3_DAC_SEL_SWAP (0x3 << 6) -+#define RT5640_IF3_DAC_SEL_SWAP (0x1 << 6) -+#define RT5640_IF3_DAC_SEL_L2R (0x2 << 6) -+#define RT5640_IF3_DAC_SEL_R2L (0x3 << 6) - #define RT5640_IF3_ADC_SEL_MASK (0x3 << 4) - #define RT5640_IF3_ADC_SEL_SFT 4 - #define RT5640_IF3_ADC_SEL_NOR (0x0 << 4) --#define RT5640_IF3_ADC_SEL_L2R (0x1 << 4) --#define RT5640_IF3_ADC_SEL_R2L (0x2 << 4) --#define RT5640_IF3_ADC_SEL_SWAP (0x3 << 4) -+#define RT5640_IF3_ADC_SEL_SWAP (0x1 << 4) -+#define RT5640_IF3_ADC_SEL_L2R (0x2 << 4) -+#define RT5640_IF3_ADC_SEL_R2L (0x3 << 4) - - /* REC Left Mixer Control 1 (0x3b) */ - #define RT5640_G_HP_L_RM_L_MASK (0x7 << 13) -diff --git a/sound/soc/codecs/ssm4567.c b/sound/soc/codecs/ssm4567.c -index e619d5651b09..080c78e88e10 100644 ---- a/sound/soc/codecs/ssm4567.c -+++ b/sound/soc/codecs/ssm4567.c -@@ -352,6 +352,11 @@ static int ssm4567_set_power(struct ssm4567 *ssm4567, bool enable) - regcache_cache_only(ssm4567->regmap, !enable); - - if (enable) { -+ ret = regmap_write(ssm4567->regmap, SSM4567_REG_SOFT_RESET, -+ 0x00); -+ if (ret) -+ return ret; -+ - ret = regmap_update_bits(ssm4567->regmap, - SSM4567_REG_POWER_CTRL, - SSM4567_POWER_SPWDN, 0x00); -diff --git a/sound/soc/samsung/s3c-i2s-v2.c b/sound/soc/samsung/s3c-i2s-v2.c -index df65c5b494b1..b6ab3fc5789e 100644 ---- a/sound/soc/samsung/s3c-i2s-v2.c -+++ b/sound/soc/samsung/s3c-i2s-v2.c -@@ -709,7 +709,7 @@ static int s3c2412_i2s_resume(struct snd_soc_dai *dai) - #endif - - int s3c_i2sv2_register_component(struct device *dev, int id, -- struct snd_soc_component_driver *cmp_drv, -+ const struct snd_soc_component_driver *cmp_drv, - struct snd_soc_dai_driver *dai_drv) - { - struct snd_soc_dai_ops *ops = (struct snd_soc_dai_ops *)dai_drv->ops; -diff --git a/sound/soc/samsung/s3c-i2s-v2.h b/sound/soc/samsung/s3c-i2s-v2.h -index 90abab364b49..d0684145ed1f 100644 ---- a/sound/soc/samsung/s3c-i2s-v2.h -+++ b/sound/soc/samsung/s3c-i2s-v2.h -@@ -101,7 +101,7 @@ extern int s3c_i2sv2_probe(struct snd_soc_dai *dai, - * soc core. - */ - extern int s3c_i2sv2_register_component(struct device *dev, int id, -- struct snd_soc_component_driver *cmp_drv, -+ const struct snd_soc_component_driver *cmp_drv, - struct snd_soc_dai_driver *dai_drv); - - #endif /* __SND_SOC_S3C24XX_S3C_I2SV2_I2S_H */ -diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c -index 581175a51ecf..5e811dc02fb9 100644 ---- a/sound/soc/soc-dapm.c -+++ b/sound/soc/soc-dapm.c -@@ -2188,6 +2188,13 @@ static ssize_t dapm_widget_show_component(struct snd_soc_component *cmpnt, - int count = 0; - char *state = "not set"; - -+ /* card won't be set for the dummy component, as a spot fix -+ * we're checking for that case specifically here but in future -+ * we will ensure that the dummy component looks like others. -+ */ -+ if (!cmpnt->card) -+ return 0; -+ - list_for_each_entry(w, &cmpnt->card->widgets, list) { - if (w->dapm != dapm) - continue; -diff --git a/sound/usb/clock.c b/sound/usb/clock.c -index 2ed260b10f6d..7ccbcaf6a147 100644 ---- a/sound/usb/clock.c -+++ b/sound/usb/clock.c -@@ -285,6 +285,8 @@ static int set_sample_rate_v1(struct snd_usb_audio *chip, int iface, - unsigned char data[3]; - int err, crate; - -+ if (get_iface_desc(alts)->bNumEndpoints < 1) -+ return -EINVAL; - ep = get_endpoint(alts, 0)->bEndpointAddress; - - /* if endpoint doesn't have sampling rate control, bail out */ -diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c -index 7b1cb365ffab..c07a7eda42a2 100644 ---- a/sound/usb/endpoint.c -+++ b/sound/usb/endpoint.c -@@ -438,6 +438,9 @@ exit_clear: - * - * New endpoints will be added to chip->ep_list and must be freed by - * calling snd_usb_endpoint_free(). -+ * -+ * For SND_USB_ENDPOINT_TYPE_SYNC, the caller needs to guarantee that -+ * bNumEndpoints > 1 beforehand. - */ - struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip, - struct usb_host_interface *alts, -diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c -index ddca6547399b..1f8fb0d904e0 100644 ---- a/sound/usb/mixer_maps.c -+++ b/sound/usb/mixer_maps.c -@@ -349,6 +349,16 @@ static struct usbmix_name_map bose_companion5_map[] = { - }; - - /* -+ * Dell usb dock with ALC4020 codec had a firmware problem where it got -+ * screwed up when zero volume is passed; just skip it as a workaround -+ */ -+static const struct usbmix_name_map dell_alc4020_map[] = { -+ { 16, NULL }, -+ { 19, NULL }, -+ { 0 } -+}; -+ -+/* - * Control map entries - */ - -@@ -431,6 +441,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { - .map = aureon_51_2_map, - }, - { -+ .id = USB_ID(0x0bda, 0x4014), -+ .map = dell_alc4020_map, -+ }, -+ { - .id = USB_ID(0x0dba, 0x1000), - .map = mbox1_map, - }, -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index 279025650568..f6c3bf79af9a 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -1519,7 +1519,11 @@ static int snd_microii_spdif_default_get(struct snd_kcontrol *kcontrol, - - /* use known values for that card: interface#1 altsetting#1 */ - iface = usb_ifnum_to_if(chip->dev, 1); -+ if (!iface || iface->num_altsetting < 2) -+ return -EINVAL; - alts = &iface->altsetting[1]; -+ if (get_iface_desc(alts)->bNumEndpoints < 1) -+ return -EINVAL; - ep = get_endpoint(alts, 0)->bEndpointAddress; - - err = snd_usb_ctl_msg(chip->dev, -diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c -index 9245f52d43bd..44d178ee9177 100644 ---- a/sound/usb/pcm.c -+++ b/sound/usb/pcm.c -@@ -159,6 +159,8 @@ static int init_pitch_v1(struct snd_usb_audio *chip, int iface, - unsigned char data[1]; - int err; - -+ if (get_iface_desc(alts)->bNumEndpoints < 1) -+ return -EINVAL; - ep = get_endpoint(alts, 0)->bEndpointAddress; - - data[0] = 1; -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index c458d60d5030..db11ecf0b74d 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -150,6 +150,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, - usb_audio_err(chip, "cannot memdup\n"); - return -ENOMEM; - } -+ INIT_LIST_HEAD(&fp->list); - if (fp->nr_rates > MAX_NR_RATES) { - kfree(fp); - return -EINVAL; -@@ -167,19 +168,20 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, - stream = (fp->endpoint & USB_DIR_IN) - ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK; - err = snd_usb_add_audio_stream(chip, stream, fp); -- if (err < 0) { -- kfree(fp); -- kfree(rate_table); -- return err; -- } -+ if (err < 0) -+ goto error; - if (fp->iface != get_iface_desc(&iface->altsetting[0])->bInterfaceNumber || - fp->altset_idx >= iface->num_altsetting) { -- kfree(fp); -- kfree(rate_table); -- return -EINVAL; -+ err = -EINVAL; -+ goto error; - } - alts = &iface->altsetting[fp->altset_idx]; - altsd = get_iface_desc(alts); -+ if (altsd->bNumEndpoints < 1) { -+ err = -EINVAL; -+ goto error; -+ } -+ - fp->protocol = altsd->bInterfaceProtocol; - - if (fp->datainterval == 0) -@@ -190,6 +192,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, - snd_usb_init_pitch(chip, fp->iface, alts, fp); - snd_usb_init_sample_rate(chip, fp->iface, alts, fp, fp->rate_max); - return 0; -+ -+ error: -+ list_del(&fp->list); /* unlink for avoiding double-free */ -+ kfree(fp); -+ kfree(rate_table); -+ return err; - } - - static int create_auto_pcm_quirk(struct snd_usb_audio *chip, -@@ -462,6 +470,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip, - fp->ep_attr = get_endpoint(alts, 0)->bmAttributes; - fp->datainterval = 0; - fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize); -+ INIT_LIST_HEAD(&fp->list); - - switch (fp->maxpacksize) { - case 0x120: -@@ -485,6 +494,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip, - ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK; - err = snd_usb_add_audio_stream(chip, stream, fp); - if (err < 0) { -+ list_del(&fp->list); /* unlink for avoiding double-free */ - kfree(fp); - return err; - } -@@ -1121,12 +1131,18 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) - switch (chip->usb_id) { - case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema */ - case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */ -+ case USB_ID(0x045E, 0x076E): /* MS Lifecam HD-5001 */ - case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */ - case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */ - case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */ -+ case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */ - case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */ - case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ -+ case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */ - case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ -+ case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */ -+ case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */ -+ case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */ - case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */ - return true; - } -diff --git a/sound/usb/stream.c b/sound/usb/stream.c -index c4dc577ab1bd..8e9548bc1f1a 100644 ---- a/sound/usb/stream.c -+++ b/sound/usb/stream.c -@@ -314,7 +314,9 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits, - /* - * add this endpoint to the chip instance. - * if a stream with the same endpoint already exists, append to it. -- * if not, create a new pcm stream. -+ * if not, create a new pcm stream. note, fp is added to the substream -+ * fmt_list and will be freed on the chip instance release. do not free -+ * fp or do remove it from the substream fmt_list to avoid double-free. - */ - int snd_usb_add_audio_stream(struct snd_usb_audio *chip, - int stream, -@@ -675,6 +677,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no) - * (fp->maxpacksize & 0x7ff); - fp->attributes = parse_uac_endpoint_attributes(chip, alts, protocol, iface_no); - fp->clock = clock; -+ INIT_LIST_HEAD(&fp->list); - - /* some quirks for attributes here */ - -@@ -723,6 +726,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no) - dev_dbg(&dev->dev, "%u:%d: add audio endpoint %#x\n", iface_no, altno, fp->endpoint); - err = snd_usb_add_audio_stream(chip, stream, fp); - if (err < 0) { -+ list_del(&fp->list); /* unlink for avoiding double-free */ - kfree(fp->rate_table); - kfree(fp->chmap); - kfree(fp); -diff --git a/tools/hv/Makefile b/tools/hv/Makefile -index a8ab79556926..a8c4644022a6 100644 ---- a/tools/hv/Makefile -+++ b/tools/hv/Makefile -@@ -5,6 +5,8 @@ PTHREAD_LIBS = -lpthread - WARNINGS = -Wall -Wextra - CFLAGS = $(WARNINGS) -g $(PTHREAD_LIBS) $(shell getconf LFS_CFLAGS) - -+CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include -+ - all: hv_kvp_daemon hv_vss_daemon hv_fcopy_daemon - %: %.c - $(CC) $(CFLAGS) -o $@ $^ -diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c -index 0144b3d1bb77..88cccea3ca99 100644 ---- a/tools/lib/traceevent/parse-filter.c -+++ b/tools/lib/traceevent/parse-filter.c -@@ -1164,11 +1164,11 @@ process_filter(struct event_format *event, struct filter_arg **parg, - current_op = current_exp; - - ret = collapse_tree(current_op, parg, error_str); -+ /* collapse_tree() may free current_op, and updates parg accordingly */ -+ current_op = NULL; - if (ret < 0) - goto fail; - -- *parg = current_op; -- - free(token); - return 0; - -diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt -index 52ef7a9d50aa..14d9e8ffaff7 100644 ---- a/tools/perf/Documentation/perf-stat.txt -+++ b/tools/perf/Documentation/perf-stat.txt -@@ -69,6 +69,14 @@ report:: - --scale:: - scale/normalize counter values - -+-d:: -+--detailed:: -+ print more detailed statistics, can be specified up to 3 times -+ -+ -d: detailed events, L1 and LLC data cache -+ -d -d: more detailed events, dTLB and iTLB events -+ -d -d -d: very detailed events, adding prefetch events -+ - -r:: - --repeat=:: - repeat command and print average + stddev (max: 100). 0 means forever. -diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c -index 08c09ad755d2..7bb47424bc49 100644 ---- a/tools/perf/ui/browsers/hists.c -+++ b/tools/perf/ui/browsers/hists.c -@@ -302,7 +302,7 @@ static void callchain_node__init_have_children(struct callchain_node *node, - chain = list_entry(node->val.next, struct callchain_list, list); - chain->has_children = has_sibling; - -- if (node->val.next != node->val.prev) { -+ if (!list_empty(&node->val)) { - chain = list_entry(node->val.prev, struct callchain_list, list); - chain->has_children = !RB_EMPTY_ROOT(&node->rb_root); - } -@@ -844,7 +844,7 @@ next: - return row - first_row; - } - --static int hist_browser__show_callchain(struct hist_browser *browser, -+static int hist_browser__show_callchain_graph(struct hist_browser *browser, - struct rb_root *root, int level, - unsigned short row, u64 total, - print_callchain_entry_fn print, -@@ -898,7 +898,7 @@ static int hist_browser__show_callchain(struct hist_browser *browser, - else - new_total = total; - -- row += hist_browser__show_callchain(browser, &child->rb_root, -+ row += hist_browser__show_callchain_graph(browser, &child->rb_root, - new_level, row, new_total, - print, arg, is_output_full); - } -@@ -910,6 +910,43 @@ out: - return row - first_row; - } - -+static int hist_browser__show_callchain(struct hist_browser *browser, -+ struct hist_entry *entry, int level, -+ unsigned short row, -+ print_callchain_entry_fn print, -+ struct callchain_print_arg *arg, -+ check_output_full_fn is_output_full) -+{ -+ u64 total = hists__total_period(entry->hists); -+ int printed; -+ -+ if (callchain_param.mode == CHAIN_GRAPH_REL) { -+ if (symbol_conf.cumulate_callchain) -+ total = entry->stat_acc->period; -+ else -+ total = entry->stat.period; -+ } -+ -+ if (callchain_param.mode == CHAIN_FLAT) { -+ printed = hist_browser__show_callchain_flat(browser, -+ &entry->sorted_chain, row, total, -+ print, arg, is_output_full); -+ } else if (callchain_param.mode == CHAIN_FOLDED) { -+ printed = hist_browser__show_callchain_folded(browser, -+ &entry->sorted_chain, row, total, -+ print, arg, is_output_full); -+ } else { -+ printed = hist_browser__show_callchain_graph(browser, -+ &entry->sorted_chain, level, row, total, -+ print, arg, is_output_full); -+ } -+ -+ if (arg->is_current_entry) -+ browser->he_selection = entry; -+ -+ return printed; -+} -+ - struct hpp_arg { - struct ui_browser *b; - char folded_sign; -@@ -1084,38 +1121,14 @@ static int hist_browser__show_entry(struct hist_browser *browser, - --row_offset; - - if (folded_sign == '-' && row != browser->b.rows) { -- u64 total = hists__total_period(entry->hists); - struct callchain_print_arg arg = { - .row_offset = row_offset, - .is_current_entry = current_entry, - }; - -- if (callchain_param.mode == CHAIN_GRAPH_REL) { -- if (symbol_conf.cumulate_callchain) -- total = entry->stat_acc->period; -- else -- total = entry->stat.period; -- } -- -- if (callchain_param.mode == CHAIN_FLAT) { -- printed += hist_browser__show_callchain_flat(browser, -- &entry->sorted_chain, row, total, -+ printed += hist_browser__show_callchain(browser, entry, 1, row, - hist_browser__show_callchain_entry, &arg, - hist_browser__check_output_full); -- } else if (callchain_param.mode == CHAIN_FOLDED) { -- printed += hist_browser__show_callchain_folded(browser, -- &entry->sorted_chain, row, total, -- hist_browser__show_callchain_entry, &arg, -- hist_browser__check_output_full); -- } else { -- printed += hist_browser__show_callchain(browser, -- &entry->sorted_chain, 1, row, total, -- hist_browser__show_callchain_entry, &arg, -- hist_browser__check_output_full); -- } -- -- if (arg.is_current_entry) -- browser->he_selection = entry; - } - - return printed; -@@ -1380,15 +1393,11 @@ do_offset: - static int hist_browser__fprintf_callchain(struct hist_browser *browser, - struct hist_entry *he, FILE *fp) - { -- u64 total = hists__total_period(he->hists); - struct callchain_print_arg arg = { - .fp = fp, - }; - -- if (symbol_conf.cumulate_callchain) -- total = he->stat_acc->period; -- -- hist_browser__show_callchain(browser, &he->sorted_chain, 1, 0, total, -+ hist_browser__show_callchain(browser, he, 1, 0, - hist_browser__fprintf_callchain_entry, &arg, - hist_browser__check_dump_full); - return arg.printed; -@@ -2320,10 +2329,12 @@ skip_annotation: - * - * See hist_browser__show_entry. - */ -- nr_options += add_script_opt(browser, -- &actions[nr_options], -- &options[nr_options], -- NULL, browser->selection->sym); -+ if (sort__has_sym && browser->selection->sym) { -+ nr_options += add_script_opt(browser, -+ &actions[nr_options], -+ &options[nr_options], -+ NULL, browser->selection->sym); -+ } - } - nr_options += add_script_opt(browser, &actions[nr_options], - &options[nr_options], NULL, NULL); -diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c -index 85155e91b61b..7bad5c3fa7b7 100644 ---- a/tools/perf/util/event.c -+++ b/tools/perf/util/event.c -@@ -282,7 +282,7 @@ int perf_event__synthesize_mmap_events(struct perf_tool *tool, - strcpy(execname, ""); - - /* 00400000-0040c000 r-xp 00000000 fd:01 41038 /bin/cat */ -- n = sscanf(bf, "%"PRIx64"-%"PRIx64" %s %"PRIx64" %x:%x %u %s\n", -+ n = sscanf(bf, "%"PRIx64"-%"PRIx64" %s %"PRIx64" %x:%x %u %[^\n]\n", - &event->mmap2.start, &event->mmap2.len, prot, - &event->mmap2.pgoff, &event->mmap2.maj, - &event->mmap2.min, -diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c -index d81f13de2476..a7eb0eae9938 100644 ---- a/tools/perf/util/evlist.c -+++ b/tools/perf/util/evlist.c -@@ -1181,12 +1181,12 @@ void perf_evlist__set_maps(struct perf_evlist *evlist, struct cpu_map *cpus, - */ - if (cpus != evlist->cpus) { - cpu_map__put(evlist->cpus); -- evlist->cpus = cpus; -+ evlist->cpus = cpu_map__get(cpus); - } - - if (threads != evlist->threads) { - thread_map__put(evlist->threads); -- evlist->threads = threads; -+ evlist->threads = thread_map__get(threads); - } - - perf_evlist__propagate_maps(evlist); -diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h -index 8e75434bd01c..4d8037a3d8a4 100644 ---- a/tools/perf/util/evsel.h -+++ b/tools/perf/util/evsel.h -@@ -93,10 +93,8 @@ struct perf_evsel { - const char *unit; - struct event_format *tp_format; - off_t id_offset; -- union { -- void *priv; -- u64 db_id; -- }; -+ void *priv; -+ u64 db_id; - struct cgroup_sel *cgrp; - void *handler; - struct cpu_map *cpus; -diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c -index 05d815851be1..4e1590ba8902 100644 ---- a/tools/perf/util/intel-pt.c -+++ b/tools/perf/util/intel-pt.c -@@ -1127,7 +1127,7 @@ static int intel_pt_synth_transaction_sample(struct intel_pt_queue *ptq) - pr_err("Intel Processor Trace: failed to deliver transaction event, error %d\n", - ret); - -- if (pt->synth_opts.callchain) -+ if (pt->synth_opts.last_branch) - intel_pt_reset_last_branch_rb(ptq); - - return ret; -diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c -index 813d9b272c81..48a1c5e7dc0d 100644 ---- a/tools/perf/util/parse-events.c -+++ b/tools/perf/util/parse-events.c -@@ -2101,11 +2101,11 @@ char *parse_events_formats_error_string(char *additional_terms) - - /* valid terms */ - if (additional_terms) { -- if (!asprintf(&str, "valid terms: %s,%s", -- additional_terms, static_terms)) -+ if (asprintf(&str, "valid terms: %s,%s", -+ additional_terms, static_terms) < 0) - goto fail; - } else { -- if (!asprintf(&str, "valid terms: %s", static_terms)) -+ if (asprintf(&str, "valid terms: %s", static_terms) < 0) - goto fail; - } - return str; -diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c -index b597bcc8fc78..37b4f5070353 100644 ---- a/tools/perf/util/pmu.c -+++ b/tools/perf/util/pmu.c -@@ -284,13 +284,12 @@ static int pmu_aliases_parse(char *dir, struct list_head *head) - { - struct dirent *evt_ent; - DIR *event_dir; -- int ret = 0; - - event_dir = opendir(dir); - if (!event_dir) - return -EINVAL; - -- while (!ret && (evt_ent = readdir(event_dir))) { -+ while ((evt_ent = readdir(event_dir))) { - char path[PATH_MAX]; - char *name = evt_ent->d_name; - FILE *file; -@@ -306,17 +305,19 @@ static int pmu_aliases_parse(char *dir, struct list_head *head) - - snprintf(path, PATH_MAX, "%s/%s", dir, name); - -- ret = -EINVAL; - file = fopen(path, "r"); -- if (!file) -- break; -+ if (!file) { -+ pr_debug("Cannot open %s\n", path); -+ continue; -+ } - -- ret = perf_pmu__new_alias(head, dir, name, file); -+ if (perf_pmu__new_alias(head, dir, name, file) < 0) -+ pr_debug("Cannot set up %s\n", name); - fclose(file); - } - - closedir(event_dir); -- return ret; -+ return 0; - } - - /* -diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py -index 1833103768cb..c8680984d2d6 100644 ---- a/tools/perf/util/setup.py -+++ b/tools/perf/util/setup.py -@@ -22,6 +22,7 @@ cflags = getenv('CFLAGS', '').split() - # switch off several checks (need to be at the end of cflags list) - cflags += ['-fno-strict-aliasing', '-Wno-write-strings', '-Wno-unused-parameter' ] - -+src_perf = getenv('srctree') + '/tools/perf' - build_lib = getenv('PYTHON_EXTBUILD_LIB') - build_tmp = getenv('PYTHON_EXTBUILD_TMP') - libtraceevent = getenv('LIBTRACEEVENT') -@@ -30,6 +31,9 @@ libapikfs = getenv('LIBAPI') - ext_sources = [f.strip() for f in file('util/python-ext-sources') - if len(f.strip()) > 0 and f[0] != '#'] - -+# use full paths with source files -+ext_sources = map(lambda x: '%s/%s' % (src_perf, x) , ext_sources) -+ - perf = Extension('perf', - sources = ext_sources, - include_dirs = ['util/include'], -diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c -index ec722346e6ff..16892a7ca27e 100644 ---- a/tools/perf/util/sort.c -+++ b/tools/perf/util/sort.c -@@ -2272,6 +2272,9 @@ static char *prefix_if_not_in(const char *pre, char *str) - - static char *setup_overhead(char *keys) - { -+ if (sort__mode == SORT_MODE__DIFF) -+ return keys; -+ - keys = prefix_if_not_in("overhead", keys); - - if (symbol_conf.cumulate_callchain) -diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c -index ea6064696fe4..a7b9022b5c8f 100644 ---- a/virt/kvm/arm/arch_timer.c -+++ b/virt/kvm/arm/arch_timer.c -@@ -86,6 +86,8 @@ static void kvm_timer_inject_irq_work(struct work_struct *work) - vcpu = container_of(work, struct kvm_vcpu, arch.timer_cpu.expired); - vcpu->arch.timer_cpu.armed = false; - -+ WARN_ON(!kvm_timer_should_fire(vcpu)); -+ - /* - * If the vcpu is blocked we want to wake it up so that it will see - * the timer has expired when entering the guest. -@@ -93,10 +95,46 @@ static void kvm_timer_inject_irq_work(struct work_struct *work) - kvm_vcpu_kick(vcpu); - } - -+static u64 kvm_timer_compute_delta(struct kvm_vcpu *vcpu) -+{ -+ cycle_t cval, now; -+ -+ cval = vcpu->arch.timer_cpu.cntv_cval; -+ now = kvm_phys_timer_read() - vcpu->kvm->arch.timer.cntvoff; -+ -+ if (now < cval) { -+ u64 ns; -+ -+ ns = cyclecounter_cyc2ns(timecounter->cc, -+ cval - now, -+ timecounter->mask, -+ &timecounter->frac); -+ return ns; -+ } -+ -+ return 0; -+} -+ - static enum hrtimer_restart kvm_timer_expire(struct hrtimer *hrt) - { - struct arch_timer_cpu *timer; -+ struct kvm_vcpu *vcpu; -+ u64 ns; -+ - timer = container_of(hrt, struct arch_timer_cpu, timer); -+ vcpu = container_of(timer, struct kvm_vcpu, arch.timer_cpu); -+ -+ /* -+ * Check that the timer has really expired from the guest's -+ * PoV (NTP on the host may have forced it to expire -+ * early). If we should have slept longer, restart it. -+ */ -+ ns = kvm_timer_compute_delta(vcpu); -+ if (unlikely(ns)) { -+ hrtimer_forward_now(hrt, ns_to_ktime(ns)); -+ return HRTIMER_RESTART; -+ } -+ - queue_work(wqueue, &timer->expired); - return HRTIMER_NORESTART; - } -@@ -170,8 +208,6 @@ static int kvm_timer_update_state(struct kvm_vcpu *vcpu) - void kvm_timer_schedule(struct kvm_vcpu *vcpu) - { - struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu; -- u64 ns; -- cycle_t cval, now; - - BUG_ON(timer_is_armed(timer)); - -@@ -191,14 +227,7 @@ void kvm_timer_schedule(struct kvm_vcpu *vcpu) - return; - - /* The timer has not yet expired, schedule a background timer */ -- cval = timer->cntv_cval; -- now = kvm_phys_timer_read() - vcpu->kvm->arch.timer.cntvoff; -- -- ns = cyclecounter_cyc2ns(timecounter->cc, -- cval - now, -- timecounter->mask, -- &timecounter->frac); -- timer_arm(timer, ns); -+ timer_arm(timer, kvm_timer_compute_delta(vcpu)); - } - - void kvm_timer_unschedule(struct kvm_vcpu *vcpu) -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index 9102ae172d2a..298473707f17 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -537,6 +537,16 @@ static struct kvm *kvm_create_vm(unsigned long type) - if (!kvm) - return ERR_PTR(-ENOMEM); - -+ spin_lock_init(&kvm->mmu_lock); -+ atomic_inc(¤t->mm->mm_count); -+ kvm->mm = current->mm; -+ kvm_eventfd_init(kvm); -+ mutex_init(&kvm->lock); -+ mutex_init(&kvm->irq_lock); -+ mutex_init(&kvm->slots_lock); -+ atomic_set(&kvm->users_count, 1); -+ INIT_LIST_HEAD(&kvm->devices); -+ - r = kvm_arch_init_vm(kvm, type); - if (r) - goto out_err_no_disable; -@@ -569,16 +579,6 @@ static struct kvm *kvm_create_vm(unsigned long type) - goto out_err; - } - -- spin_lock_init(&kvm->mmu_lock); -- kvm->mm = current->mm; -- atomic_inc(&kvm->mm->mm_count); -- kvm_eventfd_init(kvm); -- mutex_init(&kvm->lock); -- mutex_init(&kvm->irq_lock); -- mutex_init(&kvm->slots_lock); -- atomic_set(&kvm->users_count, 1); -- INIT_LIST_HEAD(&kvm->devices); -- - r = kvm_init_mmu_notifier(kvm); - if (r) - goto out_err; -@@ -603,6 +603,7 @@ out_err_no_disable: - for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) - kvm_free_memslots(kvm, kvm->memslots[i]); - kvm_arch_free_vm(kvm); -+ mmdrop(current->mm); - return ERR_PTR(r); - } -