diff options
| author |   Anthony G. Basile <blueness@gentoo.org> | 2014-11-23 08:22:19 -0500 |
|---|---|---|
| committer | Anthony G. Basile <blueness@gentoo.org> | 2014-11-23 08:22:19 -0500 |
| commit | 15afc830247f64793abdbf9549d38b2e2e202ea2 (patch) | |
| tree | 7d3a66d42ef5e2ca847938d273f7671d8844a63f | |
| parent | Grsec/PaX: 3.0-{3.2.64,3.14.24,3.17.2}-201411150027 (diff) | |
| download | hardened-patchset-15afc830247f64793abdbf9549d38b2e2e202ea2.tar.gz hardened-patchset-15afc830247f64793abdbf9549d38b2e2e202ea2.tar.bz2 hardened-patchset-15afc830247f64793abdbf9549d38b2e2e202ea2.zip | |
Grsec/PaX: 3.0-{3.2.64,3.14.25,3.17.4}-201411220955
| -rw-r--r-- | 3.14.24/1023_linux-3.14.24.patch | 7091 | ||||
| -rw-r--r-- | 3.14.25/0000_README (renamed from 3.17.3/0000_README) | 6 | ||||
| -rw-r--r-- | 3.14.25/4420_grsecurity-3.0-3.14.25-201411220954.patch (renamed from 3.14.24/4420_grsecurity-3.0-3.14.24-201411150026.patch) | 1104 | ||||
| -rw-r--r-- | 3.14.25/4425_grsec_remove_EI_PAX.patch (renamed from 3.14.24/4425_grsec_remove_EI_PAX.patch) | 0 | ||||
| -rw-r--r-- | 3.14.25/4427_force_XATTR_PAX_tmpfs.patch (renamed from 3.14.24/4427_force_XATTR_PAX_tmpfs.patch) | 0 | ||||
| -rw-r--r-- | 3.14.25/4430_grsec-remove-localversion-grsec.patch (renamed from 3.14.24/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 3.14.25/4435_grsec-mute-warnings.patch (renamed from 3.14.24/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 3.14.25/4440_grsec-remove-protected-paths.patch (renamed from 3.14.24/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 3.14.25/4450_grsec-kconfig-default-gids.patch (renamed from 3.14.24/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 3.14.25/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 3.14.24/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 3.14.25/4470_disable-compat_vdso.patch (renamed from 3.14.24/4470_disable-compat_vdso.patch) | 0 | ||||
| -rw-r--r-- | 3.14.25/4475_emutramp_default_on.patch (renamed from 3.14.24/4475_emutramp_default_on.patch) | 0 | ||||
| -rw-r--r-- | 3.17.3/1002_linux-3.17.3.patch | 11840 | ||||
| -rw-r--r-- | 3.17.4/0000_README (renamed from 3.14.24/0000_README) | 6 | ||||
| -rw-r--r-- | 3.17.4/4420_grsecurity-3.0-3.17.4-201411220955.patch (renamed from 3.17.3/4420_grsecurity-3.0-3.17.3-201411150027.patch) | 1207 | ||||
| -rw-r--r-- | 3.17.4/4425_grsec_remove_EI_PAX.patch (renamed from 3.17.3/4425_grsec_remove_EI_PAX.patch) | 0 | ||||
| -rw-r--r-- | 3.17.4/4427_force_XATTR_PAX_tmpfs.patch (renamed from 3.17.3/4427_force_XATTR_PAX_tmpfs.patch) | 0 | ||||
| -rw-r--r-- | 3.17.4/4430_grsec-remove-localversion-grsec.patch (renamed from 3.17.3/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 3.17.4/4435_grsec-mute-warnings.patch (renamed from 3.17.3/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 3.17.4/4440_grsec-remove-protected-paths.patch (renamed from 3.17.3/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 3.17.4/4450_grsec-kconfig-default-gids.patch (renamed from 3.17.3/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 3.17.4/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 3.17.3/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 3.17.4/4470_disable-compat_vdso.patch (renamed from 3.17.3/4470_disable-compat_vdso.patch) | 0 | ||||
| -rw-r--r-- | 3.17.4/4475_emutramp_default_on.patch (renamed from 3.17.3/4475_emutramp_default_on.patch) | 0 | ||||
| -rw-r--r-- | 3.2.64/0000_README | 2 | ||||
| -rw-r--r-- | 3.2.64/4420_grsecurity-3.0-3.2.64-201411220952.patch (renamed from 3.2.64/4420_grsecurity-3.0-3.2.64-201411150025.patch) | 21 |
26 files changed, 392 insertions, 20885 deletions
diff --git a/3.14.24/1023_linux-3.14.24.patch b/3.14.24/1023_linux-3.14.24.patch deleted file mode 100644 index 5c63dd5..0000000 --- a/3.14.24/1023_linux-3.14.24.patch +++ /dev/null @@ -1,7091 +0,0 @@ -diff --git a/Makefile b/Makefile -index 135a04a..8fd0610 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 23 -+SUBLEVEL = 24 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts -index 4f31b2e..398064c 100644 ---- a/arch/arc/boot/dts/nsimosci.dts -+++ b/arch/arc/boot/dts/nsimosci.dts -@@ -20,7 +20,7 @@ - /* this is for console on PGU */ - /* bootargs = "console=tty0 consoleblank=0"; */ - /* this is for console on serial */ -- bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=ttyS0,115200n8 consoleblank=0 debug"; -+ bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug"; - }; - - aliases { -diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h -index 2fd3162..c1d3d2d 100644 ---- a/arch/arc/include/asm/cache.h -+++ b/arch/arc/include/asm/cache.h -@@ -55,4 +55,31 @@ extern void read_decode_cache_bcr(void); - - #endif /* !__ASSEMBLY__ */ - -+/* Instruction cache related Auxiliary registers */ -+#define ARC_REG_IC_BCR 0x77 /* Build Config reg */ -+#define ARC_REG_IC_IVIC 0x10 -+#define ARC_REG_IC_CTRL 0x11 -+#define ARC_REG_IC_IVIL 0x19 -+#if defined(CONFIG_ARC_MMU_V3) || defined (CONFIG_ARC_MMU_V4) -+#define ARC_REG_IC_PTAG 0x1E -+#endif -+ -+/* Bit val in IC_CTRL */ -+#define IC_CTRL_CACHE_DISABLE 0x1 -+ -+/* Data cache related Auxiliary registers */ -+#define ARC_REG_DC_BCR 0x72 /* Build Config reg */ -+#define ARC_REG_DC_IVDC 0x47 -+#define ARC_REG_DC_CTRL 0x48 -+#define ARC_REG_DC_IVDL 0x4A -+#define ARC_REG_DC_FLSH 0x4B -+#define ARC_REG_DC_FLDL 0x4C -+#if defined(CONFIG_ARC_MMU_V3) || defined (CONFIG_ARC_MMU_V4) -+#define ARC_REG_DC_PTAG 0x5C -+#endif -+ -+/* Bit val in DC_CTRL */ -+#define DC_CTRL_INV_MODE_FLUSH 0x40 -+#define DC_CTRL_FLUSH_STATUS 0x100 -+ - #endif /* _ASM_CACHE_H */ -diff --git a/arch/arc/include/asm/kgdb.h b/arch/arc/include/asm/kgdb.h -index b65fca7..fea9316 100644 ---- a/arch/arc/include/asm/kgdb.h -+++ b/arch/arc/include/asm/kgdb.h -@@ -19,7 +19,7 @@ - * register API yet */ - #undef DBG_MAX_REG_NUM - --#define GDB_MAX_REGS 39 -+#define GDB_MAX_REGS 87 - - #define BREAK_INSTR_SIZE 2 - #define CACHE_FLUSH_IS_SAFE 1 -@@ -33,23 +33,27 @@ static inline void arch_kgdb_breakpoint(void) - - extern void kgdb_trap(struct pt_regs *regs); - --enum arc700_linux_regnums { -+/* This is the numbering of registers according to the GDB. See GDB's -+ * arc-tdep.h for details. -+ * -+ * Registers are ordered for GDB 7.5. It is incompatible with GDB 6.8. */ -+enum arc_linux_regnums { - _R0 = 0, - _R1, _R2, _R3, _R4, _R5, _R6, _R7, _R8, _R9, _R10, _R11, _R12, _R13, - _R14, _R15, _R16, _R17, _R18, _R19, _R20, _R21, _R22, _R23, _R24, - _R25, _R26, -- _BTA = 27, -- _LP_START = 28, -- _LP_END = 29, -- _LP_COUNT = 30, -- _STATUS32 = 31, -- _BLINK = 32, -- _FP = 33, -- __SP = 34, -- _EFA = 35, -- _RET = 36, -- _ORIG_R8 = 37, -- _STOP_PC = 38 -+ _FP = 27, -+ __SP = 28, -+ _R30 = 30, -+ _BLINK = 31, -+ _LP_COUNT = 60, -+ _STOP_PC = 64, -+ _RET = 64, -+ _LP_START = 65, -+ _LP_END = 66, -+ _STATUS32 = 67, -+ _ECR = 76, -+ _BTA = 82, - }; - - #else -diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S -index 9919972..07a58f2 100644 ---- a/arch/arc/kernel/head.S -+++ b/arch/arc/kernel/head.S -@@ -12,10 +12,42 @@ - * to skip certain things during boot on simulator - */ - -+#include <linux/linkage.h> - #include <asm/asm-offsets.h> - #include <asm/entry.h> --#include <linux/linkage.h> - #include <asm/arcregs.h> -+#include <asm/cache.h> -+ -+.macro CPU_EARLY_SETUP -+ -+ ; Setting up Vectror Table (in case exception happens in early boot -+ sr @_int_vec_base_lds, [AUX_INTR_VEC_BASE] -+ -+ ; Disable I-cache/D-cache if kernel so configured -+ lr r5, [ARC_REG_IC_BCR] -+ breq r5, 0, 1f ; I$ doesn't exist -+ lr r5, [ARC_REG_IC_CTRL] -+#ifdef CONFIG_ARC_HAS_ICACHE -+ bclr r5, r5, 0 ; 0 - Enable, 1 is Disable -+#else -+ bset r5, r5, 0 ; I$ exists, but is not used -+#endif -+ sr r5, [ARC_REG_IC_CTRL] -+ -+1: -+ lr r5, [ARC_REG_DC_BCR] -+ breq r5, 0, 1f ; D$ doesn't exist -+ lr r5, [ARC_REG_DC_CTRL] -+ bclr r5, r5, 6 ; Invalidate (discard w/o wback) -+#ifdef CONFIG_ARC_HAS_DCACHE -+ bclr r5, r5, 0 ; Enable (+Inv) -+#else -+ bset r5, r5, 0 ; Disable (+Inv) -+#endif -+ sr r5, [ARC_REG_DC_CTRL] -+ -+1: -+.endm - - .cpu A7 - -@@ -24,13 +56,13 @@ - .globl stext - stext: - ;------------------------------------------------------------------- -- ; Don't clobber r0-r4 yet. It might have bootloader provided info -+ ; Don't clobber r0-r2 yet. It might have bootloader provided info - ;------------------------------------------------------------------- - -- sr @_int_vec_base_lds, [AUX_INTR_VEC_BASE] -+ CPU_EARLY_SETUP - - #ifdef CONFIG_SMP -- ; Only Boot (Master) proceeds. Others wait in platform dependent way -+ ; Ensure Boot (Master) proceeds. Others wait in platform dependent way - ; IDENTITY Reg [ 3 2 1 0 ] - ; (cpu-id) ^^^ => Zero for UP ARC700 - ; => #Core-ID if SMP (Master 0) -@@ -39,7 +71,8 @@ stext: - ; need to make sure only boot cpu takes this path. - GET_CPU_ID r5 - cmp r5, 0 -- jnz arc_platform_smp_wait_to_boot -+ mov.ne r0, r5 -+ jne arc_platform_smp_wait_to_boot - #endif - ; Clear BSS before updating any globals - ; XXX: use ZOL here -@@ -89,7 +122,7 @@ stext: - - first_lines_of_secondary: - -- sr @_int_vec_base_lds, [AUX_INTR_VEC_BASE] -+ CPU_EARLY_SETUP - - ; setup per-cpu idle task as "current" on this CPU - ld r0, [@secondary_idle_tsk] -diff --git a/arch/arc/mm/cache_arc700.c b/arch/arc/mm/cache_arc700.c -index 400c663..1f676c4 100644 ---- a/arch/arc/mm/cache_arc700.c -+++ b/arch/arc/mm/cache_arc700.c -@@ -73,37 +73,9 @@ - #include <asm/cachectl.h> - #include <asm/setup.h> - --/* Instruction cache related Auxiliary registers */ --#define ARC_REG_IC_BCR 0x77 /* Build Config reg */ --#define ARC_REG_IC_IVIC 0x10 --#define ARC_REG_IC_CTRL 0x11 --#define ARC_REG_IC_IVIL 0x19 --#if (CONFIG_ARC_MMU_VER > 2) --#define ARC_REG_IC_PTAG 0x1E --#endif -- --/* Bit val in IC_CTRL */ --#define IC_CTRL_CACHE_DISABLE 0x1 -- --/* Data cache related Auxiliary registers */ --#define ARC_REG_DC_BCR 0x72 /* Build Config reg */ --#define ARC_REG_DC_IVDC 0x47 --#define ARC_REG_DC_CTRL 0x48 --#define ARC_REG_DC_IVDL 0x4A --#define ARC_REG_DC_FLSH 0x4B --#define ARC_REG_DC_FLDL 0x4C --#if (CONFIG_ARC_MMU_VER > 2) --#define ARC_REG_DC_PTAG 0x5C --#endif -- --/* Bit val in DC_CTRL */ --#define DC_CTRL_INV_MODE_FLUSH 0x40 --#define DC_CTRL_FLUSH_STATUS 0x100 -- --char *arc_cache_mumbojumbo(int cpu_id, char *buf, int len) -+char *arc_cache_mumbojumbo(int c, char *buf, int len) - { - int n = 0; -- unsigned int c = smp_processor_id(); - - #define PR_CACHE(p, enb, str) \ - { \ -@@ -169,72 +141,43 @@ void read_decode_cache_bcr(void) - */ - void arc_cache_init(void) - { -- unsigned int cpu = smp_processor_id(); -- struct cpuinfo_arc_cache *ic = &cpuinfo_arc700[cpu].icache; -- struct cpuinfo_arc_cache *dc = &cpuinfo_arc700[cpu].dcache; -- unsigned int dcache_does_alias, temp; -+ unsigned int __maybe_unused cpu = smp_processor_id(); -+ struct cpuinfo_arc_cache __maybe_unused *ic, __maybe_unused *dc; - char str[256]; - - printk(arc_cache_mumbojumbo(0, str, sizeof(str))); - -- if (!ic->ver) -- goto chk_dc; -- --#ifdef CONFIG_ARC_HAS_ICACHE -- /* 1. Confirm some of I-cache params which Linux assumes */ -- if (ic->line_len != L1_CACHE_BYTES) -- panic("Cache H/W doesn't match kernel Config"); -- -- if (ic->ver != CONFIG_ARC_MMU_VER) -- panic("Cache ver doesn't match MMU ver\n"); --#endif -- -- /* Enable/disable I-Cache */ -- temp = read_aux_reg(ARC_REG_IC_CTRL); -- - #ifdef CONFIG_ARC_HAS_ICACHE -- temp &= ~IC_CTRL_CACHE_DISABLE; --#else -- temp |= IC_CTRL_CACHE_DISABLE; -+ ic = &cpuinfo_arc700[cpu].icache; -+ if (ic->ver) { -+ if (ic->line_len != L1_CACHE_BYTES) -+ panic("ICache line [%d] != kernel Config [%d]", -+ ic->line_len, L1_CACHE_BYTES); -+ -+ if (ic->ver != CONFIG_ARC_MMU_VER) -+ panic("Cache ver [%d] doesn't match MMU ver [%d]\n", -+ ic->ver, CONFIG_ARC_MMU_VER); -+ } - #endif - -- write_aux_reg(ARC_REG_IC_CTRL, temp); -- --chk_dc: -- if (!dc->ver) -- return; -- - #ifdef CONFIG_ARC_HAS_DCACHE -- if (dc->line_len != L1_CACHE_BYTES) -- panic("Cache H/W doesn't match kernel Config"); -+ dc = &cpuinfo_arc700[cpu].dcache; -+ if (dc->ver) { -+ unsigned int dcache_does_alias; - -- /* check for D-Cache aliasing */ -- dcache_does_alias = (dc->sz / dc->assoc) > PAGE_SIZE; -+ if (dc->line_len != L1_CACHE_BYTES) -+ panic("DCache line [%d] != kernel Config [%d]", -+ dc->line_len, L1_CACHE_BYTES); - -- if (dcache_does_alias && !cache_is_vipt_aliasing()) -- panic("Enable CONFIG_ARC_CACHE_VIPT_ALIASING\n"); -- else if (!dcache_does_alias && cache_is_vipt_aliasing()) -- panic("Don't need CONFIG_ARC_CACHE_VIPT_ALIASING\n"); --#endif -- -- /* Set the default Invalidate Mode to "simpy discard dirty lines" -- * as this is more frequent then flush before invalidate -- * Ofcourse we toggle this default behviour when desired -- */ -- temp = read_aux_reg(ARC_REG_DC_CTRL); -- temp &= ~DC_CTRL_INV_MODE_FLUSH; -+ /* check for D-Cache aliasing */ -+ dcache_does_alias = (dc->sz / dc->assoc) > PAGE_SIZE; - --#ifdef CONFIG_ARC_HAS_DCACHE -- /* Enable D-Cache: Clear Bit 0 */ -- write_aux_reg(ARC_REG_DC_CTRL, temp & ~IC_CTRL_CACHE_DISABLE); --#else -- /* Flush D cache */ -- write_aux_reg(ARC_REG_DC_FLSH, 0x1); -- /* Disable D cache */ -- write_aux_reg(ARC_REG_DC_CTRL, temp | IC_CTRL_CACHE_DISABLE); -+ if (dcache_does_alias && !cache_is_vipt_aliasing()) -+ panic("Enable CONFIG_ARC_CACHE_VIPT_ALIASING\n"); -+ else if (!dcache_does_alias && cache_is_vipt_aliasing()) -+ panic("Don't need CONFIG_ARC_CACHE_VIPT_ALIASING\n"); -+ } - #endif -- -- return; - } - - #define OP_INV 0x1 -@@ -254,12 +197,16 @@ static inline void __cache_line_loop(unsigned long paddr, unsigned long vaddr, - - if (cacheop == OP_INV_IC) { - aux_cmd = ARC_REG_IC_IVIL; -+#if (CONFIG_ARC_MMU_VER > 2) - aux_tag = ARC_REG_IC_PTAG; -+#endif - } - else { - /* d$ cmd: INV (discard or wback-n-discard) OR FLUSH (wback) */ - aux_cmd = cacheop & OP_INV ? ARC_REG_DC_IVDL : ARC_REG_DC_FLDL; -+#if (CONFIG_ARC_MMU_VER > 2) - aux_tag = ARC_REG_DC_PTAG; -+#endif - } - - /* Ensure we properly floor/ceil the non-line aligned/sized requests -diff --git a/arch/mips/include/asm/ftrace.h b/arch/mips/include/asm/ftrace.h -index 992aaba..b463f2a 100644 ---- a/arch/mips/include/asm/ftrace.h -+++ b/arch/mips/include/asm/ftrace.h -@@ -24,7 +24,7 @@ do { \ - asm volatile ( \ - "1: " load " %[tmp_dst], 0(%[tmp_src])\n" \ - " li %[tmp_err], 0\n" \ -- "2:\n" \ -+ "2: .insn\n" \ - \ - ".section .fixup, \"ax\"\n" \ - "3: li %[tmp_err], 1\n" \ -@@ -46,7 +46,7 @@ do { \ - asm volatile ( \ - "1: " store " %[tmp_src], 0(%[tmp_dst])\n"\ - " li %[tmp_err], 0\n" \ -- "2:\n" \ -+ "2: .insn\n" \ - \ - ".section .fixup, \"ax\"\n" \ - "3: li %[tmp_err], 1\n" \ -diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c -index 65d452a..dd012c5 100644 ---- a/arch/mips/mm/tlbex.c -+++ b/arch/mips/mm/tlbex.c -@@ -1057,6 +1057,7 @@ static void build_update_entries(u32 **p, unsigned int tmp, unsigned int ptep) - struct mips_huge_tlb_info { - int huge_pte; - int restore_scratch; -+ bool need_reload_pte; - }; - - static struct mips_huge_tlb_info -@@ -1071,6 +1072,7 @@ build_fast_tlb_refill_handler (u32 **p, struct uasm_label **l, - - rv.huge_pte = scratch; - rv.restore_scratch = 0; -+ rv.need_reload_pte = false; - - if (check_for_high_segbits) { - UASM_i_MFC0(p, tmp, C0_BADVADDR); -@@ -1259,6 +1261,7 @@ static void build_r4000_tlb_refill_handler(void) - } else { - htlb_info.huge_pte = K0; - htlb_info.restore_scratch = 0; -+ htlb_info.need_reload_pte = true; - vmalloc_mode = refill_noscratch; - /* - * create the plain linear handler -@@ -1295,7 +1298,8 @@ static void build_r4000_tlb_refill_handler(void) - } - #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT - uasm_l_tlb_huge_update(&l, p); -- UASM_i_LW(&p, K0, 0, K1); -+ if (htlb_info.need_reload_pte) -+ UASM_i_LW(&p, htlb_info.huge_pte, 0, K1); - build_huge_update_entries(&p, htlb_info.huge_pte, K1); - build_huge_tlb_write_entry(&p, &l, &r, K0, tlb_random, - htlb_info.restore_scratch); -diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c -index a8fe5aa..3b46eed 100644 ---- a/arch/powerpc/platforms/pseries/dlpar.c -+++ b/arch/powerpc/platforms/pseries/dlpar.c -@@ -380,7 +380,7 @@ static int dlpar_online_cpu(struct device_node *dn) - BUG_ON(get_cpu_current_state(cpu) - != CPU_STATE_OFFLINE); - cpu_maps_update_done(); -- rc = cpu_up(cpu); -+ rc = device_online(get_cpu_device(cpu)); - if (rc) - goto out; - cpu_maps_update_begin(); -@@ -463,7 +463,7 @@ static int dlpar_offline_cpu(struct device_node *dn) - if (get_cpu_current_state(cpu) == CPU_STATE_ONLINE) { - set_preferred_offline_state(cpu, CPU_STATE_OFFLINE); - cpu_maps_update_done(); -- rc = cpu_down(cpu); -+ rc = device_offline(get_cpu_device(cpu)); - if (rc) - goto out; - cpu_maps_update_begin(); -diff --git a/arch/sh/kernel/cpu/sh3/setup-sh770x.c b/arch/sh/kernel/cpu/sh3/setup-sh770x.c -index ff1465c..5acf89c 100644 ---- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c -+++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c -@@ -118,7 +118,7 @@ static struct plat_sci_port scif0_platform_data = { - }; - - static struct resource scif0_resources[] = { -- DEFINE_RES_MEM(0xfffffe80, 0x100), -+ DEFINE_RES_MEM(0xfffffe80, 0x10), - DEFINE_RES_IRQ(evt2irq(0x4e0)), - }; - -@@ -143,7 +143,7 @@ static struct plat_sci_port scif1_platform_data = { - }; - - static struct resource scif1_resources[] = { -- DEFINE_RES_MEM(0xa4000150, 0x100), -+ DEFINE_RES_MEM(0xa4000150, 0x10), - DEFINE_RES_IRQ(evt2irq(0x900)), - }; - -@@ -169,7 +169,7 @@ static struct plat_sci_port scif2_platform_data = { - }; - - static struct resource scif2_resources[] = { -- DEFINE_RES_MEM(0xa4000140, 0x100), -+ DEFINE_RES_MEM(0xa4000140, 0x10), - DEFINE_RES_IRQ(evt2irq(0x880)), - }; - -diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c -index 3716e69..e8ab93c 100644 ---- a/arch/um/drivers/ubd_kern.c -+++ b/arch/um/drivers/ubd_kern.c -@@ -1277,7 +1277,7 @@ static void do_ubd_request(struct request_queue *q) - - while(1){ - struct ubd *dev = q->queuedata; -- if(dev->end_sg == 0){ -+ if(dev->request == NULL){ - struct request *req = blk_fetch_request(q); - if(req == NULL) - return; -@@ -1299,7 +1299,8 @@ static void do_ubd_request(struct request_queue *q) - return; - } - prepare_flush_request(req, io_req); -- submit_request(io_req, dev); -+ if (submit_request(io_req, dev) == false) -+ return; - } - - while(dev->start_sg < dev->end_sg){ -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index e409891..98aa930 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -2436,12 +2436,9 @@ config X86_DMA_REMAP - depends on STA2X11 - - config IOSF_MBI -- bool -+ tristate -+ default m - depends on PCI -- ---help--- -- To be selected by modules requiring access to the Intel OnChip System -- Fabric (IOSF) Sideband MailBox Interface (MBI). For MBI platforms -- enumerable by PCI. - - source "net/Kconfig" - -diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S -index 4299eb0..92a2e93 100644 ---- a/arch/x86/ia32/ia32entry.S -+++ b/arch/x86/ia32/ia32entry.S -@@ -151,6 +151,16 @@ ENTRY(ia32_sysenter_target) - 1: movl (%rbp),%ebp - _ASM_EXTABLE(1b,ia32_badarg) - ASM_CLAC -+ -+ /* -+ * Sysenter doesn't filter flags, so we need to clear NT -+ * ourselves. To save a few cycles, we can check whether -+ * NT was set instead of doing an unconditional popfq. -+ */ -+ testl $X86_EFLAGS_NT,EFLAGS-ARGOFFSET(%rsp) -+ jnz sysenter_fix_flags -+sysenter_flags_fixed: -+ - orl $TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET) - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET) - CFI_REMEMBER_STATE -@@ -184,6 +194,8 @@ sysexit_from_sys_call: - TRACE_IRQS_ON - ENABLE_INTERRUPTS_SYSEXIT32 - -+ CFI_RESTORE_STATE -+ - #ifdef CONFIG_AUDITSYSCALL - .macro auditsys_entry_common - movl %esi,%r9d /* 6th arg: 4th syscall arg */ -@@ -226,7 +238,6 @@ sysexit_from_sys_call: - .endm - - sysenter_auditsys: -- CFI_RESTORE_STATE - auditsys_entry_common - movl %ebp,%r9d /* reload 6th syscall arg */ - jmp sysenter_dispatch -@@ -235,6 +246,11 @@ sysexit_audit: - auditsys_exit sysexit_from_sys_call - #endif - -+sysenter_fix_flags: -+ pushq_cfi $(X86_EFLAGS_IF|X86_EFLAGS_FIXED) -+ popfq_cfi -+ jmp sysenter_flags_fixed -+ - sysenter_tracesys: - #ifdef CONFIG_AUDITSYSCALL - testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET) -diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h -index 9c999c1..01f15b2 100644 ---- a/arch/x86/include/asm/elf.h -+++ b/arch/x86/include/asm/elf.h -@@ -155,8 +155,9 @@ do { \ - #define elf_check_arch(x) \ - ((x)->e_machine == EM_X86_64) - --#define compat_elf_check_arch(x) \ -- (elf_check_arch_ia32(x) || (x)->e_machine == EM_X86_64) -+#define compat_elf_check_arch(x) \ -+ (elf_check_arch_ia32(x) || \ -+ (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine == EM_X86_64)) - - #if __USER32_DS != __USER_DS - # error "The following code assumes __USER32_DS == __USER_DS" -diff --git a/arch/x86/include/asm/iosf_mbi.h b/arch/x86/include/asm/iosf_mbi.h -index 8e71c79..57995f0 100644 ---- a/arch/x86/include/asm/iosf_mbi.h -+++ b/arch/x86/include/asm/iosf_mbi.h -@@ -50,6 +50,32 @@ - #define BT_MBI_PCIE_READ 0x00 - #define BT_MBI_PCIE_WRITE 0x01 - -+/* Quark available units */ -+#define QRK_MBI_UNIT_HBA 0x00 -+#define QRK_MBI_UNIT_HB 0x03 -+#define QRK_MBI_UNIT_RMU 0x04 -+#define QRK_MBI_UNIT_MM 0x05 -+#define QRK_MBI_UNIT_MMESRAM 0x05 -+#define QRK_MBI_UNIT_SOC 0x31 -+ -+/* Quark read/write opcodes */ -+#define QRK_MBI_HBA_READ 0x10 -+#define QRK_MBI_HBA_WRITE 0x11 -+#define QRK_MBI_HB_READ 0x10 -+#define QRK_MBI_HB_WRITE 0x11 -+#define QRK_MBI_RMU_READ 0x10 -+#define QRK_MBI_RMU_WRITE 0x11 -+#define QRK_MBI_MM_READ 0x10 -+#define QRK_MBI_MM_WRITE 0x11 -+#define QRK_MBI_MMESRAM_READ 0x12 -+#define QRK_MBI_MMESRAM_WRITE 0x13 -+#define QRK_MBI_SOC_READ 0x06 -+#define QRK_MBI_SOC_WRITE 0x07 -+ -+#if IS_ENABLED(CONFIG_IOSF_MBI) -+ -+bool iosf_mbi_available(void); -+ - /** - * iosf_mbi_read() - MailBox Interface read command - * @port: port indicating subunit being accessed -@@ -87,4 +113,33 @@ int iosf_mbi_write(u8 port, u8 opcode, u32 offset, u32 mdr); - */ - int iosf_mbi_modify(u8 port, u8 opcode, u32 offset, u32 mdr, u32 mask); - -+#else /* CONFIG_IOSF_MBI is not enabled */ -+static inline -+bool iosf_mbi_available(void) -+{ -+ return false; -+} -+ -+static inline -+int iosf_mbi_read(u8 port, u8 opcode, u32 offset, u32 *mdr) -+{ -+ WARN(1, "IOSF_MBI driver not available"); -+ return -EPERM; -+} -+ -+static inline -+int iosf_mbi_write(u8 port, u8 opcode, u32 offset, u32 mdr) -+{ -+ WARN(1, "IOSF_MBI driver not available"); -+ return -EPERM; -+} -+ -+static inline -+int iosf_mbi_modify(u8 port, u8 opcode, u32 offset, u32 mdr, u32 mask) -+{ -+ WARN(1, "IOSF_MBI driver not available"); -+ return -EPERM; -+} -+#endif /* CONFIG_IOSF_MBI */ -+ - #endif /* IOSF_MBI_SYMS_H */ -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index ac63ea4..e9dc029 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -984,6 +984,20 @@ static inline void kvm_inject_gp(struct kvm_vcpu *vcpu, u32 error_code) - kvm_queue_exception_e(vcpu, GP_VECTOR, error_code); - } - -+static inline u64 get_canonical(u64 la) -+{ -+ return ((int64_t)la << 16) >> 16; -+} -+ -+static inline bool is_noncanonical_address(u64 la) -+{ -+#ifdef CONFIG_X86_64 -+ return get_canonical(la) != la; -+#else -+ return false; -+#endif -+} -+ - #define TSS_IOPB_BASE_OFFSET 0x66 - #define TSS_BASE_SIZE 0x68 - #define TSS_IOPB_SIZE (65536 / 8) -@@ -1042,7 +1056,7 @@ int kvm_cpu_get_interrupt(struct kvm_vcpu *v); - void kvm_vcpu_reset(struct kvm_vcpu *vcpu); - - void kvm_define_shared_msr(unsigned index, u32 msr); --void kvm_set_shared_msr(unsigned index, u64 val, u64 mask); -+int kvm_set_shared_msr(unsigned index, u64 val, u64 mask); - - bool kvm_is_linear_rip(struct kvm_vcpu *vcpu, unsigned long linear_rip); - -diff --git a/arch/x86/include/uapi/asm/vmx.h b/arch/x86/include/uapi/asm/vmx.h -index 0e79420..990a2fe 100644 ---- a/arch/x86/include/uapi/asm/vmx.h -+++ b/arch/x86/include/uapi/asm/vmx.h -@@ -67,6 +67,7 @@ - #define EXIT_REASON_EPT_MISCONFIG 49 - #define EXIT_REASON_INVEPT 50 - #define EXIT_REASON_PREEMPTION_TIMER 52 -+#define EXIT_REASON_INVVPID 53 - #define EXIT_REASON_WBINVD 54 - #define EXIT_REASON_XSETBV 55 - #define EXIT_REASON_APIC_WRITE 56 -@@ -114,6 +115,7 @@ - { EXIT_REASON_EOI_INDUCED, "EOI_INDUCED" }, \ - { EXIT_REASON_INVALID_STATE, "INVALID_STATE" }, \ - { EXIT_REASON_INVD, "INVD" }, \ -+ { EXIT_REASON_INVVPID, "INVVPID" }, \ - { EXIT_REASON_INVPCID, "INVPCID" } - - #endif /* _UAPIVMX_H */ -diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c -index 7f26c9a..523f147 100644 ---- a/arch/x86/kernel/apic/apic.c -+++ b/arch/x86/kernel/apic/apic.c -@@ -1290,7 +1290,7 @@ void setup_local_APIC(void) - unsigned int value, queued; - int i, j, acked = 0; - unsigned long long tsc = 0, ntsc; -- long long max_loops = cpu_khz; -+ long long max_loops = cpu_khz ? cpu_khz : 1000000; - - if (cpu_has_tsc) - rdtscll(tsc); -@@ -1387,7 +1387,7 @@ void setup_local_APIC(void) - break; - } - if (queued) { -- if (cpu_has_tsc) { -+ if (cpu_has_tsc && cpu_khz) { - rdtscll(ntsc); - max_loops = (cpu_khz << 10) - (ntsc - tsc); - } else -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index 8e28bf2..3f27f5f 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -1141,7 +1141,7 @@ void syscall_init(void) - /* Flags to clear on syscall */ - wrmsrl(MSR_SYSCALL_MASK, - X86_EFLAGS_TF|X86_EFLAGS_DF|X86_EFLAGS_IF| -- X86_EFLAGS_IOPL|X86_EFLAGS_AC); -+ X86_EFLAGS_IOPL|X86_EFLAGS_AC|X86_EFLAGS_NT); - } - - /* -diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c -index c1a07d3..66746a8 100644 ---- a/arch/x86/kernel/cpu/intel.c -+++ b/arch/x86/kernel/cpu/intel.c -@@ -383,6 +383,13 @@ static void init_intel(struct cpuinfo_x86 *c) - detect_extended_topology(c); - - l2 = init_intel_cacheinfo(c); -+ -+ /* Detect legacy cache sizes if init_intel_cacheinfo did not */ -+ if (l2 == 0) { -+ cpu_detect_cache_sizes(c); -+ l2 = c->x86_cache_size; -+ } -+ - if (c->cpuid_level > 9) { - unsigned eax = cpuid_eax(10); - /* Check for version and the number of counters */ -@@ -497,6 +504,13 @@ static unsigned int intel_size_cache(struct cpuinfo_x86 *c, unsigned int size) - */ - if ((c->x86 == 6) && (c->x86_model == 11) && (size == 0)) - size = 256; -+ -+ /* -+ * Intel Quark SoC X1000 contains a 4-way set associative -+ * 16K cache with a 16 byte cache line and 256 lines per tag -+ */ -+ if ((c->x86 == 5) && (c->x86_model == 9)) -+ size = 16; - return size; - } - #endif -@@ -724,7 +738,8 @@ static const struct cpu_dev intel_cpu_dev = { - [3] = "OverDrive PODP5V83", - [4] = "Pentium MMX", - [7] = "Mobile Pentium 75 - 200", -- [8] = "Mobile Pentium MMX" -+ [8] = "Mobile Pentium MMX", -+ [9] = "Quark SoC X1000", - } - }, - { .family = 6, .model_names = -diff --git a/arch/x86/kernel/iosf_mbi.c b/arch/x86/kernel/iosf_mbi.c -index c3aae66..2e97b3c 100644 ---- a/arch/x86/kernel/iosf_mbi.c -+++ b/arch/x86/kernel/iosf_mbi.c -@@ -25,6 +25,10 @@ - - #include <asm/iosf_mbi.h> - -+#define PCI_DEVICE_ID_BAYTRAIL 0x0F00 -+#define PCI_DEVICE_ID_BRASWELL 0x2280 -+#define PCI_DEVICE_ID_QUARK_X1000 0x0958 -+ - static DEFINE_SPINLOCK(iosf_mbi_lock); - - static inline u32 iosf_mbi_form_mcr(u8 op, u8 port, u8 offset) -@@ -177,6 +181,13 @@ int iosf_mbi_modify(u8 port, u8 opcode, u32 offset, u32 mdr, u32 mask) - } - EXPORT_SYMBOL(iosf_mbi_modify); - -+bool iosf_mbi_available(void) -+{ -+ /* Mbi isn't hot-pluggable. No remove routine is provided */ -+ return mbi_pdev; -+} -+EXPORT_SYMBOL(iosf_mbi_available); -+ - static int iosf_mbi_probe(struct pci_dev *pdev, - const struct pci_device_id *unused) - { -@@ -193,7 +204,9 @@ static int iosf_mbi_probe(struct pci_dev *pdev, - } - - static DEFINE_PCI_DEVICE_TABLE(iosf_mbi_pci_ids) = { -- { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0F00) }, -+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_BAYTRAIL) }, -+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_BRASWELL) }, -+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_QUARK_X1000) }, - { 0, }, - }; - MODULE_DEVICE_TABLE(pci, iosf_mbi_pci_ids); -diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c -index 9e5de68..b88fc86 100644 ---- a/arch/x86/kernel/signal.c -+++ b/arch/x86/kernel/signal.c -@@ -673,6 +673,11 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs) - * handler too. - */ - regs->flags &= ~(X86_EFLAGS_DF|X86_EFLAGS_RF|X86_EFLAGS_TF); -+ /* -+ * Ensure the signal handler starts with the new fpu state. -+ */ -+ if (used_math()) -+ drop_init_fpu(current); - } - signal_setup_done(failed, ksig, test_thread_flag(TIF_SINGLESTEP)); - } -diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c -index e0d1d7a..de02906 100644 ---- a/arch/x86/kernel/tsc.c -+++ b/arch/x86/kernel/tsc.c -@@ -1173,14 +1173,17 @@ void __init tsc_init(void) - - x86_init.timers.tsc_pre_init(); - -- if (!cpu_has_tsc) -+ if (!cpu_has_tsc) { -+ setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER); - return; -+ } - - tsc_khz = x86_platform.calibrate_tsc(); - cpu_khz = tsc_khz; - - if (!tsc_khz) { - mark_tsc_unstable("could not calculate TSC khz"); -+ setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER); - return; - } - -diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c -index a4b451c..dd50e26 100644 ---- a/arch/x86/kernel/xsave.c -+++ b/arch/x86/kernel/xsave.c -@@ -268,8 +268,6 @@ int save_xstate_sig(void __user *buf, void __user *buf_fx, int size) - if (use_fxsr() && save_xstate_epilog(buf_fx, ia32_fxstate)) - return -1; - -- drop_init_fpu(tsk); /* trigger finit */ -- - return 0; - } - -@@ -399,8 +397,11 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size) - set_used_math(); - } - -- if (use_eager_fpu()) -+ if (use_eager_fpu()) { -+ preempt_disable(); - math_state_restore(); -+ preempt_enable(); -+ } - - return err; - } else { -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 7bff3e2..38d3751 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -498,11 +498,6 @@ static void rsp_increment(struct x86_emulate_ctxt *ctxt, int inc) - masked_increment(reg_rmw(ctxt, VCPU_REGS_RSP), stack_mask(ctxt), inc); - } - --static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel) --{ -- register_address_increment(ctxt, &ctxt->_eip, rel); --} -- - static u32 desc_limit_scaled(struct desc_struct *desc) - { - u32 limit = get_desc_limit(desc); -@@ -576,6 +571,38 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt) - return emulate_exception(ctxt, NM_VECTOR, 0, false); - } - -+static inline int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst, -+ int cs_l) -+{ -+ switch (ctxt->op_bytes) { -+ case 2: -+ ctxt->_eip = (u16)dst; -+ break; -+ case 4: -+ ctxt->_eip = (u32)dst; -+ break; -+ case 8: -+ if ((cs_l && is_noncanonical_address(dst)) || -+ (!cs_l && (dst & ~(u32)-1))) -+ return emulate_gp(ctxt, 0); -+ ctxt->_eip = dst; -+ break; -+ default: -+ WARN(1, "unsupported eip assignment size\n"); -+ } -+ return X86EMUL_CONTINUE; -+} -+ -+static inline int assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst) -+{ -+ return assign_eip_far(ctxt, dst, ctxt->mode == X86EMUL_MODE_PROT64); -+} -+ -+static inline int jmp_rel(struct x86_emulate_ctxt *ctxt, int rel) -+{ -+ return assign_eip_near(ctxt, ctxt->_eip + rel); -+} -+ - static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg) - { - u16 selector; -@@ -1958,13 +1985,15 @@ static int em_grp45(struct x86_emulate_ctxt *ctxt) - case 2: /* call near abs */ { - long int old_eip; - old_eip = ctxt->_eip; -- ctxt->_eip = ctxt->src.val; -+ rc = assign_eip_near(ctxt, ctxt->src.val); -+ if (rc != X86EMUL_CONTINUE) -+ break; - ctxt->src.val = old_eip; - rc = em_push(ctxt); - break; - } - case 4: /* jmp abs */ -- ctxt->_eip = ctxt->src.val; -+ rc = assign_eip_near(ctxt, ctxt->src.val); - break; - case 5: /* jmp far */ - rc = em_jmp_far(ctxt); -@@ -1996,10 +2025,14 @@ static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt) - - static int em_ret(struct x86_emulate_ctxt *ctxt) - { -- ctxt->dst.type = OP_REG; -- ctxt->dst.addr.reg = &ctxt->_eip; -- ctxt->dst.bytes = ctxt->op_bytes; -- return em_pop(ctxt); -+ int rc; -+ unsigned long eip; -+ -+ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); -+ if (rc != X86EMUL_CONTINUE) -+ return rc; -+ -+ return assign_eip_near(ctxt, eip); - } - - static int em_ret_far(struct x86_emulate_ctxt *ctxt) -@@ -2277,7 +2310,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) - { - const struct x86_emulate_ops *ops = ctxt->ops; - struct desc_struct cs, ss; -- u64 msr_data; -+ u64 msr_data, rcx, rdx; - int usermode; - u16 cs_sel = 0, ss_sel = 0; - -@@ -2293,6 +2326,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) - else - usermode = X86EMUL_MODE_PROT32; - -+ rcx = reg_read(ctxt, VCPU_REGS_RCX); -+ rdx = reg_read(ctxt, VCPU_REGS_RDX); -+ - cs.dpl = 3; - ss.dpl = 3; - ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data); -@@ -2310,6 +2346,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) - ss_sel = cs_sel + 8; - cs.d = 0; - cs.l = 1; -+ if (is_noncanonical_address(rcx) || -+ is_noncanonical_address(rdx)) -+ return emulate_gp(ctxt, 0); - break; - } - cs_sel |= SELECTOR_RPL_MASK; -@@ -2318,8 +2357,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) - ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS); - ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS); - -- ctxt->_eip = reg_read(ctxt, VCPU_REGS_RDX); -- *reg_write(ctxt, VCPU_REGS_RSP) = reg_read(ctxt, VCPU_REGS_RCX); -+ ctxt->_eip = rdx; -+ *reg_write(ctxt, VCPU_REGS_RSP) = rcx; - - return X86EMUL_CONTINUE; - } -@@ -2858,10 +2897,13 @@ static int em_aad(struct x86_emulate_ctxt *ctxt) - - static int em_call(struct x86_emulate_ctxt *ctxt) - { -+ int rc; - long rel = ctxt->src.val; - - ctxt->src.val = (unsigned long)ctxt->_eip; -- jmp_rel(ctxt, rel); -+ rc = jmp_rel(ctxt, rel); -+ if (rc != X86EMUL_CONTINUE) -+ return rc; - return em_push(ctxt); - } - -@@ -2893,11 +2935,12 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt) - static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt) - { - int rc; -+ unsigned long eip; - -- ctxt->dst.type = OP_REG; -- ctxt->dst.addr.reg = &ctxt->_eip; -- ctxt->dst.bytes = ctxt->op_bytes; -- rc = emulate_pop(ctxt, &ctxt->dst.val, ctxt->op_bytes); -+ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); -+ if (rc != X86EMUL_CONTINUE) -+ return rc; -+ rc = assign_eip_near(ctxt, eip); - if (rc != X86EMUL_CONTINUE) - return rc; - rsp_increment(ctxt, ctxt->src.val); -@@ -3227,20 +3270,24 @@ static int em_lmsw(struct x86_emulate_ctxt *ctxt) - - static int em_loop(struct x86_emulate_ctxt *ctxt) - { -+ int rc = X86EMUL_CONTINUE; -+ - register_address_increment(ctxt, reg_rmw(ctxt, VCPU_REGS_RCX), -1); - if ((address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) != 0) && - (ctxt->b == 0xe2 || test_cc(ctxt->b ^ 0x5, ctxt->eflags))) -- jmp_rel(ctxt, ctxt->src.val); -+ rc = jmp_rel(ctxt, ctxt->src.val); - -- return X86EMUL_CONTINUE; -+ return rc; - } - - static int em_jcxz(struct x86_emulate_ctxt *ctxt) - { -+ int rc = X86EMUL_CONTINUE; -+ - if (address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) == 0) -- jmp_rel(ctxt, ctxt->src.val); -+ rc = jmp_rel(ctxt, ctxt->src.val); - -- return X86EMUL_CONTINUE; -+ return rc; - } - - static int em_in(struct x86_emulate_ctxt *ctxt) -@@ -4637,7 +4684,7 @@ special_insn: - break; - case 0x70 ... 0x7f: /* jcc (short) */ - if (test_cc(ctxt->b, ctxt->eflags)) -- jmp_rel(ctxt, ctxt->src.val); -+ rc = jmp_rel(ctxt, ctxt->src.val); - break; - case 0x8d: /* lea r16/r32, m */ - ctxt->dst.val = ctxt->src.addr.mem.ea; -@@ -4666,7 +4713,7 @@ special_insn: - break; - case 0xe9: /* jmp rel */ - case 0xeb: /* jmp rel short */ -- jmp_rel(ctxt, ctxt->src.val); -+ rc = jmp_rel(ctxt, ctxt->src.val); - ctxt->dst.type = OP_NONE; /* Disable writeback. */ - break; - case 0xf4: /* hlt */ -@@ -4786,7 +4833,7 @@ twobyte_insn: - break; - case 0x80 ... 0x8f: /* jnz rel, etc*/ - if (test_cc(ctxt->b, ctxt->eflags)) -- jmp_rel(ctxt, ctxt->src.val); -+ rc = jmp_rel(ctxt, ctxt->src.val); - break; - case 0x90 ... 0x9f: /* setcc r/m8 */ - ctxt->dst.val = test_cc(ctxt->b, ctxt->eflags); -diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c -index 518d864..298781d 100644 ---- a/arch/x86/kvm/i8254.c -+++ b/arch/x86/kvm/i8254.c -@@ -262,8 +262,10 @@ void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu) - return; - - timer = &pit->pit_state.timer; -+ mutex_lock(&pit->pit_state.lock); - if (hrtimer_cancel(timer)) - hrtimer_start_expires(timer, HRTIMER_MODE_ABS); -+ mutex_unlock(&pit->pit_state.lock); - } - - static void destroy_pit_timer(struct kvm_pit *pit) -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index 2de1bc0..9643eda6 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -3213,7 +3213,7 @@ static int wrmsr_interception(struct vcpu_svm *svm) - msr.host_initiated = false; - - svm->next_rip = kvm_rip_read(&svm->vcpu) + 2; -- if (svm_set_msr(&svm->vcpu, &msr)) { -+ if (kvm_set_msr(&svm->vcpu, &msr)) { - trace_kvm_msr_write_ex(ecx, data); - kvm_inject_gp(&svm->vcpu, 0); - } else { -@@ -3495,9 +3495,9 @@ static int handle_exit(struct kvm_vcpu *vcpu) - - if (exit_code >= ARRAY_SIZE(svm_exit_handlers) - || !svm_exit_handlers[exit_code]) { -- kvm_run->exit_reason = KVM_EXIT_UNKNOWN; -- kvm_run->hw.hardware_exit_reason = exit_code; -- return 0; -+ WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_code); -+ kvm_queue_exception(vcpu, UD_VECTOR); -+ return 1; - } - - return svm_exit_handlers[exit_code](svm); -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 3927528..0c90f4b 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -2582,12 +2582,15 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - default: - msr = find_msr_entry(vmx, msr_index); - if (msr) { -+ u64 old_msr_data = msr->data; - msr->data = data; - if (msr - vmx->guest_msrs < vmx->save_nmsrs) { - preempt_disable(); -- kvm_set_shared_msr(msr->index, msr->data, -- msr->mask); -+ ret = kvm_set_shared_msr(msr->index, msr->data, -+ msr->mask); - preempt_enable(); -+ if (ret) -+ msr->data = old_msr_data; - } - break; - } -@@ -5169,7 +5172,7 @@ static int handle_wrmsr(struct kvm_vcpu *vcpu) - msr.data = data; - msr.index = ecx; - msr.host_initiated = false; -- if (vmx_set_msr(vcpu, &msr) != 0) { -+ if (kvm_set_msr(vcpu, &msr) != 0) { - trace_kvm_msr_write_ex(ecx, data); - kvm_inject_gp(vcpu, 0); - return 1; -@@ -6441,6 +6444,12 @@ static int handle_invept(struct kvm_vcpu *vcpu) - return 1; - } - -+static int handle_invvpid(struct kvm_vcpu *vcpu) -+{ -+ kvm_queue_exception(vcpu, UD_VECTOR); -+ return 1; -+} -+ - /* - * The exit handlers return 1 if the exit was handled fully and guest execution - * may resume. Otherwise they set the kvm_run parameter to indicate what needs -@@ -6486,6 +6495,7 @@ static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = { - [EXIT_REASON_MWAIT_INSTRUCTION] = handle_invalid_op, - [EXIT_REASON_MONITOR_INSTRUCTION] = handle_invalid_op, - [EXIT_REASON_INVEPT] = handle_invept, -+ [EXIT_REASON_INVVPID] = handle_invvpid, - }; - - static const int kvm_vmx_max_exit_handlers = -@@ -6719,7 +6729,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu) - case EXIT_REASON_VMPTRST: case EXIT_REASON_VMREAD: - case EXIT_REASON_VMRESUME: case EXIT_REASON_VMWRITE: - case EXIT_REASON_VMOFF: case EXIT_REASON_VMON: -- case EXIT_REASON_INVEPT: -+ case EXIT_REASON_INVEPT: case EXIT_REASON_INVVPID: - /* - * VMX instructions trap unconditionally. This allows L1 to - * emulate them for its L2 guest, i.e., allows 3-level nesting! -@@ -6884,10 +6894,10 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu) - && kvm_vmx_exit_handlers[exit_reason]) - return kvm_vmx_exit_handlers[exit_reason](vcpu); - else { -- vcpu->run->exit_reason = KVM_EXIT_UNKNOWN; -- vcpu->run->hw.hardware_exit_reason = exit_reason; -+ WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_reason); -+ kvm_queue_exception(vcpu, UD_VECTOR); -+ return 1; - } -- return 0; - } - - static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr) -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 8fbd1a7..51c2851 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -225,20 +225,25 @@ static void kvm_shared_msr_cpu_online(void) - shared_msr_update(i, shared_msrs_global.msrs[i]); - } - --void kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) -+int kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) - { - unsigned int cpu = smp_processor_id(); - struct kvm_shared_msrs *smsr = per_cpu_ptr(shared_msrs, cpu); -+ int err; - - if (((value ^ smsr->values[slot].curr) & mask) == 0) -- return; -+ return 0; - smsr->values[slot].curr = value; -- wrmsrl(shared_msrs_global.msrs[slot], value); -+ err = wrmsrl_safe(shared_msrs_global.msrs[slot], value); -+ if (err) -+ return 1; -+ - if (!smsr->registered) { - smsr->urn.on_user_return = kvm_on_user_return; - user_return_notifier_register(&smsr->urn); - smsr->registered = true; - } -+ return 0; - } - EXPORT_SYMBOL_GPL(kvm_set_shared_msr); - -@@ -946,7 +951,6 @@ void kvm_enable_efer_bits(u64 mask) - } - EXPORT_SYMBOL_GPL(kvm_enable_efer_bits); - -- - /* - * Writes msr value into into the appropriate "register". - * Returns 0 on success, non-0 otherwise. -@@ -954,8 +958,34 @@ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits); - */ - int kvm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) - { -+ switch (msr->index) { -+ case MSR_FS_BASE: -+ case MSR_GS_BASE: -+ case MSR_KERNEL_GS_BASE: -+ case MSR_CSTAR: -+ case MSR_LSTAR: -+ if (is_noncanonical_address(msr->data)) -+ return 1; -+ break; -+ case MSR_IA32_SYSENTER_EIP: -+ case MSR_IA32_SYSENTER_ESP: -+ /* -+ * IA32_SYSENTER_ESP and IA32_SYSENTER_EIP cause #GP if -+ * non-canonical address is written on Intel but not on -+ * AMD (which ignores the top 32-bits, because it does -+ * not implement 64-bit SYSENTER). -+ * -+ * 64-bit code should hence be able to write a non-canonical -+ * value on AMD. Making the address canonical ensures that -+ * vmentry does not fail on Intel after writing a non-canonical -+ * value, and that something deterministic happens if the guest -+ * invokes 64-bit SYSENTER. -+ */ -+ msr->data = get_canonical(msr->data); -+ } - return kvm_x86_ops->set_msr(vcpu, msr); - } -+EXPORT_SYMBOL_GPL(kvm_set_msr); - - /* - * Adapt set_msr() to msr_io()'s calling convention -diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c -index a348868..fed892d 100644 ---- a/arch/x86/mm/pageattr.c -+++ b/arch/x86/mm/pageattr.c -@@ -405,7 +405,7 @@ phys_addr_t slow_virt_to_phys(void *__virt_addr) - psize = page_level_size(level); - pmask = page_level_mask(level); - offset = virt_addr & ~pmask; -- phys_addr = pte_pfn(*pte) << PAGE_SHIFT; -+ phys_addr = (phys_addr_t)pte_pfn(*pte) << PAGE_SHIFT; - return (phys_addr | offset); - } - EXPORT_SYMBOL_GPL(slow_virt_to_phys); -diff --git a/block/blk-settings.c b/block/blk-settings.c -index 5d21239..95138e9 100644 ---- a/block/blk-settings.c -+++ b/block/blk-settings.c -@@ -553,7 +553,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, - bottom = max(b->physical_block_size, b->io_min) + alignment; - - /* Verify that top and bottom intervals line up */ -- if (max(top, bottom) & (min(top, bottom) - 1)) { -+ if (max(top, bottom) % min(top, bottom)) { - t->misaligned = 1; - ret = -1; - } -@@ -598,7 +598,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, - - /* Find lowest common alignment_offset */ - t->alignment_offset = lcm(t->alignment_offset, alignment) -- & (max(t->physical_block_size, t->io_min) - 1); -+ % max(t->physical_block_size, t->io_min); - - /* Verify that new alignment_offset is on a logical block boundary */ - if (t->alignment_offset & (t->logical_block_size - 1)) { -diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c -index 2648797..4044cf7 100644 ---- a/block/scsi_ioctl.c -+++ b/block/scsi_ioctl.c -@@ -489,7 +489,7 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode, - - if (bytes && blk_rq_map_kern(q, rq, buffer, bytes, __GFP_WAIT)) { - err = DRIVER_ERROR << 24; -- goto out; -+ goto error; - } - - memset(sense, 0, sizeof(sense)); -@@ -499,7 +499,6 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode, - - blk_execute_rq(q, disk, rq, 0); - --out: - err = rq->errors & 0xff; /* only 8 bit SCSI status */ - if (err) { - if (rq->sense_len && rq->sense) { -diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c -index a19c027..83187f4 100644 ---- a/crypto/algif_skcipher.c -+++ b/crypto/algif_skcipher.c -@@ -49,7 +49,7 @@ struct skcipher_ctx { - struct ablkcipher_request req; - }; - --#define MAX_SGL_ENTS ((PAGE_SIZE - sizeof(struct skcipher_sg_list)) / \ -+#define MAX_SGL_ENTS ((4096 - sizeof(struct skcipher_sg_list)) / \ - sizeof(struct scatterlist) - 1) - - static inline int skcipher_sndbuf(struct sock *sk) -diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c -index b603720..37acda6 100644 ---- a/drivers/ata/libata-sff.c -+++ b/drivers/ata/libata-sff.c -@@ -2008,13 +2008,15 @@ static int ata_bus_softreset(struct ata_port *ap, unsigned int devmask, - - DPRINTK("ata%u: bus reset via SRST\n", ap->print_id); - -- /* software reset. causes dev0 to be selected */ -- iowrite8(ap->ctl, ioaddr->ctl_addr); -- udelay(20); /* FIXME: flush */ -- iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr); -- udelay(20); /* FIXME: flush */ -- iowrite8(ap->ctl, ioaddr->ctl_addr); -- ap->last_ctl = ap->ctl; -+ if (ap->ioaddr.ctl_addr) { -+ /* software reset. causes dev0 to be selected */ -+ iowrite8(ap->ctl, ioaddr->ctl_addr); -+ udelay(20); /* FIXME: flush */ -+ iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr); -+ udelay(20); /* FIXME: flush */ -+ iowrite8(ap->ctl, ioaddr->ctl_addr); -+ ap->last_ctl = ap->ctl; -+ } - - /* wait the port to become ready */ - return ata_sff_wait_after_reset(&ap->link, devmask, deadline); -@@ -2215,10 +2217,6 @@ void ata_sff_error_handler(struct ata_port *ap) - - spin_unlock_irqrestore(ap->lock, flags); - -- /* ignore ata_sff_softreset if ctl isn't accessible */ -- if (softreset == ata_sff_softreset && !ap->ioaddr.ctl_addr) -- softreset = NULL; -- - /* ignore built-in hardresets if SCR access is not available */ - if ((hardreset == sata_std_hardreset || - hardreset == sata_sff_hardreset) && !sata_scr_valid(&ap->link)) -diff --git a/drivers/ata/pata_serverworks.c b/drivers/ata/pata_serverworks.c -index 96c6a79..79dedba 100644 ---- a/drivers/ata/pata_serverworks.c -+++ b/drivers/ata/pata_serverworks.c -@@ -252,12 +252,18 @@ static void serverworks_set_dmamode(struct ata_port *ap, struct ata_device *adev - pci_write_config_byte(pdev, 0x54, ultra_cfg); - } - --static struct scsi_host_template serverworks_sht = { -+static struct scsi_host_template serverworks_osb4_sht = { -+ ATA_BMDMA_SHT(DRV_NAME), -+ .sg_tablesize = LIBATA_DUMB_MAX_PRD, -+}; -+ -+static struct scsi_host_template serverworks_csb_sht = { - ATA_BMDMA_SHT(DRV_NAME), - }; - - static struct ata_port_operations serverworks_osb4_port_ops = { - .inherits = &ata_bmdma_port_ops, -+ .qc_prep = ata_bmdma_dumb_qc_prep, - .cable_detect = serverworks_cable_detect, - .mode_filter = serverworks_osb4_filter, - .set_piomode = serverworks_set_piomode, -@@ -266,6 +272,7 @@ static struct ata_port_operations serverworks_osb4_port_ops = { - - static struct ata_port_operations serverworks_csb_port_ops = { - .inherits = &serverworks_osb4_port_ops, -+ .qc_prep = ata_bmdma_qc_prep, - .mode_filter = serverworks_csb_filter, - }; - -@@ -405,6 +412,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id - } - }; - const struct ata_port_info *ppi[] = { &info[id->driver_data], NULL }; -+ struct scsi_host_template *sht = &serverworks_csb_sht; - int rc; - - rc = pcim_enable_device(pdev); -@@ -418,6 +426,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id - /* Select non UDMA capable OSB4 if we can't do fixups */ - if (rc < 0) - ppi[0] = &info[1]; -+ sht = &serverworks_osb4_sht; - } - /* setup CSB5/CSB6 : South Bridge and IDE option RAID */ - else if ((pdev->device == PCI_DEVICE_ID_SERVERWORKS_CSB5IDE) || -@@ -434,7 +443,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id - ppi[1] = &ata_dummy_port_info; - } - -- return ata_pci_bmdma_init_one(pdev, ppi, &serverworks_sht, NULL, 0); -+ return ata_pci_bmdma_init_one(pdev, ppi, sht, NULL, 0); - } - - #ifdef CONFIG_PM -diff --git a/drivers/base/core.c b/drivers/base/core.c -index 2b56717..6a8955e 100644 ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -741,12 +741,12 @@ class_dir_create_and_add(struct class *class, struct kobject *parent_kobj) - return &dir->kobj; - } - -+static DEFINE_MUTEX(gdp_mutex); - - static struct kobject *get_device_parent(struct device *dev, - struct device *parent) - { - if (dev->class) { -- static DEFINE_MUTEX(gdp_mutex); - struct kobject *kobj = NULL; - struct kobject *parent_kobj; - struct kobject *k; -@@ -810,7 +810,9 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) - glue_dir->kset != &dev->class->p->glue_dirs) - return; - -+ mutex_lock(&gdp_mutex); - kobject_put(glue_dir); -+ mutex_unlock(&gdp_mutex); - } - - static void cleanup_device_parent(struct device *dev) -diff --git a/drivers/block/drbd/drbd_interval.c b/drivers/block/drbd/drbd_interval.c -index 89c497c..04a14e0 100644 ---- a/drivers/block/drbd/drbd_interval.c -+++ b/drivers/block/drbd/drbd_interval.c -@@ -79,6 +79,7 @@ bool - drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) - { - struct rb_node **new = &root->rb_node, *parent = NULL; -+ sector_t this_end = this->sector + (this->size >> 9); - - BUG_ON(!IS_ALIGNED(this->size, 512)); - -@@ -87,6 +88,8 @@ drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) - rb_entry(*new, struct drbd_interval, rb); - - parent = *new; -+ if (here->end < this_end) -+ here->end = this_end; - if (this->sector < here->sector) - new = &(*new)->rb_left; - else if (this->sector > here->sector) -@@ -99,6 +102,7 @@ drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) - return false; - } - -+ this->end = this_end; - rb_link_node(&this->rb, parent, new); - rb_insert_augmented(&this->rb, root, &augment_callbacks); - return true; -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index 7296c7f..255ca23 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -3217,7 +3217,7 @@ static int rbd_obj_read_sync(struct rbd_device *rbd_dev, - page_count = (u32) calc_pages_for(offset, length); - pages = ceph_alloc_page_vector(page_count, GFP_KERNEL); - if (IS_ERR(pages)) -- ret = PTR_ERR(pages); -+ return PTR_ERR(pages); - - ret = -ENOMEM; - obj_request = rbd_obj_request_create(object_name, offset, length, -diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c -index 64c60ed..63fc7f0 100644 ---- a/drivers/block/xen-blkback/blkback.c -+++ b/drivers/block/xen-blkback/blkback.c -@@ -763,6 +763,7 @@ again: - BUG_ON(new_map_idx >= segs_to_map); - if (unlikely(map[new_map_idx].status != 0)) { - pr_debug(DRV_PFX "invalid buffer -- could not remap it\n"); -+ put_free_pages(blkif, &pages[seg_idx]->page, 1); - pages[seg_idx]->handle = BLKBACK_INVALID_HANDLE; - ret |= 1; - goto next; -diff --git a/drivers/char/random.c b/drivers/char/random.c -index 429b75b..8a64dbe 100644 ---- a/drivers/char/random.c -+++ b/drivers/char/random.c -@@ -1063,8 +1063,8 @@ static void extract_buf(struct entropy_store *r, __u8 *out) - * pool while mixing, and hash one final time. - */ - sha_transform(hash.w, extract, workspace); -- memset(extract, 0, sizeof(extract)); -- memset(workspace, 0, sizeof(workspace)); -+ memzero_explicit(extract, sizeof(extract)); -+ memzero_explicit(workspace, sizeof(workspace)); - - /* - * In case the hash function has some recognizable output -@@ -1076,7 +1076,7 @@ static void extract_buf(struct entropy_store *r, __u8 *out) - hash.w[2] ^= rol32(hash.w[2], 16); - - memcpy(out, &hash, EXTRACT_SIZE); -- memset(&hash, 0, sizeof(hash)); -+ memzero_explicit(&hash, sizeof(hash)); - } - - static ssize_t extract_entropy(struct entropy_store *r, void *buf, -@@ -1124,7 +1124,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf, - } - - /* Wipe data just returned from memory */ -- memset(tmp, 0, sizeof(tmp)); -+ memzero_explicit(tmp, sizeof(tmp)); - - return ret; - } -@@ -1162,7 +1162,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf, - } - - /* Wipe data just returned from memory */ -- memset(tmp, 0, sizeof(tmp)); -+ memzero_explicit(tmp, sizeof(tmp)); - - return ret; - } -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index 4159236..4854f81 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -460,7 +460,18 @@ show_one(cpuinfo_max_freq, cpuinfo.max_freq); - show_one(cpuinfo_transition_latency, cpuinfo.transition_latency); - show_one(scaling_min_freq, min); - show_one(scaling_max_freq, max); --show_one(scaling_cur_freq, cur); -+ -+static ssize_t show_scaling_cur_freq( -+ struct cpufreq_policy *policy, char *buf) -+{ -+ ssize_t ret; -+ -+ if (cpufreq_driver && cpufreq_driver->setpolicy && cpufreq_driver->get) -+ ret = sprintf(buf, "%u\n", cpufreq_driver->get(policy->cpu)); -+ else -+ ret = sprintf(buf, "%u\n", policy->cur); -+ return ret; -+} - - static int cpufreq_set_policy(struct cpufreq_policy *policy, - struct cpufreq_policy *new_policy); -@@ -854,11 +865,11 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy, - if (ret) - goto err_out_kobj_put; - } -- if (has_target()) { -- ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr); -- if (ret) -- goto err_out_kobj_put; -- } -+ -+ ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr); -+ if (ret) -+ goto err_out_kobj_put; -+ - if (cpufreq_driver->bios_limit) { - ret = sysfs_create_file(&policy->kobj, &bios_limit.attr); - if (ret) -diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index ae52c77..533a509 100644 ---- a/drivers/cpufreq/intel_pstate.c -+++ b/drivers/cpufreq/intel_pstate.c -@@ -55,6 +55,17 @@ static inline int32_t div_fp(int32_t x, int32_t y) - return div_s64((int64_t)x << FRAC_BITS, (int64_t)y); - } - -+static inline int ceiling_fp(int32_t x) -+{ -+ int mask, ret; -+ -+ ret = fp_toint(x); -+ mask = (1 << FRAC_BITS) - 1; -+ if (x & mask) -+ ret += 1; -+ return ret; -+} -+ - struct sample { - int32_t core_pct_busy; - u64 aperf; -@@ -67,6 +78,7 @@ struct pstate_data { - int current_pstate; - int min_pstate; - int max_pstate; -+ int scaling; - int turbo_pstate; - }; - -@@ -118,6 +130,7 @@ struct pstate_funcs { - int (*get_max)(void); - int (*get_min)(void); - int (*get_turbo)(void); -+ int (*get_scaling)(void); - void (*set)(struct cpudata*, int pstate); - void (*get_vid)(struct cpudata *); - }; -@@ -397,7 +410,7 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate) - cpudata->vid.ratio); - - vid_fp = clamp_t(int32_t, vid_fp, cpudata->vid.min, cpudata->vid.max); -- vid = fp_toint(vid_fp); -+ vid = ceiling_fp(vid_fp); - - if (pstate > cpudata->pstate.max_pstate) - vid = cpudata->vid.turbo; -@@ -407,6 +420,22 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate) - wrmsrl(MSR_IA32_PERF_CTL, val); - } - -+#define BYT_BCLK_FREQS 5 -+static int byt_freq_table[BYT_BCLK_FREQS] = { 833, 1000, 1333, 1167, 800}; -+ -+static int byt_get_scaling(void) -+{ -+ u64 value; -+ int i; -+ -+ rdmsrl(MSR_FSB_FREQ, value); -+ i = value & 0x3; -+ -+ BUG_ON(i > BYT_BCLK_FREQS); -+ -+ return byt_freq_table[i] * 100; -+} -+ - static void byt_get_vid(struct cpudata *cpudata) - { - u64 value; -@@ -451,6 +480,11 @@ static int core_get_turbo_pstate(void) - return ret; - } - -+static inline int core_get_scaling(void) -+{ -+ return 100000; -+} -+ - static void core_set_pstate(struct cpudata *cpudata, int pstate) - { - u64 val; -@@ -475,6 +509,7 @@ static struct cpu_defaults core_params = { - .get_max = core_get_max_pstate, - .get_min = core_get_min_pstate, - .get_turbo = core_get_turbo_pstate, -+ .get_scaling = core_get_scaling, - .set = core_set_pstate, - }, - }; -@@ -493,6 +528,7 @@ static struct cpu_defaults byt_params = { - .get_min = byt_get_min_pstate, - .get_turbo = byt_get_turbo_pstate, - .set = byt_set_pstate, -+ .get_scaling = byt_get_scaling, - .get_vid = byt_get_vid, - }, - }; -@@ -526,7 +562,7 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate) - if (pstate == cpu->pstate.current_pstate) - return; - -- trace_cpu_frequency(pstate * 100000, cpu->cpu); -+ trace_cpu_frequency(pstate * cpu->pstate.scaling, cpu->cpu); - - cpu->pstate.current_pstate = pstate; - -@@ -555,6 +591,7 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu) - cpu->pstate.min_pstate = pstate_funcs.get_min(); - cpu->pstate.max_pstate = pstate_funcs.get_max(); - cpu->pstate.turbo_pstate = pstate_funcs.get_turbo(); -+ cpu->pstate.scaling = pstate_funcs.get_scaling(); - - if (pstate_funcs.get_vid) - pstate_funcs.get_vid(cpu); -@@ -574,7 +611,9 @@ static inline void intel_pstate_calc_busy(struct cpudata *cpu, - core_pct += 1; - - sample->freq = fp_toint( -- mul_fp(int_tofp(cpu->pstate.max_pstate * 1000), core_pct)); -+ mul_fp(int_tofp( -+ cpu->pstate.max_pstate * cpu->pstate.scaling / 100), -+ core_pct)); - - sample->core_pct_busy = (int32_t)core_pct; - } -@@ -685,10 +724,14 @@ static const struct x86_cpu_id intel_pstate_cpu_ids[] = { - ICPU(0x37, byt_params), - ICPU(0x3a, core_params), - ICPU(0x3c, core_params), -+ ICPU(0x3d, core_params), - ICPU(0x3e, core_params), - ICPU(0x3f, core_params), - ICPU(0x45, core_params), - ICPU(0x46, core_params), -+ ICPU(0x4c, byt_params), -+ ICPU(0x4f, core_params), -+ ICPU(0x56, core_params), - {} - }; - MODULE_DEVICE_TABLE(x86cpu, intel_pstate_cpu_ids); -@@ -751,6 +794,7 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy) - if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) { - limits.min_perf_pct = 100; - limits.min_perf = int_tofp(1); -+ limits.max_policy_pct = 100; - limits.max_perf_pct = 100; - limits.max_perf = int_tofp(1); - limits.no_turbo = limits.turbo_disabled; -@@ -812,12 +856,13 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy) - else - policy->policy = CPUFREQ_POLICY_POWERSAVE; - -- policy->min = cpu->pstate.min_pstate * 100000; -- policy->max = cpu->pstate.turbo_pstate * 100000; -+ policy->min = cpu->pstate.min_pstate * cpu->pstate.scaling; -+ policy->max = cpu->pstate.turbo_pstate * cpu->pstate.scaling; - - /* cpuinfo and default policy values */ -- policy->cpuinfo.min_freq = cpu->pstate.min_pstate * 100000; -- policy->cpuinfo.max_freq = cpu->pstate.turbo_pstate * 100000; -+ policy->cpuinfo.min_freq = cpu->pstate.min_pstate * cpu->pstate.scaling; -+ policy->cpuinfo.max_freq = -+ cpu->pstate.turbo_pstate * cpu->pstate.scaling; - policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL; - cpumask_set_cpu(policy->cpu, policy->cpus); - -@@ -875,6 +920,7 @@ static void copy_cpu_funcs(struct pstate_funcs *funcs) - pstate_funcs.get_max = funcs->get_max; - pstate_funcs.get_min = funcs->get_min; - pstate_funcs.get_turbo = funcs->get_turbo; -+ pstate_funcs.get_scaling = funcs->get_scaling; - pstate_funcs.set = funcs->set; - pstate_funcs.get_vid = funcs->get_vid; - } -diff --git a/drivers/edac/cpc925_edac.c b/drivers/edac/cpc925_edac.c -index df6575f..682288c 100644 ---- a/drivers/edac/cpc925_edac.c -+++ b/drivers/edac/cpc925_edac.c -@@ -562,7 +562,7 @@ static void cpc925_mc_check(struct mem_ctl_info *mci) - - if (apiexcp & UECC_EXCP_DETECTED) { - cpc925_mc_printk(mci, KERN_INFO, "DRAM UECC Fault\n"); -- edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, -+ edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, - pfn, offset, 0, - csrow, -1, -1, - mci->ctl_name, ""); -diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c -index 3cda79b..ece3aef 100644 ---- a/drivers/edac/e7xxx_edac.c -+++ b/drivers/edac/e7xxx_edac.c -@@ -226,7 +226,7 @@ static void process_ce(struct mem_ctl_info *mci, struct e7xxx_error_info *info) - static void process_ce_no_info(struct mem_ctl_info *mci) - { - edac_dbg(3, "\n"); -- edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, 0, 0, 0, -1, -1, -1, -+ edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, 0, 0, 0, -1, -1, -1, - "e7xxx CE log register overflow", ""); - } - -diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c -index fa1326e..ad76f10 100644 ---- a/drivers/edac/i3200_edac.c -+++ b/drivers/edac/i3200_edac.c -@@ -242,11 +242,11 @@ static void i3200_process_error_info(struct mem_ctl_info *mci, - -1, -1, - "i3000 UE", ""); - } else if (log & I3200_ECCERRLOG_CE) { -- edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, -+ edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, - 0, 0, eccerrlog_syndrome(log), - eccerrlog_row(channel, log), - -1, -1, -- "i3000 UE", ""); -+ "i3000 CE", ""); - } - } - } -diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c -index 3382f63..4382343 100644 ---- a/drivers/edac/i82860_edac.c -+++ b/drivers/edac/i82860_edac.c -@@ -124,7 +124,7 @@ static int i82860_process_error_info(struct mem_ctl_info *mci, - dimm->location[0], dimm->location[1], -1, - "i82860 UE", ""); - else -- edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, -+ edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, - info->eap, 0, info->derrsyn, - dimm->location[0], dimm->location[1], -1, - "i82860 CE", ""); -diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c -index cca063b..d2e56e9 100644 ---- a/drivers/gpu/drm/ast/ast_mode.c -+++ b/drivers/gpu/drm/ast/ast_mode.c -@@ -1012,8 +1012,8 @@ static u32 copy_cursor_image(u8 *src, u8 *dst, int width, int height) - srcdata32[1].ul = *((u32 *)(srcxor + 4)) & 0xf0f0f0f0; - data32.b[0] = srcdata32[0].b[1] | (srcdata32[0].b[0] >> 4); - data32.b[1] = srcdata32[0].b[3] | (srcdata32[0].b[2] >> 4); -- data32.b[2] = srcdata32[0].b[1] | (srcdata32[1].b[0] >> 4); -- data32.b[3] = srcdata32[0].b[3] | (srcdata32[1].b[2] >> 4); -+ data32.b[2] = srcdata32[1].b[1] | (srcdata32[1].b[0] >> 4); -+ data32.b[3] = srcdata32[1].b[3] | (srcdata32[1].b[2] >> 4); - - writel(data32.ul, dstxor); - csum += data32.ul; -diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.c b/drivers/gpu/drm/cirrus/cirrus_drv.c -index 08ce520..faa1f42 100644 ---- a/drivers/gpu/drm/cirrus/cirrus_drv.c -+++ b/drivers/gpu/drm/cirrus/cirrus_drv.c -@@ -32,6 +32,8 @@ static struct drm_driver driver; - static DEFINE_PCI_DEVICE_TABLE(pciidlist) = { - { PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_5446, 0x1af4, 0x1100, 0, - 0, 0 }, -+ { PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_5446, PCI_VENDOR_ID_XEN, -+ 0x0001, 0, 0, 0 }, - {0,} - }; - -diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c -index fd98bec..c6d9777 100644 ---- a/drivers/gpu/drm/i915/intel_panel.c -+++ b/drivers/gpu/drm/i915/intel_panel.c -@@ -645,7 +645,7 @@ static void pch_enable_backlight(struct intel_connector *connector) - - cpu_ctl2 = I915_READ(BLC_PWM_CPU_CTL2); - if (cpu_ctl2 & BLM_PWM_ENABLE) { -- WARN(1, "cpu backlight already enabled\n"); -+ DRM_DEBUG_KMS("cpu backlight already enabled\n"); - cpu_ctl2 &= ~BLM_PWM_ENABLE; - I915_WRITE(BLC_PWM_CPU_CTL2, cpu_ctl2); - } -@@ -693,7 +693,7 @@ static void i9xx_enable_backlight(struct intel_connector *connector) - - ctl = I915_READ(BLC_PWM_CTL); - if (ctl & BACKLIGHT_DUTY_CYCLE_MASK_PNV) { -- WARN(1, "backlight already enabled\n"); -+ DRM_DEBUG_KMS("backlight already enabled\n"); - I915_WRITE(BLC_PWM_CTL, 0); - } - -@@ -724,7 +724,7 @@ static void i965_enable_backlight(struct intel_connector *connector) - - ctl2 = I915_READ(BLC_PWM_CTL2); - if (ctl2 & BLM_PWM_ENABLE) { -- WARN(1, "backlight already enabled\n"); -+ DRM_DEBUG_KMS("backlight already enabled\n"); - ctl2 &= ~BLM_PWM_ENABLE; - I915_WRITE(BLC_PWM_CTL2, ctl2); - } -@@ -758,7 +758,7 @@ static void vlv_enable_backlight(struct intel_connector *connector) - - ctl2 = I915_READ(VLV_BLC_PWM_CTL2(pipe)); - if (ctl2 & BLM_PWM_ENABLE) { -- WARN(1, "backlight already enabled\n"); -+ DRM_DEBUG_KMS("backlight already enabled\n"); - ctl2 &= ~BLM_PWM_ENABLE; - I915_WRITE(VLV_BLC_PWM_CTL2(pipe), ctl2); - } -diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c -index 2d9b9d7..f3edd28 100644 ---- a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c -+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c -@@ -124,6 +124,7 @@ dcb_outp_parse(struct nouveau_bios *bios, u8 idx, u8 *ver, u8 *len, - struct dcb_output *outp) - { - u16 dcb = dcb_outp(bios, idx, ver, len); -+ memset(outp, 0x00, sizeof(*outp)); - if (dcb) { - if (*ver >= 0x20) { - u32 conn = nv_ro32(bios, dcb + 0x00); -diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c -index 798bde2..c39c414 100644 ---- a/drivers/gpu/drm/qxl/qxl_display.c -+++ b/drivers/gpu/drm/qxl/qxl_display.c -@@ -523,7 +523,6 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc, - struct qxl_framebuffer *qfb; - struct qxl_bo *bo, *old_bo = NULL; - struct qxl_crtc *qcrtc = to_qxl_crtc(crtc); -- uint32_t width, height, base_offset; - bool recreate_primary = false; - int ret; - int surf_id; -@@ -553,9 +552,10 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc, - if (qcrtc->index == 0) - recreate_primary = true; - -- width = mode->hdisplay; -- height = mode->vdisplay; -- base_offset = 0; -+ if (bo->surf.stride * bo->surf.height > qdev->vram_size) { -+ DRM_ERROR("Mode doesn't fit in vram size (vgamem)"); -+ return -EINVAL; -+ } - - ret = qxl_bo_reserve(bo, false); - if (ret != 0) -@@ -569,10 +569,10 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc, - if (recreate_primary) { - qxl_io_destroy_primary(qdev); - qxl_io_log(qdev, -- "recreate primary: %dx%d (was %dx%d,%d,%d)\n", -- width, height, bo->surf.width, -- bo->surf.height, bo->surf.stride, bo->surf.format); -- qxl_io_create_primary(qdev, base_offset, bo); -+ "recreate primary: %dx%d,%d,%d\n", -+ bo->surf.width, bo->surf.height, -+ bo->surf.stride, bo->surf.format); -+ qxl_io_create_primary(qdev, 0, bo); - bo->is_primary = true; - surf_id = 0; - } else { -diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c -index 0a2f5b4..879e628 100644 ---- a/drivers/gpu/drm/radeon/si_dpm.c -+++ b/drivers/gpu/drm/radeon/si_dpm.c -@@ -6200,7 +6200,7 @@ static void si_parse_pplib_clock_info(struct radeon_device *rdev, - if ((rps->class2 & ATOM_PPLIB_CLASSIFICATION2_ULV) && - index == 0) { - /* XXX disable for A0 tahiti */ -- si_pi->ulv.supported = true; -+ si_pi->ulv.supported = false; - si_pi->ulv.pl = *pl; - si_pi->ulv.one_pcie_lane_in_ulv = false; - si_pi->ulv.volt_change_delay = SISLANDS_ULVVOLTAGECHANGEDELAY_DFLT; -diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c -index 0644429..52b4711 100644 ---- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c -+++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c -@@ -84,6 +84,7 @@ static int modeset_init(struct drm_device *dev) - if ((priv->num_encoders == 0) || (priv->num_connectors == 0)) { - /* oh nos! */ - dev_err(dev->dev, "no encoders/connectors found\n"); -+ drm_mode_config_cleanup(dev); - return -ENXIO; - } - -@@ -178,33 +179,37 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) - dev->dev_private = priv; - - priv->wq = alloc_ordered_workqueue("tilcdc", 0); -+ if (!priv->wq) { -+ ret = -ENOMEM; -+ goto fail_free_priv; -+ } - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!res) { - dev_err(dev->dev, "failed to get memory resource\n"); - ret = -EINVAL; -- goto fail; -+ goto fail_free_wq; - } - - priv->mmio = ioremap_nocache(res->start, resource_size(res)); - if (!priv->mmio) { - dev_err(dev->dev, "failed to ioremap\n"); - ret = -ENOMEM; -- goto fail; -+ goto fail_free_wq; - } - - priv->clk = clk_get(dev->dev, "fck"); - if (IS_ERR(priv->clk)) { - dev_err(dev->dev, "failed to get functional clock\n"); - ret = -ENODEV; -- goto fail; -+ goto fail_iounmap; - } - - priv->disp_clk = clk_get(dev->dev, "dpll_disp_ck"); - if (IS_ERR(priv->clk)) { - dev_err(dev->dev, "failed to get display clock\n"); - ret = -ENODEV; -- goto fail; -+ goto fail_put_clk; - } - - #ifdef CONFIG_CPU_FREQ -@@ -214,7 +219,7 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) - CPUFREQ_TRANSITION_NOTIFIER); - if (ret) { - dev_err(dev->dev, "failed to register cpufreq notifier\n"); -- goto fail; -+ goto fail_put_disp_clk; - } - #endif - -@@ -259,13 +264,13 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) - ret = modeset_init(dev); - if (ret < 0) { - dev_err(dev->dev, "failed to initialize mode setting\n"); -- goto fail; -+ goto fail_cpufreq_unregister; - } - - ret = drm_vblank_init(dev, 1); - if (ret < 0) { - dev_err(dev->dev, "failed to initialize vblank\n"); -- goto fail; -+ goto fail_mode_config_cleanup; - } - - pm_runtime_get_sync(dev->dev); -@@ -273,7 +278,7 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) - pm_runtime_put_sync(dev->dev); - if (ret < 0) { - dev_err(dev->dev, "failed to install IRQ handler\n"); -- goto fail; -+ goto fail_vblank_cleanup; - } - - platform_set_drvdata(pdev, dev); -@@ -289,13 +294,48 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) - priv->fbdev = drm_fbdev_cma_init(dev, bpp, - dev->mode_config.num_crtc, - dev->mode_config.num_connector); -+ if (IS_ERR(priv->fbdev)) { -+ ret = PTR_ERR(priv->fbdev); -+ goto fail_irq_uninstall; -+ } - - drm_kms_helper_poll_init(dev); - - return 0; - --fail: -- tilcdc_unload(dev); -+fail_irq_uninstall: -+ pm_runtime_get_sync(dev->dev); -+ drm_irq_uninstall(dev); -+ pm_runtime_put_sync(dev->dev); -+ -+fail_vblank_cleanup: -+ drm_vblank_cleanup(dev); -+ -+fail_mode_config_cleanup: -+ drm_mode_config_cleanup(dev); -+ -+fail_cpufreq_unregister: -+ pm_runtime_disable(dev->dev); -+#ifdef CONFIG_CPU_FREQ -+ cpufreq_unregister_notifier(&priv->freq_transition, -+ CPUFREQ_TRANSITION_NOTIFIER); -+fail_put_disp_clk: -+ clk_put(priv->disp_clk); -+#endif -+ -+fail_put_clk: -+ clk_put(priv->clk); -+ -+fail_iounmap: -+ iounmap(priv->mmio); -+ -+fail_free_wq: -+ flush_workqueue(priv->wq); -+ destroy_workqueue(priv->wq); -+ -+fail_free_priv: -+ dev->dev_private = NULL; -+ kfree(priv); - return ret; - } - -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -index 0083cbf..fb7c36e 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -@@ -688,7 +688,11 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset) - goto out_err0; - } - -- if (unlikely(dev_priv->prim_bb_mem < dev_priv->vram_size)) -+ /* -+ * Limit back buffer size to VRAM size. Remove this once -+ * screen targets are implemented. -+ */ -+ if (dev_priv->prim_bb_mem > dev_priv->vram_size) - dev_priv->prim_bb_mem = dev_priv->vram_size; - - mutex_unlock(&dev_priv->hw_mutex); -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -index 8a65041..c8f8ecf 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -@@ -1954,6 +1954,14 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector, - DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) - }; - int i; -+ u32 assumed_bpp = 2; -+ -+ /* -+ * If using screen objects, then assume 32-bpp because that's what the -+ * SVGA device is assuming -+ */ -+ if (dev_priv->sou_priv) -+ assumed_bpp = 4; - - /* Add preferred mode */ - { -@@ -1964,8 +1972,9 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector, - mode->vdisplay = du->pref_height; - vmw_guess_mode_timing(mode); - -- if (vmw_kms_validate_mode_vram(dev_priv, mode->hdisplay * 2, -- mode->vdisplay)) { -+ if (vmw_kms_validate_mode_vram(dev_priv, -+ mode->hdisplay * assumed_bpp, -+ mode->vdisplay)) { - drm_mode_probed_add(connector, mode); - } else { - drm_mode_destroy(dev, mode); -@@ -1987,7 +1996,8 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector, - bmode->vdisplay > max_height) - continue; - -- if (!vmw_kms_validate_mode_vram(dev_priv, bmode->hdisplay * 2, -+ if (!vmw_kms_validate_mode_vram(dev_priv, -+ bmode->hdisplay * assumed_bpp, - bmode->vdisplay)) - continue; - -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 6e12cd0..91bc66b 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -292,6 +292,11 @@ - #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7 - #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001 - -+#define USB_VENDOR_ID_ELAN 0x04f3 -+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN 0x0089 -+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B 0x009b -+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F 0x016f -+ - #define USB_VENDOR_ID_ELECOM 0x056e - #define USB_DEVICE_ID_ELECOM_BM084 0x0061 - -diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c -index 44df131..617c47f 100644 ---- a/drivers/hid/usbhid/hid-core.c -+++ b/drivers/hid/usbhid/hid-core.c -@@ -82,7 +82,7 @@ static int hid_start_in(struct hid_device *hid) - struct usbhid_device *usbhid = hid->driver_data; - - spin_lock_irqsave(&usbhid->lock, flags); -- if (hid->open > 0 && -+ if ((hid->open > 0 || hid->quirks & HID_QUIRK_ALWAYS_POLL) && - !test_bit(HID_DISCONNECTED, &usbhid->iofl) && - !test_bit(HID_SUSPENDED, &usbhid->iofl) && - !test_and_set_bit(HID_IN_RUNNING, &usbhid->iofl)) { -@@ -292,6 +292,8 @@ static void hid_irq_in(struct urb *urb) - case 0: /* success */ - usbhid_mark_busy(usbhid); - usbhid->retry_delay = 0; -+ if ((hid->quirks & HID_QUIRK_ALWAYS_POLL) && !hid->open) -+ break; - hid_input_report(urb->context, HID_INPUT_REPORT, - urb->transfer_buffer, - urb->actual_length, 1); -@@ -734,8 +736,10 @@ void usbhid_close(struct hid_device *hid) - if (!--hid->open) { - spin_unlock_irq(&usbhid->lock); - hid_cancel_delayed_stuff(usbhid); -- usb_kill_urb(usbhid->urbin); -- usbhid->intf->needs_remote_wakeup = 0; -+ if (!(hid->quirks & HID_QUIRK_ALWAYS_POLL)) { -+ usb_kill_urb(usbhid->urbin); -+ usbhid->intf->needs_remote_wakeup = 0; -+ } - } else { - spin_unlock_irq(&usbhid->lock); - } -@@ -1119,6 +1123,19 @@ static int usbhid_start(struct hid_device *hid) - - set_bit(HID_STARTED, &usbhid->iofl); - -+ if (hid->quirks & HID_QUIRK_ALWAYS_POLL) { -+ ret = usb_autopm_get_interface(usbhid->intf); -+ if (ret) -+ goto fail; -+ usbhid->intf->needs_remote_wakeup = 1; -+ ret = hid_start_in(hid); -+ if (ret) { -+ dev_err(&hid->dev, -+ "failed to start in urb: %d\n", ret); -+ } -+ usb_autopm_put_interface(usbhid->intf); -+ } -+ - /* Some keyboards don't work until their LEDs have been set. - * Since BIOSes do set the LEDs, it must be safe for any device - * that supports the keyboard boot protocol. -@@ -1151,6 +1168,9 @@ static void usbhid_stop(struct hid_device *hid) - if (WARN_ON(!usbhid)) - return; - -+ if (hid->quirks & HID_QUIRK_ALWAYS_POLL) -+ usbhid->intf->needs_remote_wakeup = 0; -+ - clear_bit(HID_STARTED, &usbhid->iofl); - spin_lock_irq(&usbhid->lock); /* Sync with error and led handlers */ - set_bit(HID_DISCONNECTED, &usbhid->iofl); -diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c -index 8e4ddb3..deb3643 100644 ---- a/drivers/hid/usbhid/hid-quirks.c -+++ b/drivers/hid/usbhid/hid-quirks.c -@@ -69,6 +69,9 @@ static const struct hid_blacklist { - { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET }, -+ { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL }, -+ { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL }, -+ { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F, HID_QUIRK_ALWAYS_POLL }, - { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS }, - { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET }, -diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c -index 11e9c7f..8873d84 100644 ---- a/drivers/i2c/busses/i2c-at91.c -+++ b/drivers/i2c/busses/i2c-at91.c -@@ -434,7 +434,7 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) - } - } - -- ret = wait_for_completion_io_timeout(&dev->cmd_complete, -+ ret = wait_for_completion_timeout(&dev->cmd_complete, - dev->adapter.timeout); - if (ret == 0) { - dev_err(dev->dev, "controller timed out\n"); -diff --git a/drivers/iio/common/st_sensors/st_sensors_buffer.c b/drivers/iio/common/st_sensors/st_sensors_buffer.c -index 1665c8e..e18bc67 100644 ---- a/drivers/iio/common/st_sensors/st_sensors_buffer.c -+++ b/drivers/iio/common/st_sensors/st_sensors_buffer.c -@@ -71,7 +71,7 @@ int st_sensors_get_buffer_element(struct iio_dev *indio_dev, u8 *buf) - goto st_sensors_free_memory; - } - -- for (i = 0; i < n * num_data_channels; i++) { -+ for (i = 0; i < n * byte_for_channel; i++) { - if (i < n) - buf[i] = rx_array[i]; - else -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index f1da362..8fca488f 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -101,6 +101,12 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = { - }, - { - .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "X750LN"), -+ }, -+ }, -+ { -+ .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Compaq"), - DMI_MATCH(DMI_PRODUCT_NAME , "ProLiant"), - DMI_MATCH(DMI_PRODUCT_VERSION, "8500"), -@@ -609,6 +615,22 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { - }, - }, - { -+ /* Fujitsu A544 laptop */ -+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK A544"), -+ }, -+ }, -+ { -+ /* Fujitsu AH544 laptop */ -+ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"), -+ }, -+ }, -+ { - /* Fujitsu U574 laptop */ - /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ - .matches = { -diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c -index 0e722c1..ca1621b 100644 ---- a/drivers/md/dm-bufio.c -+++ b/drivers/md/dm-bufio.c -@@ -465,6 +465,7 @@ static void __relink_lru(struct dm_buffer *b, int dirty) - c->n_buffers[dirty]++; - b->list_mode = dirty; - list_move(&b->lru_list, &c->lru[dirty]); -+ b->last_accessed = jiffies; - } - - /*---------------------------------------------------------------- -@@ -1485,9 +1486,9 @@ static long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan, - list_for_each_entry_safe_reverse(b, tmp, &c->lru[l], lru_list) { - freed += __cleanup_old_buffer(b, gfp_mask, 0); - if (!--nr_to_scan) -- break; -+ return freed; -+ dm_bufio_cond_resched(); - } -- dm_bufio_cond_resched(); - } - return freed; - } -diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c -index 08d9a20..c69d0b7 100644 ---- a/drivers/md/dm-log-userspace-transfer.c -+++ b/drivers/md/dm-log-userspace-transfer.c -@@ -272,7 +272,7 @@ int dm_ulog_tfr_init(void) - - r = cn_add_callback(&ulog_cn_id, "dmlogusr", cn_ulog_callback); - if (r) { -- cn_del_callback(&ulog_cn_id); -+ kfree(prealloced_cn_msg); - return r; - } - -diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c -index 1e344b0..22e8c20 100644 ---- a/drivers/media/dvb-frontends/ds3000.c -+++ b/drivers/media/dvb-frontends/ds3000.c -@@ -864,6 +864,13 @@ struct dvb_frontend *ds3000_attach(const struct ds3000_config *config, - memcpy(&state->frontend.ops, &ds3000_ops, - sizeof(struct dvb_frontend_ops)); - state->frontend.demodulator_priv = state; -+ -+ /* -+ * Some devices like T480 starts with voltage on. Be sure -+ * to turn voltage off during init, as this can otherwise -+ * interfere with Unicable SCR systems. -+ */ -+ ds3000_set_voltage(&state->frontend, SEC_VOLTAGE_OFF); - return &state->frontend; - - error3: -diff --git a/drivers/media/i2c/tda7432.c b/drivers/media/i2c/tda7432.c -index 72af644..cf93021 100644 ---- a/drivers/media/i2c/tda7432.c -+++ b/drivers/media/i2c/tda7432.c -@@ -293,7 +293,7 @@ static int tda7432_s_ctrl(struct v4l2_ctrl *ctrl) - if (t->mute->val) { - lf |= TDA7432_MUTE; - lr |= TDA7432_MUTE; -- lf |= TDA7432_MUTE; -+ rf |= TDA7432_MUTE; - rr |= TDA7432_MUTE; - } - /* Mute & update balance*/ -diff --git a/drivers/media/tuners/m88ts2022.c b/drivers/media/tuners/m88ts2022.c -index 40c42de..7a62097 100644 ---- a/drivers/media/tuners/m88ts2022.c -+++ b/drivers/media/tuners/m88ts2022.c -@@ -314,7 +314,7 @@ static int m88ts2022_set_params(struct dvb_frontend *fe) - div_min = gdiv28 * 78 / 100; - div_max = clamp_val(div_max, 0U, 63U); - -- f_3db_hz = c->symbol_rate * 135UL / 200UL; -+ f_3db_hz = mult_frac(c->symbol_rate, 135, 200); - f_3db_hz += 2000000U + (frequency_offset_khz * 1000U); - f_3db_hz = clamp(f_3db_hz, 7000000U, 40000000U); - -diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c -index 4d97a76..c1a3f8f 100644 ---- a/drivers/media/usb/em28xx/em28xx-cards.c -+++ b/drivers/media/usb/em28xx/em28xx-cards.c -@@ -2993,16 +2993,6 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev, - } - } - -- if (dev->chip_id == CHIP_ID_EM2870 || -- dev->chip_id == CHIP_ID_EM2874 || -- dev->chip_id == CHIP_ID_EM28174 || -- dev->chip_id == CHIP_ID_EM28178) { -- /* Digital only device - don't load any alsa module */ -- dev->audio_mode.has_audio = false; -- dev->has_audio_class = false; -- dev->has_alsa_audio = false; -- } -- - if (chip_name != default_chip_name) - printk(KERN_INFO DRIVER_NAME - ": chip ID is %s\n", chip_name); -@@ -3272,7 +3262,6 @@ static int em28xx_usb_probe(struct usb_interface *interface, - dev->alt = -1; - dev->is_audio_only = has_audio && !(has_video || has_dvb); - dev->has_alsa_audio = has_audio; -- dev->audio_mode.has_audio = has_audio; - dev->has_video = has_video; - dev->ifnum = ifnum; - -diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c -index 898fb9b..97fd881 100644 ---- a/drivers/media/usb/em28xx/em28xx-core.c -+++ b/drivers/media/usb/em28xx/em28xx-core.c -@@ -506,8 +506,18 @@ int em28xx_audio_setup(struct em28xx *dev) - int vid1, vid2, feat, cfg; - u32 vid; - -- if (!dev->audio_mode.has_audio) -+ if (dev->chip_id == CHIP_ID_EM2870 || -+ dev->chip_id == CHIP_ID_EM2874 || -+ dev->chip_id == CHIP_ID_EM28174 || -+ dev->chip_id == CHIP_ID_EM28178) { -+ /* Digital only device - don't load any alsa module */ -+ dev->audio_mode.has_audio = false; -+ dev->has_audio_class = false; -+ dev->has_alsa_audio = false; - return 0; -+ } -+ -+ dev->audio_mode.has_audio = true; - - /* See how this device is configured */ - cfg = em28xx_read_reg(dev, EM28XX_R00_CHIPCFG); -diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c -index c3c9289..e24ee08 100644 ---- a/drivers/media/usb/em28xx/em28xx-video.c -+++ b/drivers/media/usb/em28xx/em28xx-video.c -@@ -953,13 +953,16 @@ static int em28xx_stop_streaming(struct vb2_queue *vq) - } - - spin_lock_irqsave(&dev->slock, flags); -+ if (dev->usb_ctl.vid_buf != NULL) { -+ vb2_buffer_done(&dev->usb_ctl.vid_buf->vb, VB2_BUF_STATE_ERROR); -+ dev->usb_ctl.vid_buf = NULL; -+ } - while (!list_empty(&vidq->active)) { - struct em28xx_buffer *buf; - buf = list_entry(vidq->active.next, struct em28xx_buffer, list); - list_del(&buf->list); - vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR); - } -- dev->usb_ctl.vid_buf = NULL; - spin_unlock_irqrestore(&dev->slock, flags); - - return 0; -@@ -981,13 +984,16 @@ int em28xx_stop_vbi_streaming(struct vb2_queue *vq) - } - - spin_lock_irqsave(&dev->slock, flags); -+ if (dev->usb_ctl.vbi_buf != NULL) { -+ vb2_buffer_done(&dev->usb_ctl.vbi_buf->vb, VB2_BUF_STATE_ERROR); -+ dev->usb_ctl.vbi_buf = NULL; -+ } - while (!list_empty(&vbiq->active)) { - struct em28xx_buffer *buf; - buf = list_entry(vbiq->active.next, struct em28xx_buffer, list); - list_del(&buf->list); - vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR); - } -- dev->usb_ctl.vbi_buf = NULL; - spin_unlock_irqrestore(&dev->slock, flags); - - return 0; -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index c3bb250..753ad4c 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -2210,6 +2210,15 @@ static struct usb_device_id uvc_ids[] = { - .bInterfaceSubClass = 1, - .bInterfaceProtocol = 0, - .driver_info = UVC_QUIRK_PROBE_DEF }, -+ /* Dell XPS M1330 (OmniVision OV7670 webcam) */ -+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE -+ | USB_DEVICE_ID_MATCH_INT_INFO, -+ .idVendor = 0x05a9, -+ .idProduct = 0x7670, -+ .bInterfaceClass = USB_CLASS_VIDEO, -+ .bInterfaceSubClass = 1, -+ .bInterfaceProtocol = 0, -+ .driver_info = UVC_QUIRK_PROBE_DEF }, - /* Apple Built-In iSight */ - { .match_flags = USB_DEVICE_ID_MATCH_DEVICE - | USB_DEVICE_ID_MATCH_INT_INFO, -diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c -index 433d6d7..c5521ce 100644 ---- a/drivers/media/v4l2-core/v4l2-common.c -+++ b/drivers/media/v4l2-core/v4l2-common.c -@@ -431,16 +431,13 @@ static unsigned int clamp_align(unsigned int x, unsigned int min, - /* Bits that must be zero to be aligned */ - unsigned int mask = ~((1 << align) - 1); - -+ /* Clamp to aligned min and max */ -+ x = clamp(x, (min + ~mask) & mask, max & mask); -+ - /* Round to nearest aligned value */ - if (align) - x = (x + (1 << (align - 1))) & mask; - -- /* Clamp to aligned value of min and max */ -- if (x < min) -- x = (min + ~mask) & mask; -- else if (x > max) -- x = max & mask; -- - return x; - } - -diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c -index 1d15735..89b4c42 100644 ---- a/drivers/mfd/rtsx_pcr.c -+++ b/drivers/mfd/rtsx_pcr.c -@@ -1177,7 +1177,7 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, - pcr->msi_en = msi_en; - if (pcr->msi_en) { - ret = pci_enable_msi(pcidev); -- if (ret < 0) -+ if (ret) - pcr->msi_en = false; - } - -diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c -index d4e8604..e87a248 100644 ---- a/drivers/mfd/ti_am335x_tscadc.c -+++ b/drivers/mfd/ti_am335x_tscadc.c -@@ -54,11 +54,11 @@ void am335x_tsc_se_set_cache(struct ti_tscadc_dev *tsadc, u32 val) - unsigned long flags; - - spin_lock_irqsave(&tsadc->reg_lock, flags); -- tsadc->reg_se_cache = val; -+ tsadc->reg_se_cache |= val; - if (tsadc->adc_waiting) - wake_up(&tsadc->reg_se_wait); - else if (!tsadc->adc_in_use) -- tscadc_writel(tsadc, REG_SE, val); -+ tscadc_writel(tsadc, REG_SE, tsadc->reg_se_cache); - - spin_unlock_irqrestore(&tsadc->reg_lock, flags); - } -@@ -97,6 +97,7 @@ static void am335x_tscadc_need_adc(struct ti_tscadc_dev *tsadc) - void am335x_tsc_se_set_once(struct ti_tscadc_dev *tsadc, u32 val) - { - spin_lock_irq(&tsadc->reg_lock); -+ tsadc->reg_se_cache |= val; - am335x_tscadc_need_adc(tsadc); - - tscadc_writel(tsadc, REG_SE, val); -diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c -index 7e18661..ca297d7 100644 ---- a/drivers/mmc/host/rtsx_pci_sdmmc.c -+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c -@@ -342,6 +342,13 @@ static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host, - } - - if (rsp_type == SD_RSP_TYPE_R2) { -+ /* -+ * The controller offloads the last byte {CRC-7, end bit 1'b1} -+ * of response type R2. Assign dummy CRC, 0, and end bit to the -+ * byte(ptr[16], goes into the LSB of resp[3] later). -+ */ -+ ptr[16] = 1; -+ - for (i = 0; i < 4; i++) { - cmd->resp[i] = get_unaligned_be32(ptr + 1 + i * 4); - dev_dbg(sdmmc_dev(host), "cmd->resp[%d] = 0x%08x\n", -diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c -index 0955777..19bfa0a 100644 ---- a/drivers/mmc/host/sdhci-pci.c -+++ b/drivers/mmc/host/sdhci-pci.c -@@ -103,6 +103,10 @@ static const struct sdhci_pci_fixes sdhci_cafe = { - SDHCI_QUIRK_BROKEN_TIMEOUT_VAL, - }; - -+static const struct sdhci_pci_fixes sdhci_intel_qrk = { -+ .quirks = SDHCI_QUIRK_NO_HISPD_BIT, -+}; -+ - static int mrst_hc_probe_slot(struct sdhci_pci_slot *slot) - { - slot->host->mmc->caps |= MMC_CAP_8_BIT_DATA; -@@ -733,6 +737,14 @@ static const struct pci_device_id pci_ids[] = { - - { - .vendor = PCI_VENDOR_ID_INTEL, -+ .device = PCI_DEVICE_ID_INTEL_QRK_SD, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .driver_data = (kernel_ulong_t)&sdhci_intel_qrk, -+ }, -+ -+ { -+ .vendor = PCI_VENDOR_ID_INTEL, - .device = PCI_DEVICE_ID_INTEL_MRST_SD0, - .subvendor = PCI_ANY_ID, - .subdevice = PCI_ANY_ID, -diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h -index 6d71871..c101477 100644 ---- a/drivers/mmc/host/sdhci-pci.h -+++ b/drivers/mmc/host/sdhci-pci.h -@@ -17,6 +17,7 @@ - #define PCI_DEVICE_ID_INTEL_CLV_SDIO2 0x08fb - #define PCI_DEVICE_ID_INTEL_CLV_EMMC0 0x08e5 - #define PCI_DEVICE_ID_INTEL_CLV_EMMC1 0x08e6 -+#define PCI_DEVICE_ID_INTEL_QRK_SD 0x08A7 - - /* - * PCI registers -diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c -index c5dad65..904b451 100644 ---- a/drivers/mtd/ubi/fastmap.c -+++ b/drivers/mtd/ubi/fastmap.c -@@ -330,6 +330,7 @@ static int process_pool_aeb(struct ubi_device *ubi, struct ubi_attach_info *ai, - av = tmp_av; - else { - ubi_err("orphaned volume in fastmap pool!"); -+ kmem_cache_free(ai->aeb_slab_cache, new_aeb); - return UBI_BAD_FASTMAP; - } - -diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig -index 494b888..7e5c6a8 100644 ---- a/drivers/net/Kconfig -+++ b/drivers/net/Kconfig -@@ -135,6 +135,7 @@ config MACVLAN - config MACVTAP - tristate "MAC-VLAN based tap driver" - depends on MACVLAN -+ depends on INET - help - This adds a specialized tap character device driver that is based - on the MAC-VLAN network interface, called macvtap. A macvtap device -@@ -205,6 +206,7 @@ config RIONET_RX_SIZE - - config TUN - tristate "Universal TUN/TAP device driver support" -+ depends on INET - select CRC32 - ---help--- - TUN/TAP provides packet reception and transmission for user space -diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c -index 0c6adaa..f30ceb1 100644 ---- a/drivers/net/macvtap.c -+++ b/drivers/net/macvtap.c -@@ -16,6 +16,7 @@ - #include <linux/idr.h> - #include <linux/fs.h> - -+#include <net/ipv6.h> - #include <net/net_namespace.h> - #include <net/rtnetlink.h> - #include <net/sock.h> -@@ -65,7 +66,7 @@ static struct cdev macvtap_cdev; - static const struct proto_ops macvtap_socket_ops; - - #define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \ -- NETIF_F_TSO6 | NETIF_F_UFO) -+ NETIF_F_TSO6) - #define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO) - #define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG) - -@@ -569,7 +570,11 @@ static int macvtap_skb_from_vnet_hdr(struct sk_buff *skb, - gso_type = SKB_GSO_TCPV6; - break; - case VIRTIO_NET_HDR_GSO_UDP: -+ pr_warn_once("macvtap: %s: using disabled UFO feature; please fix this program\n", -+ current->comm); - gso_type = SKB_GSO_UDP; -+ if (skb->protocol == htons(ETH_P_IPV6)) -+ ipv6_proxy_select_ident(skb); - break; - default: - return -EINVAL; -@@ -614,8 +619,6 @@ static void macvtap_skb_to_vnet_hdr(const struct sk_buff *skb, - vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV4; - else if (sinfo->gso_type & SKB_GSO_TCPV6) - vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV6; -- else if (sinfo->gso_type & SKB_GSO_UDP) -- vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_UDP; - else - BUG(); - if (sinfo->gso_type & SKB_GSO_TCP_ECN) -@@ -950,9 +953,6 @@ static int set_offload(struct macvtap_queue *q, unsigned long arg) - if (arg & TUN_F_TSO6) - feature_mask |= NETIF_F_TSO6; - } -- -- if (arg & TUN_F_UFO) -- feature_mask |= NETIF_F_UFO; - } - - /* tun/tap driver inverts the usage for TSO offloads, where -@@ -963,7 +963,7 @@ static int set_offload(struct macvtap_queue *q, unsigned long arg) - * When user space turns off TSO, we turn off GSO/LRO so that - * user-space will not receive TSO frames. - */ -- if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_UFO)) -+ if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6)) - features |= RX_OFFLOADS; - else - features &= ~RX_OFFLOADS; -@@ -1064,7 +1064,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd, - case TUNSETOFFLOAD: - /* let the user check for future flags */ - if (arg & ~(TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 | -- TUN_F_TSO_ECN | TUN_F_UFO)) -+ TUN_F_TSO_ECN)) - return -EINVAL; - - rtnl_lock(); -diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index 72ff14b..5a1897d 100644 ---- a/drivers/net/ppp/ppp_generic.c -+++ b/drivers/net/ppp/ppp_generic.c -@@ -601,7 +601,7 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - if (file == ppp->owner) - ppp_shutdown_interface(ppp); - } -- if (atomic_long_read(&file->f_count) <= 2) { -+ if (atomic_long_read(&file->f_count) < 2) { - ppp_release(NULL, file); - err = 0; - } else -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index 26f8635..2c8b1c2 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -65,6 +65,7 @@ - #include <linux/nsproxy.h> - #include <linux/virtio_net.h> - #include <linux/rcupdate.h> -+#include <net/ipv6.h> - #include <net/net_namespace.h> - #include <net/netns/generic.h> - #include <net/rtnetlink.h> -@@ -174,7 +175,7 @@ struct tun_struct { - struct net_device *dev; - netdev_features_t set_features; - #define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \ -- NETIF_F_TSO6|NETIF_F_UFO) -+ NETIF_F_TSO6) - - int vnet_hdr_sz; - int sndbuf; -@@ -1140,6 +1141,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, - break; - } - -+ skb_reset_network_header(skb); -+ - if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) { - pr_debug("GSO!\n"); - switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { -@@ -1150,8 +1153,20 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, - skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6; - break; - case VIRTIO_NET_HDR_GSO_UDP: -+ { -+ static bool warned; -+ -+ if (!warned) { -+ warned = true; -+ netdev_warn(tun->dev, -+ "%s: using disabled UFO feature; please fix this program\n", -+ current->comm); -+ } - skb_shinfo(skb)->gso_type = SKB_GSO_UDP; -+ if (skb->protocol == htons(ETH_P_IPV6)) -+ ipv6_proxy_select_ident(skb); - break; -+ } - default: - tun->dev->stats.rx_frame_errors++; - kfree_skb(skb); -@@ -1180,7 +1195,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, - skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG; - } - -- skb_reset_network_header(skb); - skb_probe_transport_header(skb, 0); - - rxhash = skb_get_hash(skb); -@@ -1252,8 +1266,6 @@ static ssize_t tun_put_user(struct tun_struct *tun, - gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4; - else if (sinfo->gso_type & SKB_GSO_TCPV6) - gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6; -- else if (sinfo->gso_type & SKB_GSO_UDP) -- gso.gso_type = VIRTIO_NET_HDR_GSO_UDP; - else { - pr_err("unexpected GSO type: " - "0x%x, gso_size %d, hdr_len %d\n", -@@ -1783,11 +1795,6 @@ static int set_offload(struct tun_struct *tun, unsigned long arg) - features |= NETIF_F_TSO6; - arg &= ~(TUN_F_TSO4|TUN_F_TSO6); - } -- -- if (arg & TUN_F_UFO) { -- features |= NETIF_F_UFO; -- arg &= ~TUN_F_UFO; -- } - } - - /* This gives the user a way to test for new features in future by -diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c -index 054e59c..8cee173 100644 ---- a/drivers/net/usb/ax88179_178a.c -+++ b/drivers/net/usb/ax88179_178a.c -@@ -696,6 +696,7 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p) - { - struct usbnet *dev = netdev_priv(net); - struct sockaddr *addr = p; -+ int ret; - - if (netif_running(net)) - return -EBUSY; -@@ -705,8 +706,12 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p) - memcpy(net->dev_addr, addr->sa_data, ETH_ALEN); - - /* Set the MAC address */ -- return ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, -+ ret = ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, - ETH_ALEN, net->dev_addr); -+ if (ret < 0) -+ return ret; -+ -+ return 0; - } - - static const struct net_device_ops ax88179_netdev_ops = { -diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index 841b608..07a3255 100644 ---- a/drivers/net/virtio_net.c -+++ b/drivers/net/virtio_net.c -@@ -496,8 +496,17 @@ static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len) - skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4; - break; - case VIRTIO_NET_HDR_GSO_UDP: -+ { -+ static bool warned; -+ -+ if (!warned) { -+ warned = true; -+ netdev_warn(dev, -+ "host using disabled UFO feature; please fix it\n"); -+ } - skb_shinfo(skb)->gso_type = SKB_GSO_UDP; - break; -+ } - case VIRTIO_NET_HDR_GSO_TCPV6: - skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6; - break; -@@ -836,8 +845,6 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb) - hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV4; - else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) - hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV6; -- else if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP) -- hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_UDP; - else - BUG(); - if (skb_shinfo(skb)->gso_type & SKB_GSO_TCP_ECN) -@@ -1657,7 +1664,7 @@ static int virtnet_probe(struct virtio_device *vdev) - dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST; - - if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) { -- dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO -+ dev->hw_features |= NETIF_F_TSO - | NETIF_F_TSO_ECN | NETIF_F_TSO6; - } - /* Individual feature bits: what can host handle? */ -@@ -1667,11 +1674,9 @@ static int virtnet_probe(struct virtio_device *vdev) - dev->hw_features |= NETIF_F_TSO6; - if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_ECN)) - dev->hw_features |= NETIF_F_TSO_ECN; -- if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_UFO)) -- dev->hw_features |= NETIF_F_UFO; - - if (gso) -- dev->features |= dev->hw_features & (NETIF_F_ALL_TSO|NETIF_F_UFO); -+ dev->features |= dev->hw_features & NETIF_F_ALL_TSO; - /* (!csum && gso) case will be fixed by register_netdev() */ - } - if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_CSUM)) -@@ -1711,8 +1716,7 @@ static int virtnet_probe(struct virtio_device *vdev) - /* If we can receive ANY GSO packets, we must allocate large ones. */ - if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) || - virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) || -- virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) || -- virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO)) -+ virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN)) - vi->big_packets = true; - - if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF)) -@@ -1903,9 +1907,9 @@ static struct virtio_device_id id_table[] = { - static unsigned int features[] = { - VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM, - VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC, -- VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6, -+ VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_TSO6, - VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6, -- VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO, -+ VIRTIO_NET_F_GUEST_ECN, - VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ, - VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN, - VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ, -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index 9b40532..0704a04 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -1447,9 +1447,6 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb) - if (!in6_dev) - goto out; - -- if (!pskb_may_pull(skb, skb->len)) -- goto out; -- - iphdr = ipv6_hdr(skb); - saddr = &iphdr->saddr; - daddr = &iphdr->daddr; -@@ -1770,6 +1767,8 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan, - struct pcpu_sw_netstats *tx_stats, *rx_stats; - union vxlan_addr loopback; - union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip; -+ struct net_device *dev = skb->dev; -+ int len = skb->len; - - tx_stats = this_cpu_ptr(src_vxlan->dev->tstats); - rx_stats = this_cpu_ptr(dst_vxlan->dev->tstats); -@@ -1793,16 +1792,16 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan, - - u64_stats_update_begin(&tx_stats->syncp); - tx_stats->tx_packets++; -- tx_stats->tx_bytes += skb->len; -+ tx_stats->tx_bytes += len; - u64_stats_update_end(&tx_stats->syncp); - - if (netif_rx(skb) == NET_RX_SUCCESS) { - u64_stats_update_begin(&rx_stats->syncp); - rx_stats->rx_packets++; -- rx_stats->rx_bytes += skb->len; -+ rx_stats->rx_bytes += len; - u64_stats_update_end(&rx_stats->syncp); - } else { -- skb->dev->stats.rx_dropped++; -+ dev->stats.rx_dropped++; - } - } - -@@ -1977,7 +1976,8 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) - return arp_reduce(dev, skb); - #if IS_ENABLED(CONFIG_IPV6) - else if (ntohs(eth->h_proto) == ETH_P_IPV6 && -- skb->len >= sizeof(struct ipv6hdr) + sizeof(struct nd_msg) && -+ pskb_may_pull(skb, sizeof(struct ipv6hdr) -+ + sizeof(struct nd_msg)) && - ipv6_hdr(skb)->nexthdr == IPPROTO_ICMPV6) { - struct nd_msg *msg; - -@@ -1986,6 +1986,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) - msg->icmph.icmp6_type == NDISC_NEIGHBOUR_SOLICITATION) - return neigh_reduce(dev, skb); - } -+ eth = eth_hdr(skb); - #endif - } - -diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c -index 2ca62af..76ee486 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/tx.c -+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c -@@ -173,14 +173,10 @@ static void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm, - - /* - * for data packets, rate info comes from the table inside the fw. This -- * table is controlled by LINK_QUALITY commands. Exclude ctrl port -- * frames like EAPOLs which should be treated as mgmt frames. This -- * avoids them being sent initially in high rates which increases the -- * chances for completion of the 4-Way handshake. -+ * table is controlled by LINK_QUALITY commands - */ - -- if (ieee80211_is_data(fc) && sta && -- !(info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO)) { -+ if (ieee80211_is_data(fc) && sta) { - tx_cmd->initial_rate_index = 0; - tx_cmd->tx_flags |= cpu_to_le32(TX_CMD_FLG_STA_RATE); - return; -diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h -index 7cf6081..ebd5625 100644 ---- a/drivers/net/wireless/rt2x00/rt2800.h -+++ b/drivers/net/wireless/rt2x00/rt2800.h -@@ -52,6 +52,7 @@ - * RF5592 2.4G/5G 2T2R - * RF3070 2.4G 1T1R - * RF5360 2.4G 1T1R -+ * RF5362 2.4G 1T1R - * RF5370 2.4G 1T1R - * RF5390 2.4G 1T1R - */ -@@ -72,6 +73,7 @@ - #define RF3070 0x3070 - #define RF3290 0x3290 - #define RF5360 0x5360 -+#define RF5362 0x5362 - #define RF5370 0x5370 - #define RF5372 0x5372 - #define RF5390 0x5390 -@@ -2145,7 +2147,7 @@ struct mac_iveiv_entry { - /* Bits [7-4] for RF3320 (RT3370/RT3390), on other chipsets reserved */ - #define RFCSR3_PA1_BIAS_CCK FIELD8(0x70) - #define RFCSR3_PA2_CASCODE_BIAS_CCKK FIELD8(0x80) --/* Bits for RF3290/RF5360/RF5370/RF5372/RF5390/RF5392 */ -+/* Bits for RF3290/RF5360/RF5362/RF5370/RF5372/RF5390/RF5392 */ - #define RFCSR3_VCOCAL_EN FIELD8(0x80) - /* Bits for RF3050 */ - #define RFCSR3_BIT1 FIELD8(0x02) -diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c -index 41d4a81..4e16d4d 100644 ---- a/drivers/net/wireless/rt2x00/rt2800lib.c -+++ b/drivers/net/wireless/rt2x00/rt2800lib.c -@@ -3142,6 +3142,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev, - break; - case RF3070: - case RF5360: -+ case RF5362: - case RF5370: - case RF5372: - case RF5390: -@@ -3159,6 +3160,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev, - rt2x00_rf(rt2x00dev, RF3290) || - rt2x00_rf(rt2x00dev, RF3322) || - rt2x00_rf(rt2x00dev, RF5360) || -+ rt2x00_rf(rt2x00dev, RF5362) || - rt2x00_rf(rt2x00dev, RF5370) || - rt2x00_rf(rt2x00dev, RF5372) || - rt2x00_rf(rt2x00dev, RF5390) || -@@ -4273,6 +4275,7 @@ void rt2800_vco_calibration(struct rt2x00_dev *rt2x00dev) - case RF3070: - case RF3290: - case RF5360: -+ case RF5362: - case RF5370: - case RF5372: - case RF5390: -@@ -7073,6 +7076,7 @@ static int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev) - case RF3320: - case RF3322: - case RF5360: -+ case RF5362: - case RF5370: - case RF5372: - case RF5390: -@@ -7529,6 +7533,7 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev) - case RF3320: - case RF3322: - case RF5360: -+ case RF5362: - case RF5370: - case RF5372: - case RF5390: -@@ -7658,6 +7663,7 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev) - case RF3070: - case RF3290: - case RF5360: -+ case RF5362: - case RF5370: - case RF5372: - case RF5390: -diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c -index caddc1b..57d3967 100644 ---- a/drivers/net/wireless/rt2x00/rt2800usb.c -+++ b/drivers/net/wireless/rt2x00/rt2800usb.c -@@ -1062,6 +1062,7 @@ static struct usb_device_id rt2800usb_device_table[] = { - /* Ovislink */ - { USB_DEVICE(0x1b75, 0x3071) }, - { USB_DEVICE(0x1b75, 0x3072) }, -+ { USB_DEVICE(0x1b75, 0xa200) }, - /* Para */ - { USB_DEVICE(0x20b8, 0x8888) }, - /* Pegatron */ -@@ -1235,6 +1236,8 @@ static struct usb_device_id rt2800usb_device_table[] = { - /* Arcadyan */ - { USB_DEVICE(0x043e, 0x7a12) }, - { USB_DEVICE(0x043e, 0x7a32) }, -+ /* ASUS */ -+ { USB_DEVICE(0x0b05, 0x17e8) }, - /* Azurewave */ - { USB_DEVICE(0x13d3, 0x3329) }, - { USB_DEVICE(0x13d3, 0x3365) }, -@@ -1271,6 +1274,7 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x057c, 0x8501) }, - /* Buffalo */ - { USB_DEVICE(0x0411, 0x0241) }, -+ { USB_DEVICE(0x0411, 0x0253) }, - /* D-Link */ - { USB_DEVICE(0x2001, 0x3c1a) }, - { USB_DEVICE(0x2001, 0x3c21) }, -@@ -1361,6 +1365,7 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x0df6, 0x0053) }, - { USB_DEVICE(0x0df6, 0x0069) }, - { USB_DEVICE(0x0df6, 0x006f) }, -+ { USB_DEVICE(0x0df6, 0x0078) }, - /* SMC */ - { USB_DEVICE(0x083a, 0xa512) }, - { USB_DEVICE(0x083a, 0xc522) }, -diff --git a/drivers/of/base.c b/drivers/of/base.c -index 89e888a..3935614 100644 ---- a/drivers/of/base.c -+++ b/drivers/of/base.c -@@ -1117,52 +1117,6 @@ int of_property_read_string(struct device_node *np, const char *propname, - EXPORT_SYMBOL_GPL(of_property_read_string); - - /** -- * of_property_read_string_index - Find and read a string from a multiple -- * strings property. -- * @np: device node from which the property value is to be read. -- * @propname: name of the property to be searched. -- * @index: index of the string in the list of strings -- * @out_string: pointer to null terminated return string, modified only if -- * return value is 0. -- * -- * Search for a property in a device tree node and retrieve a null -- * terminated string value (pointer to data, not a copy) in the list of strings -- * contained in that property. -- * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if -- * property does not have a value, and -EILSEQ if the string is not -- * null-terminated within the length of the property data. -- * -- * The out_string pointer is modified only if a valid string can be decoded. -- */ --int of_property_read_string_index(struct device_node *np, const char *propname, -- int index, const char **output) --{ -- struct property *prop = of_find_property(np, propname, NULL); -- int i = 0; -- size_t l = 0, total = 0; -- const char *p; -- -- if (!prop) -- return -EINVAL; -- if (!prop->value) -- return -ENODATA; -- if (strnlen(prop->value, prop->length) >= prop->length) -- return -EILSEQ; -- -- p = prop->value; -- -- for (i = 0; total < prop->length; total += l, p += l) { -- l = strlen(p) + 1; -- if (i++ == index) { -- *output = p; -- return 0; -- } -- } -- return -ENODATA; --} --EXPORT_SYMBOL_GPL(of_property_read_string_index); -- --/** - * of_property_match_string() - Find string in a list and return index - * @np: pointer to node containing string list property - * @propname: string list property name -@@ -1188,7 +1142,7 @@ int of_property_match_string(struct device_node *np, const char *propname, - end = p + prop->length; - - for (i = 0; p < end; i++, p += l) { -- l = strlen(p) + 1; -+ l = strnlen(p, end - p) + 1; - if (p + l > end) - return -EILSEQ; - pr_debug("comparing %s with %s\n", string, p); -@@ -1200,39 +1154,41 @@ int of_property_match_string(struct device_node *np, const char *propname, - EXPORT_SYMBOL_GPL(of_property_match_string); - - /** -- * of_property_count_strings - Find and return the number of strings from a -- * multiple strings property. -+ * of_property_read_string_util() - Utility helper for parsing string properties - * @np: device node from which the property value is to be read. - * @propname: name of the property to be searched. -+ * @out_strs: output array of string pointers. -+ * @sz: number of array elements to read. -+ * @skip: Number of strings to skip over at beginning of list. - * -- * Search for a property in a device tree node and retrieve the number of null -- * terminated string contain in it. Returns the number of strings on -- * success, -EINVAL if the property does not exist, -ENODATA if property -- * does not have a value, and -EILSEQ if the string is not null-terminated -- * within the length of the property data. -+ * Don't call this function directly. It is a utility helper for the -+ * of_property_read_string*() family of functions. - */ --int of_property_count_strings(struct device_node *np, const char *propname) -+int of_property_read_string_helper(struct device_node *np, const char *propname, -+ const char **out_strs, size_t sz, int skip) - { - struct property *prop = of_find_property(np, propname, NULL); -- int i = 0; -- size_t l = 0, total = 0; -- const char *p; -+ int l = 0, i = 0; -+ const char *p, *end; - - if (!prop) - return -EINVAL; - if (!prop->value) - return -ENODATA; -- if (strnlen(prop->value, prop->length) >= prop->length) -- return -EILSEQ; -- - p = prop->value; -+ end = p + prop->length; - -- for (i = 0; total < prop->length; total += l, p += l, i++) -- l = strlen(p) + 1; -- -- return i; -+ for (i = 0; p < end && (!out_strs || i < skip + sz); i++, p += l) { -+ l = strnlen(p, end - p) + 1; -+ if (p + l > end) -+ return -EILSEQ; -+ if (out_strs && i >= skip) -+ *out_strs++ = p; -+ } -+ i -= skip; -+ return i <= 0 ? -ENODATA : i; - } --EXPORT_SYMBOL_GPL(of_property_count_strings); -+EXPORT_SYMBOL_GPL(of_property_read_string_helper); - - void of_print_phandle_args(const char *msg, const struct of_phandle_args *args) - { -diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c -index 6643d19..70c61d7 100644 ---- a/drivers/of/selftest.c -+++ b/drivers/of/selftest.c -@@ -132,8 +132,9 @@ static void __init of_selftest_parse_phandle_with_args(void) - selftest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc); - } - --static void __init of_selftest_property_match_string(void) -+static void __init of_selftest_property_string(void) - { -+ const char *strings[4]; - struct device_node *np; - int rc; - -@@ -150,13 +151,66 @@ static void __init of_selftest_property_match_string(void) - rc = of_property_match_string(np, "phandle-list-names", "third"); - selftest(rc == 2, "third expected:0 got:%i\n", rc); - rc = of_property_match_string(np, "phandle-list-names", "fourth"); -- selftest(rc == -ENODATA, "unmatched string; rc=%i", rc); -+ selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc); - rc = of_property_match_string(np, "missing-property", "blah"); -- selftest(rc == -EINVAL, "missing property; rc=%i", rc); -+ selftest(rc == -EINVAL, "missing property; rc=%i\n", rc); - rc = of_property_match_string(np, "empty-property", "blah"); -- selftest(rc == -ENODATA, "empty property; rc=%i", rc); -+ selftest(rc == -ENODATA, "empty property; rc=%i\n", rc); - rc = of_property_match_string(np, "unterminated-string", "blah"); -- selftest(rc == -EILSEQ, "unterminated string; rc=%i", rc); -+ selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); -+ -+ /* of_property_count_strings() tests */ -+ rc = of_property_count_strings(np, "string-property"); -+ selftest(rc == 1, "Incorrect string count; rc=%i\n", rc); -+ rc = of_property_count_strings(np, "phandle-list-names"); -+ selftest(rc == 3, "Incorrect string count; rc=%i\n", rc); -+ rc = of_property_count_strings(np, "unterminated-string"); -+ selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); -+ rc = of_property_count_strings(np, "unterminated-string-list"); -+ selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc); -+ -+ /* of_property_read_string_index() tests */ -+ rc = of_property_read_string_index(np, "string-property", 0, strings); -+ selftest(rc == 0 && !strcmp(strings[0], "foobar"), "of_property_read_string_index() failure; rc=%i\n", rc); -+ strings[0] = NULL; -+ rc = of_property_read_string_index(np, "string-property", 1, strings); -+ selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); -+ rc = of_property_read_string_index(np, "phandle-list-names", 0, strings); -+ selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc); -+ rc = of_property_read_string_index(np, "phandle-list-names", 1, strings); -+ selftest(rc == 0 && !strcmp(strings[0], "second"), "of_property_read_string_index() failure; rc=%i\n", rc); -+ rc = of_property_read_string_index(np, "phandle-list-names", 2, strings); -+ selftest(rc == 0 && !strcmp(strings[0], "third"), "of_property_read_string_index() failure; rc=%i\n", rc); -+ strings[0] = NULL; -+ rc = of_property_read_string_index(np, "phandle-list-names", 3, strings); -+ selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); -+ strings[0] = NULL; -+ rc = of_property_read_string_index(np, "unterminated-string", 0, strings); -+ selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); -+ rc = of_property_read_string_index(np, "unterminated-string-list", 0, strings); -+ selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc); -+ strings[0] = NULL; -+ rc = of_property_read_string_index(np, "unterminated-string-list", 2, strings); /* should fail */ -+ selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); -+ strings[1] = NULL; -+ -+ /* of_property_read_string_array() tests */ -+ rc = of_property_read_string_array(np, "string-property", strings, 4); -+ selftest(rc == 1, "Incorrect string count; rc=%i\n", rc); -+ rc = of_property_read_string_array(np, "phandle-list-names", strings, 4); -+ selftest(rc == 3, "Incorrect string count; rc=%i\n", rc); -+ rc = of_property_read_string_array(np, "unterminated-string", strings, 4); -+ selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); -+ /* -- An incorrectly formed string should cause a failure */ -+ rc = of_property_read_string_array(np, "unterminated-string-list", strings, 4); -+ selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc); -+ /* -- parsing the correctly formed strings should still work: */ -+ strings[2] = NULL; -+ rc = of_property_read_string_array(np, "unterminated-string-list", strings, 2); -+ selftest(rc == 2 && strings[2] == NULL, "of_property_read_string_array() failure; rc=%i\n", rc); -+ strings[1] = NULL; -+ rc = of_property_read_string_array(np, "phandle-list-names", strings, 1); -+ selftest(rc == 1 && strings[1] == NULL, "Overwrote end of string array; rc=%i, str='%s'\n", rc, strings[1]); - } - - static void __init of_selftest_parse_interrupts(void) -@@ -379,7 +433,7 @@ static int __init of_selftest(void) - - pr_info("start of selftest - you will see error messages\n"); - of_selftest_parse_phandle_with_args(); -- of_selftest_property_match_string(); -+ of_selftest_property_string(); - of_selftest_parse_interrupts(); - of_selftest_parse_interrupts_extended(); - of_selftest_match_node(); -diff --git a/drivers/of/testcase-data/tests-phandle.dtsi b/drivers/of/testcase-data/tests-phandle.dtsi -index 0007d3c..eedee37 100644 ---- a/drivers/of/testcase-data/tests-phandle.dtsi -+++ b/drivers/of/testcase-data/tests-phandle.dtsi -@@ -32,7 +32,9 @@ - phandle-list-bad-args = <&provider2 1 0>, - <&provider3 0>; - empty-property; -+ string-property = "foobar"; - unterminated-string = [40 41 42 43]; -+ unterminated-string-list = "first", "second", [40 41 42 43]; - }; - }; - }; -diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c -index 39a207a..a943c6c 100644 ---- a/drivers/pci/pci-sysfs.c -+++ b/drivers/pci/pci-sysfs.c -@@ -186,9 +186,9 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr, - } - static DEVICE_ATTR_RO(modalias); - --static ssize_t enabled_store(struct device *dev, -- struct device_attribute *attr, const char *buf, -- size_t count) -+static ssize_t enable_store(struct device *dev, -+ struct device_attribute *attr, const char *buf, -+ size_t count) - { - struct pci_dev *pdev = to_pci_dev(dev); - unsigned long val; -@@ -212,15 +212,15 @@ static ssize_t enabled_store(struct device *dev, - return result < 0 ? result : count; - } - --static ssize_t enabled_show(struct device *dev, -- struct device_attribute *attr, char *buf) -+static ssize_t enable_show(struct device *dev, -+ struct device_attribute *attr, char *buf) - { - struct pci_dev *pdev; - - pdev = to_pci_dev (dev); - return sprintf (buf, "%u\n", atomic_read(&pdev->enable_cnt)); - } --static DEVICE_ATTR_RW(enabled); -+static DEVICE_ATTR_RW(enable); - - #ifdef CONFIG_NUMA - static ssize_t -@@ -526,7 +526,7 @@ static struct attribute *pci_dev_attrs[] = { - #endif - &dev_attr_dma_mask_bits.attr, - &dev_attr_consistent_dma_mask_bits.attr, -- &dev_attr_enabled.attr, -+ &dev_attr_enable.attr, - &dev_attr_broken_parity_status.attr, - &dev_attr_msi_bus.attr, - #if defined(CONFIG_PM_RUNTIME) && defined(CONFIG_ACPI) -diff --git a/drivers/pinctrl/pinctrl-baytrail.c b/drivers/pinctrl/pinctrl-baytrail.c -index 665b96b..eb9f190 100644 ---- a/drivers/pinctrl/pinctrl-baytrail.c -+++ b/drivers/pinctrl/pinctrl-baytrail.c -@@ -263,7 +263,7 @@ static int byt_gpio_direction_output(struct gpio_chip *chip, - spin_lock_irqsave(&vg->lock, flags); - - reg_val = readl(reg) | BYT_DIR_MASK; -- reg_val &= ~BYT_OUTPUT_EN; -+ reg_val &= ~(BYT_OUTPUT_EN | BYT_INPUT_EN); - - if (value) - writel(reg_val | BYT_LEVEL, reg); -diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c -index c91f69b3..dcfcaea 100644 ---- a/drivers/platform/x86/acer-wmi.c -+++ b/drivers/platform/x86/acer-wmi.c -@@ -570,6 +570,17 @@ static const struct dmi_system_id video_vendor_dmi_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5750"), - }, - }, -+ { -+ /* -+ * Note no video_set_backlight_video_vendor, we must use the -+ * acer interface, as there is no native backlight interface. -+ */ -+ .ident = "Acer KAV80", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "KAV80"), -+ }, -+ }, - {} - }; - -diff --git a/drivers/power/charger-manager.c b/drivers/power/charger-manager.c -index 9e4dab4..ef1f4c9 100644 ---- a/drivers/power/charger-manager.c -+++ b/drivers/power/charger-manager.c -@@ -1720,6 +1720,11 @@ static int charger_manager_probe(struct platform_device *pdev) - return -EINVAL; - } - -+ if (!desc->psy_fuel_gauge) { -+ dev_err(&pdev->dev, "No fuel gauge power supply defined\n"); -+ return -EINVAL; -+ } -+ - /* Counting index only */ - while (desc->psy_charger_stat[i]) - i++; -diff --git a/drivers/regulator/max77693.c b/drivers/regulator/max77693.c -index 5fb899f..24c926bf 100644 ---- a/drivers/regulator/max77693.c -+++ b/drivers/regulator/max77693.c -@@ -232,7 +232,7 @@ static int max77693_pmic_probe(struct platform_device *pdev) - struct max77693_pmic_dev *max77693_pmic; - struct max77693_regulator_data *rdata = NULL; - int num_rdata, i; -- struct regulator_config config; -+ struct regulator_config config = { }; - - num_rdata = max77693_pmic_init_rdata(&pdev->dev, &rdata); - if (!rdata || num_rdata <= 0) { -diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -index 788c4fe..9d81f76 100644 ---- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c -+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -@@ -707,7 +707,16 @@ static void tcm_qla2xxx_clear_nacl_from_fcport_map(struct qla_tgt_sess *sess) - pr_debug("fc_rport domain: port_id 0x%06x\n", nacl->nport_id); - - node = btree_remove32(&lport->lport_fcport_map, nacl->nport_id); -- WARN_ON(node && (node != se_nacl)); -+ if (WARN_ON(node && (node != se_nacl))) { -+ /* -+ * The nacl no longer matches what we think it should be. -+ * Most likely a new dynamic acl has been added while -+ * someone dropped the hardware lock. It clearly is a -+ * bug elsewhere, but this bit can't make things worse. -+ */ -+ btree_insert32(&lport->lport_fcport_map, nacl->nport_id, -+ node, GFP_ATOMIC); -+ } - - pr_debug("Removed from fcport_map: %p for WWNN: 0x%016LX, port_id: 0x%06x\n", - se_nacl, nacl->nport_wwnn, nacl->nport_id); -diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c -index a253920..a5db6f9 100644 ---- a/drivers/spi/spi-fsl-dspi.c -+++ b/drivers/spi/spi-fsl-dspi.c -@@ -45,7 +45,7 @@ - - #define SPI_TCR 0x08 - --#define SPI_CTAR(x) (0x0c + (x * 4)) -+#define SPI_CTAR(x) (0x0c + (((x) & 0x3) * 4)) - #define SPI_CTAR_FMSZ(x) (((x) & 0x0000000f) << 27) - #define SPI_CTAR_CPOL(x) ((x) << 26) - #define SPI_CTAR_CPHA(x) ((x) << 25) -@@ -69,7 +69,7 @@ - - #define SPI_PUSHR 0x34 - #define SPI_PUSHR_CONT (1 << 31) --#define SPI_PUSHR_CTAS(x) (((x) & 0x00000007) << 28) -+#define SPI_PUSHR_CTAS(x) (((x) & 0x00000003) << 28) - #define SPI_PUSHR_EOQ (1 << 27) - #define SPI_PUSHR_CTCNT (1 << 26) - #define SPI_PUSHR_PCS(x) (((1 << x) & 0x0000003f) << 16) -diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c -index 2789b45..971855e 100644 ---- a/drivers/spi/spi-pl022.c -+++ b/drivers/spi/spi-pl022.c -@@ -1075,7 +1075,7 @@ err_rxdesc: - pl022->sgt_tx.nents, DMA_TO_DEVICE); - err_tx_sgmap: - dma_unmap_sg(rxchan->device->dev, pl022->sgt_rx.sgl, -- pl022->sgt_tx.nents, DMA_FROM_DEVICE); -+ pl022->sgt_rx.nents, DMA_FROM_DEVICE); - err_rx_sgmap: - sg_free_table(&pl022->sgt_tx); - err_alloc_tx_sg: -diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c -index ced9ecf..7ab3ccb 100644 ---- a/drivers/spi/spi-pxa2xx.c -+++ b/drivers/spi/spi-pxa2xx.c -@@ -1280,7 +1280,9 @@ static int pxa2xx_spi_suspend(struct device *dev) - if (status != 0) - return status; - write_SSCR0(0, drv_data->ioaddr); -- clk_disable_unprepare(ssp->clk); -+ -+ if (!pm_runtime_suspended(dev)) -+ clk_disable_unprepare(ssp->clk); - - return 0; - } -@@ -1294,7 +1296,8 @@ static int pxa2xx_spi_resume(struct device *dev) - pxa2xx_spi_dma_resume(drv_data); - - /* Enable the SSP clock */ -- clk_prepare_enable(ssp->clk); -+ if (!pm_runtime_suspended(dev)) -+ clk_prepare_enable(ssp->clk); - - /* Restore LPSS private register bits */ - lpss_ssp_setup(drv_data); -diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c -index 2b96665..97d4b3f 100644 ---- a/drivers/staging/iio/impedance-analyzer/ad5933.c -+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c -@@ -115,6 +115,7 @@ static const struct iio_chan_spec ad5933_channels[] = { - .channel = 0, - .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED), - .address = AD5933_REG_TEMP_DATA, -+ .scan_index = -1, - .scan_type = { - .sign = 's', - .realbits = 14, -@@ -124,9 +125,7 @@ static const struct iio_chan_spec ad5933_channels[] = { - .type = IIO_VOLTAGE, - .indexed = 1, - .channel = 0, -- .extend_name = "real_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | -- BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "real", - .address = AD5933_REG_REAL_DATA, - .scan_index = 0, - .scan_type = { -@@ -138,9 +137,7 @@ static const struct iio_chan_spec ad5933_channels[] = { - .type = IIO_VOLTAGE, - .indexed = 1, - .channel = 0, -- .extend_name = "imag_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | -- BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "imag", - .address = AD5933_REG_IMAG_DATA, - .scan_index = 1, - .scan_type = { -@@ -748,14 +745,14 @@ static int ad5933_probe(struct i2c_client *client, - indio_dev->name = id->name; - indio_dev->modes = INDIO_DIRECT_MODE; - indio_dev->channels = ad5933_channels; -- indio_dev->num_channels = 1; /* only register temp0_input */ -+ indio_dev->num_channels = ARRAY_SIZE(ad5933_channels); - - ret = ad5933_register_ring_funcs_and_init(indio_dev); - if (ret) - goto error_disable_reg; - -- /* skip temp0_input, register in0_(real|imag)_raw */ -- ret = iio_buffer_register(indio_dev, &ad5933_channels[1], 2); -+ ret = iio_buffer_register(indio_dev, ad5933_channels, -+ ARRAY_SIZE(ad5933_channels)); - if (ret) - goto error_unreg_ring; - -diff --git a/drivers/staging/iio/meter/ade7758.h b/drivers/staging/iio/meter/ade7758.h -index 0731820..e8c98cf 100644 ---- a/drivers/staging/iio/meter/ade7758.h -+++ b/drivers/staging/iio/meter/ade7758.h -@@ -119,7 +119,6 @@ struct ade7758_state { - u8 *tx; - u8 *rx; - struct mutex buf_lock; -- const struct iio_chan_spec *ade7758_ring_channels; - struct spi_transfer ring_xfer[4]; - struct spi_message ring_msg; - /* -diff --git a/drivers/staging/iio/meter/ade7758_core.c b/drivers/staging/iio/meter/ade7758_core.c -index cba183e..94d9914 100644 ---- a/drivers/staging/iio/meter/ade7758_core.c -+++ b/drivers/staging/iio/meter/ade7758_core.c -@@ -630,9 +630,6 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_VOLTAGE, - .indexed = 1, - .channel = 0, -- .extend_name = "raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .address = AD7758_WT(AD7758_PHASE_A, AD7758_VOLTAGE), - .scan_index = 0, - .scan_type = { -@@ -644,9 +641,6 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_CURRENT, - .indexed = 1, - .channel = 0, -- .extend_name = "raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .address = AD7758_WT(AD7758_PHASE_A, AD7758_CURRENT), - .scan_index = 1, - .scan_type = { -@@ -658,9 +652,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 0, -- .extend_name = "apparent_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "apparent", - .address = AD7758_WT(AD7758_PHASE_A, AD7758_APP_PWR), - .scan_index = 2, - .scan_type = { -@@ -672,9 +664,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 0, -- .extend_name = "active_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "active", - .address = AD7758_WT(AD7758_PHASE_A, AD7758_ACT_PWR), - .scan_index = 3, - .scan_type = { -@@ -686,9 +676,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 0, -- .extend_name = "reactive_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "reactive", - .address = AD7758_WT(AD7758_PHASE_A, AD7758_REACT_PWR), - .scan_index = 4, - .scan_type = { -@@ -700,9 +688,6 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_VOLTAGE, - .indexed = 1, - .channel = 1, -- .extend_name = "raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .address = AD7758_WT(AD7758_PHASE_B, AD7758_VOLTAGE), - .scan_index = 5, - .scan_type = { -@@ -714,9 +699,6 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_CURRENT, - .indexed = 1, - .channel = 1, -- .extend_name = "raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .address = AD7758_WT(AD7758_PHASE_B, AD7758_CURRENT), - .scan_index = 6, - .scan_type = { -@@ -728,9 +710,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 1, -- .extend_name = "apparent_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "apparent", - .address = AD7758_WT(AD7758_PHASE_B, AD7758_APP_PWR), - .scan_index = 7, - .scan_type = { -@@ -742,9 +722,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 1, -- .extend_name = "active_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "active", - .address = AD7758_WT(AD7758_PHASE_B, AD7758_ACT_PWR), - .scan_index = 8, - .scan_type = { -@@ -756,9 +734,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 1, -- .extend_name = "reactive_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "reactive", - .address = AD7758_WT(AD7758_PHASE_B, AD7758_REACT_PWR), - .scan_index = 9, - .scan_type = { -@@ -770,9 +746,6 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_VOLTAGE, - .indexed = 1, - .channel = 2, -- .extend_name = "raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .address = AD7758_WT(AD7758_PHASE_C, AD7758_VOLTAGE), - .scan_index = 10, - .scan_type = { -@@ -784,9 +757,6 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_CURRENT, - .indexed = 1, - .channel = 2, -- .extend_name = "raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .address = AD7758_WT(AD7758_PHASE_C, AD7758_CURRENT), - .scan_index = 11, - .scan_type = { -@@ -798,9 +768,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 2, -- .extend_name = "apparent_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "apparent", - .address = AD7758_WT(AD7758_PHASE_C, AD7758_APP_PWR), - .scan_index = 12, - .scan_type = { -@@ -812,9 +780,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 2, -- .extend_name = "active_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "active", - .address = AD7758_WT(AD7758_PHASE_C, AD7758_ACT_PWR), - .scan_index = 13, - .scan_type = { -@@ -826,9 +792,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 2, -- .extend_name = "reactive_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "reactive", - .address = AD7758_WT(AD7758_PHASE_C, AD7758_REACT_PWR), - .scan_index = 14, - .scan_type = { -@@ -869,13 +833,14 @@ static int ade7758_probe(struct spi_device *spi) - goto error_free_rx; - } - st->us = spi; -- st->ade7758_ring_channels = &ade7758_channels[0]; - mutex_init(&st->buf_lock); - - indio_dev->name = spi->dev.driver->name; - indio_dev->dev.parent = &spi->dev; - indio_dev->info = &ade7758_info; - indio_dev->modes = INDIO_DIRECT_MODE; -+ indio_dev->channels = ade7758_channels; -+ indio_dev->num_channels = ARRAY_SIZE(ade7758_channels); - - ret = ade7758_configure_ring(indio_dev); - if (ret) -diff --git a/drivers/staging/iio/meter/ade7758_ring.c b/drivers/staging/iio/meter/ade7758_ring.c -index c0accf8..6e90064 100644 ---- a/drivers/staging/iio/meter/ade7758_ring.c -+++ b/drivers/staging/iio/meter/ade7758_ring.c -@@ -85,17 +85,16 @@ static irqreturn_t ade7758_trigger_handler(int irq, void *p) - **/ - static int ade7758_ring_preenable(struct iio_dev *indio_dev) - { -- struct ade7758_state *st = iio_priv(indio_dev); - unsigned channel; - -- if (!bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength)) -+ if (bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength)) - return -EINVAL; - - channel = find_first_bit(indio_dev->active_scan_mask, - indio_dev->masklength); - - ade7758_write_waveform_type(&indio_dev->dev, -- st->ade7758_ring_channels[channel].address); -+ indio_dev->channels[channel].address); - - return 0; - } -diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c -index 6ea95d2..38b4be2 100644 ---- a/drivers/target/target_core_device.c -+++ b/drivers/target/target_core_device.c -@@ -1409,7 +1409,8 @@ int core_dev_add_initiator_node_lun_acl( - * Check to see if there are any existing persistent reservation APTPL - * pre-registrations that need to be enabled for this LUN ACL.. - */ -- core_scsi3_check_aptpl_registration(lun->lun_se_dev, tpg, lun, lacl); -+ core_scsi3_check_aptpl_registration(lun->lun_se_dev, tpg, lun, nacl, -+ lacl->mapped_lun); - return 0; - } - -diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c -index 3013287..1205dbd 100644 ---- a/drivers/target/target_core_pr.c -+++ b/drivers/target/target_core_pr.c -@@ -944,10 +944,10 @@ int core_scsi3_check_aptpl_registration( - struct se_device *dev, - struct se_portal_group *tpg, - struct se_lun *lun, -- struct se_lun_acl *lun_acl) -+ struct se_node_acl *nacl, -+ u32 mapped_lun) - { -- struct se_node_acl *nacl = lun_acl->se_lun_nacl; -- struct se_dev_entry *deve = nacl->device_list[lun_acl->mapped_lun]; -+ struct se_dev_entry *deve = nacl->device_list[mapped_lun]; - - if (dev->dev_reservation_flags & DRF_SPC2_RESERVATIONS) - return 0; -diff --git a/drivers/target/target_core_pr.h b/drivers/target/target_core_pr.h -index 2ee2936..749fd7b 100644 ---- a/drivers/target/target_core_pr.h -+++ b/drivers/target/target_core_pr.h -@@ -60,7 +60,7 @@ extern int core_scsi3_alloc_aptpl_registration( - unsigned char *, u16, u32, int, int, u8); - extern int core_scsi3_check_aptpl_registration(struct se_device *, - struct se_portal_group *, struct se_lun *, -- struct se_lun_acl *); -+ struct se_node_acl *, u32); - extern void core_scsi3_free_pr_reg_from_nacl(struct se_device *, - struct se_node_acl *); - extern void core_scsi3_free_all_registrations(struct se_device *); -diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c -index c036595..fb8a1a1 100644 ---- a/drivers/target/target_core_tpg.c -+++ b/drivers/target/target_core_tpg.c -@@ -40,6 +40,7 @@ - #include <target/target_core_fabric.h> - - #include "target_core_internal.h" -+#include "target_core_pr.h" - - extern struct se_device *g_lun0_dev; - -@@ -166,6 +167,13 @@ void core_tpg_add_node_to_devs( - - core_enable_device_list_for_node(lun, NULL, lun->unpacked_lun, - lun_access, acl, tpg); -+ /* -+ * Check to see if there are any existing persistent reservation -+ * APTPL pre-registrations that need to be enabled for this dynamic -+ * LUN ACL now.. -+ */ -+ core_scsi3_check_aptpl_registration(dev, tpg, lun, acl, -+ lun->unpacked_lun); - spin_lock(&tpg->tpg_lun_lock); - } - spin_unlock(&tpg->tpg_lun_lock); -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 24f5279..9232c773 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -1855,8 +1855,7 @@ static void transport_complete_qf(struct se_cmd *cmd) - if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) { - trace_target_cmd_complete(cmd); - ret = cmd->se_tfo->queue_status(cmd); -- if (ret) -- goto out; -+ goto out; - } - - switch (cmd->data_direction) { -diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index 25b8f68..27b5554 100644 ---- a/drivers/tty/serial/serial_core.c -+++ b/drivers/tty/serial/serial_core.c -@@ -353,7 +353,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios, - * The spd_hi, spd_vhi, spd_shi, spd_warp kludge... - * Die! Die! Die! - */ -- if (baud == 38400) -+ if (try == 0 && baud == 38400) - baud = altbaud; - - /* -diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index d3448a9..25d0741 100644 ---- a/drivers/tty/tty_io.c -+++ b/drivers/tty/tty_io.c -@@ -1701,6 +1701,7 @@ int tty_release(struct inode *inode, struct file *filp) - int pty_master, tty_closing, o_tty_closing, do_sleep; - int idx; - char buf[64]; -+ long timeout = 0; - - if (tty_paranoia_check(tty, inode, __func__)) - return 0; -@@ -1785,7 +1786,11 @@ int tty_release(struct inode *inode, struct file *filp) - __func__, tty_name(tty, buf)); - tty_unlock_pair(tty, o_tty); - mutex_unlock(&tty_mutex); -- schedule(); -+ schedule_timeout_killable(timeout); -+ if (timeout < 120 * HZ) -+ timeout = 2 * timeout + 1; -+ else -+ timeout = MAX_SCHEDULE_TIMEOUT; - } - - /* -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index eabccd4..331f06a 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -965,11 +965,12 @@ static void acm_tty_set_termios(struct tty_struct *tty, - /* FIXME: Needs to clear unsupported bits in the termios */ - acm->clocal = ((termios->c_cflag & CLOCAL) != 0); - -- if (!newline.dwDTERate) { -+ if (C_BAUD(tty) == B0) { - newline.dwDTERate = acm->line.dwDTERate; - newctrl &= ~ACM_CTRL_DTR; -- } else -+ } else if (termios_old && (termios_old->c_cflag & CBAUD) == B0) { - newctrl |= ACM_CTRL_DTR; -+ } - - if (newctrl != acm->ctrlout) - acm_set_control(acm, acm->ctrlout = newctrl); -@@ -1672,6 +1673,7 @@ static const struct usb_device_id acm_ids[] = { - { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */ - .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ - }, -+ { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ - { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */ - }, - /* Motorola H24 HSPA module: */ -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index 2518c32..ef6ec13b 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -2057,6 +2057,8 @@ int usb_alloc_streams(struct usb_interface *interface, - return -EINVAL; - if (dev->speed != USB_SPEED_SUPER) - return -EINVAL; -+ if (dev->state < USB_STATE_CONFIGURED) -+ return -ENODEV; - - /* Streams only apply to bulk endpoints. */ - for (i = 0; i < num_eps; i++) -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 445d62a..d2bd9d7 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -4378,6 +4378,9 @@ check_highspeed (struct usb_hub *hub, struct usb_device *udev, int port1) - struct usb_qualifier_descriptor *qual; - int status; - -+ if (udev->quirks & USB_QUIRK_DEVICE_QUALIFIER) -+ return; -+ - qual = kmalloc (sizeof *qual, GFP_KERNEL); - if (qual == NULL) - return; -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 5144d11..c854593 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -93,6 +93,16 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x04e8, 0x6601), .driver_info = - USB_QUIRK_CONFIG_INTF_STRINGS }, - -+ /* Elan Touchscreen */ -+ { USB_DEVICE(0x04f3, 0x0089), .driver_info = -+ USB_QUIRK_DEVICE_QUALIFIER }, -+ -+ { USB_DEVICE(0x04f3, 0x009b), .driver_info = -+ USB_QUIRK_DEVICE_QUALIFIER }, -+ -+ { USB_DEVICE(0x04f3, 0x016f), .driver_info = -+ USB_QUIRK_DEVICE_QUALIFIER }, -+ - /* Roland SC-8820 */ - { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME }, - -diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c -index 21a3520..0985ff7 100644 ---- a/drivers/usb/dwc3/ep0.c -+++ b/drivers/usb/dwc3/ep0.c -@@ -251,7 +251,7 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc) - - /* stall is always issued on EP0 */ - dep = dwc->eps[0]; -- __dwc3_gadget_ep_set_halt(dep, 1); -+ __dwc3_gadget_ep_set_halt(dep, 1, false); - dep->flags = DWC3_EP_ENABLED; - dwc->delayed_status = false; - -@@ -461,7 +461,7 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc, - return -EINVAL; - if (set == 0 && (dep->flags & DWC3_EP_WEDGE)) - break; -- ret = __dwc3_gadget_ep_set_halt(dep, set); -+ ret = __dwc3_gadget_ep_set_halt(dep, set, true); - if (ret) - return -EINVAL; - break; -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 09e9619..d90c70c 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -532,12 +532,11 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep, - if (!usb_endpoint_xfer_isoc(desc)) - return 0; - -- memset(&trb_link, 0, sizeof(trb_link)); -- - /* Link TRB for ISOC. The HWO bit is never reset */ - trb_st_hw = &dep->trb_pool[0]; - - trb_link = &dep->trb_pool[DWC3_TRB_NUM - 1]; -+ memset(trb_link, 0, sizeof(*trb_link)); - - trb_link->bpl = lower_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw)); - trb_link->bph = upper_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw)); -@@ -588,7 +587,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) - - /* make sure HW endpoint isn't stalled */ - if (dep->flags & DWC3_EP_STALL) -- __dwc3_gadget_ep_set_halt(dep, 0); -+ __dwc3_gadget_ep_set_halt(dep, 0, false); - - reg = dwc3_readl(dwc->regs, DWC3_DALEPENA); - reg &= ~DWC3_DALEPENA_EP(dep->number); -@@ -1186,7 +1185,7 @@ out0: - return ret; - } - --int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value) -+int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol) - { - struct dwc3_gadget_ep_cmd_params params; - struct dwc3 *dwc = dep->dwc; -@@ -1195,6 +1194,14 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value) - memset(¶ms, 0x00, sizeof(params)); - - if (value) { -+ if (!protocol && ((dep->direction && dep->flags & DWC3_EP_BUSY) || -+ (!list_empty(&dep->req_queued) || -+ !list_empty(&dep->request_list)))) { -+ dev_dbg(dwc->dev, "%s: pending request, cannot halt\n", -+ dep->name); -+ return -EAGAIN; -+ } -+ - ret = dwc3_send_gadget_ep_cmd(dwc, dep->number, - DWC3_DEPCMD_SETSTALL, ¶ms); - if (ret) -@@ -1234,7 +1241,7 @@ static int dwc3_gadget_ep_set_halt(struct usb_ep *ep, int value) - goto out; - } - -- ret = __dwc3_gadget_ep_set_halt(dep, value); -+ ret = __dwc3_gadget_ep_set_halt(dep, value, false); - out: - spin_unlock_irqrestore(&dwc->lock, flags); - -@@ -1254,7 +1261,7 @@ static int dwc3_gadget_ep_set_wedge(struct usb_ep *ep) - if (dep->number == 0 || dep->number == 1) - return dwc3_gadget_ep0_set_halt(ep, 1); - else -- return dwc3_gadget_ep_set_halt(ep, 1); -+ return __dwc3_gadget_ep_set_halt(dep, 1, false); - } - - /* -------------------------------------------------------------------------- */ -diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h -index a0ee75b..ac625582 100644 ---- a/drivers/usb/dwc3/gadget.h -+++ b/drivers/usb/dwc3/gadget.h -@@ -85,7 +85,7 @@ void dwc3_ep0_out_start(struct dwc3 *dwc); - int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value); - int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request, - gfp_t gfp_flags); --int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value); -+int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol); - - /** - * dwc3_gadget_ep_get_transfer_index - Gets transfer index from HW -diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c -index ab1065a..3384486 100644 ---- a/drivers/usb/gadget/f_acm.c -+++ b/drivers/usb/gadget/f_acm.c -@@ -430,11 +430,12 @@ static int acm_set_alt(struct usb_function *f, unsigned intf, unsigned alt) - if (acm->notify->driver_data) { - VDBG(cdev, "reset acm control interface %d\n", intf); - usb_ep_disable(acm->notify); -- } else { -- VDBG(cdev, "init acm ctrl interface %d\n", intf); -+ } -+ -+ if (!acm->notify->desc) - if (config_ep_by_speed(cdev->gadget, f, acm->notify)) - return -EINVAL; -- } -+ - usb_ep_enable(acm->notify); - acm->notify->driver_data = acm; - -diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c -index 5bcf7d0..afd0a15 100644 ---- a/drivers/usb/gadget/f_fs.c -+++ b/drivers/usb/gadget/f_fs.c -@@ -1995,8 +1995,6 @@ static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f, - func->conf = c; - func->gadget = c->cdev->gadget; - -- ffs_data_get(func->ffs); -- - /* - * in drivers/usb/gadget/configfs.c:configfs_composite_bind() - * configurations are bound in sequence with list_for_each_entry, -diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c -index 27768a7..9ce0b13 100644 ---- a/drivers/usb/gadget/udc-core.c -+++ b/drivers/usb/gadget/udc-core.c -@@ -456,6 +456,11 @@ static ssize_t usb_udc_softconn_store(struct device *dev, - { - struct usb_udc *udc = container_of(dev, struct usb_udc, dev); - -+ if (!udc->driver) { -+ dev_err(dev, "soft-connect without a gadget driver\n"); -+ return -EOPNOTSUPP; -+ } -+ - if (sysfs_streq(buf, "connect")) { - usb_gadget_udc_start(udc->gadget, udc->driver); - usb_gadget_connect(udc->gadget); -diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c -index c2d5afc..1d29bbf 100644 ---- a/drivers/usb/musb/musb_cppi41.c -+++ b/drivers/usb/musb/musb_cppi41.c -@@ -190,7 +190,8 @@ static enum hrtimer_restart cppi41_recheck_tx_req(struct hrtimer *timer) - } - } - -- if (!list_empty(&controller->early_tx_list)) { -+ if (!list_empty(&controller->early_tx_list) && -+ !hrtimer_is_queued(&controller->early_tx)) { - ret = HRTIMER_RESTART; - hrtimer_forward_now(&controller->early_tx, - ktime_set(0, 150 * NSEC_PER_USEC)); -diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c -index 85f5215..865243e 100644 ---- a/drivers/usb/musb/musb_dsps.c -+++ b/drivers/usb/musb/musb_dsps.c -@@ -733,7 +733,9 @@ static int dsps_resume(struct device *dev) - dsps_writel(mbase, wrp->mode, glue->context.mode); - dsps_writel(mbase, wrp->tx_mode, glue->context.tx_mode); - dsps_writel(mbase, wrp->rx_mode, glue->context.rx_mode); -- setup_timer(&glue->timer, otg_timer, (unsigned long) musb); -+ if (musb->xceiv->state == OTG_STATE_B_IDLE && -+ musb->port_mode == MUSB_PORT_MODE_DUAL_ROLE) -+ mod_timer(&glue->timer, jiffies + wrp->poll_seconds * HZ); - - return 0; - } -diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c -index 8afa813..0180eef 100644 ---- a/drivers/usb/phy/phy.c -+++ b/drivers/usb/phy/phy.c -@@ -229,6 +229,9 @@ struct usb_phy *usb_get_phy_dev(struct device *dev, u8 index) - phy = __usb_find_phy_dev(dev, &phy_bind_list, index); - if (IS_ERR(phy) || !try_module_get(phy->dev->driver->owner)) { - dev_dbg(dev, "unable to find transceiver\n"); -+ if (!IS_ERR(phy)) -+ phy = ERR_PTR(-ENODEV); -+ - goto err0; - } - -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 63b2af2..3beae72 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -155,6 +155,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ - { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ - { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ -+ { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ - { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ - { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */ - { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */ -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 3614620..a523ada 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -145,6 +145,7 @@ static struct ftdi_sio_quirk ftdi_8u2232c_quirk = { - * /sys/bus/usb-serial/drivers/ftdi_sio/new_id and send a patch or report. - */ - static const struct usb_device_id id_table_combined[] = { -+ { USB_DEVICE(FTDI_VID, FTDI_BRICK_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) }, -@@ -674,6 +675,8 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) }, - { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) }, - { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) }, -+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) }, -+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, - { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, - { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 5937b2d..6786b70 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -30,6 +30,12 @@ - - /*** third-party PIDs (using FTDI_VID) ***/ - -+/* -+ * Certain versions of the official Windows FTDI driver reprogrammed -+ * counterfeit FTDI devices to PID 0. Support these devices anyway. -+ */ -+#define FTDI_BRICK_PID 0x0000 -+ - #define FTDI_LUMEL_PD12_PID 0x6002 - - /* -@@ -143,8 +149,12 @@ - * Xsens Technologies BV products (http://www.xsens.com). - */ - #define XSENS_VID 0x2639 --#define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ -+#define XSENS_AWINDA_STATION_PID 0x0101 -+#define XSENS_AWINDA_DONGLE_PID 0x0102 - #define XSENS_MTW_PID 0x0200 /* Xsens MTw */ -+#define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ -+ -+/* Xsens devices using FTDI VID */ - #define XSENS_CONVERTER_0_PID 0xD388 /* Xsens USB converter */ - #define XSENS_CONVERTER_1_PID 0xD389 /* Xsens Wireless Receiver */ - #define XSENS_CONVERTER_2_PID 0xD38A -diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c -index 618c1c1..5cdb32b 100644 ---- a/drivers/usb/serial/kobil_sct.c -+++ b/drivers/usb/serial/kobil_sct.c -@@ -335,7 +335,8 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port, - port->interrupt_out_urb->transfer_buffer_length = length; - - priv->cur_pos = priv->cur_pos + length; -- result = usb_submit_urb(port->interrupt_out_urb, GFP_NOIO); -+ result = usb_submit_urb(port->interrupt_out_urb, -+ GFP_ATOMIC); - dev_dbg(&port->dev, "%s - Send write URB returns: %i\n", __func__, result); - todo = priv->filled - priv->cur_pos; - -@@ -350,7 +351,7 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port, - if (priv->device_type == KOBIL_ADAPTER_B_PRODUCT_ID || - priv->device_type == KOBIL_ADAPTER_K_PRODUCT_ID) { - result = usb_submit_urb(port->interrupt_in_urb, -- GFP_NOIO); -+ GFP_ATOMIC); - dev_dbg(&port->dev, "%s - Send read URB returns: %i\n", __func__, result); - } - } -diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c -index 4856fb7..4b7bfb3 100644 ---- a/drivers/usb/serial/opticon.c -+++ b/drivers/usb/serial/opticon.c -@@ -215,7 +215,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port, - - /* The connected devices do not have a bulk write endpoint, - * to transmit data to de barcode device the control endpoint is used */ -- dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO); -+ dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_ATOMIC); - if (!dr) { - count = -ENOMEM; - goto error_no_dr; -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index e47aabe..8b34841 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -269,6 +269,7 @@ static void option_instat_callback(struct urb *urb); - #define TELIT_PRODUCT_DE910_DUAL 0x1010 - #define TELIT_PRODUCT_UE910_V2 0x1012 - #define TELIT_PRODUCT_LE920 0x1200 -+#define TELIT_PRODUCT_LE910 0x1201 - - /* ZTE PRODUCTS */ - #define ZTE_VENDOR_ID 0x19d2 -@@ -361,6 +362,7 @@ static void option_instat_callback(struct urb *urb); - - /* Haier products */ - #define HAIER_VENDOR_ID 0x201e -+#define HAIER_PRODUCT_CE81B 0x10f8 - #define HAIER_PRODUCT_CE100 0x2009 - - /* Cinterion (formerly Siemens) products */ -@@ -588,6 +590,11 @@ static const struct option_blacklist_info zte_1255_blacklist = { - .reserved = BIT(3) | BIT(4), - }; - -+static const struct option_blacklist_info telit_le910_blacklist = { -+ .sendsetup = BIT(0), -+ .reserved = BIT(1) | BIT(2), -+}; -+ - static const struct option_blacklist_info telit_le920_blacklist = { - .sendsetup = BIT(0), - .reserved = BIT(1) | BIT(5), -@@ -1137,6 +1144,8 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, -+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), -+ .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), - .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ -@@ -1612,6 +1621,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, - { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, - { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(HAIER_VENDOR_ID, HAIER_PRODUCT_CE81B, 0xff, 0xff, 0xff) }, - /* Pirelli */ - { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) }, - { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_2, 0xff) }, -diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c -index 22c7d43..b1d815e 100644 ---- a/drivers/usb/storage/transport.c -+++ b/drivers/usb/storage/transport.c -@@ -1118,6 +1118,31 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us) - */ - if (result == USB_STOR_XFER_LONG) - fake_sense = 1; -+ -+ /* -+ * Sometimes a device will mistakenly skip the data phase -+ * and go directly to the status phase without sending a -+ * zero-length packet. If we get a 13-byte response here, -+ * check whether it really is a CSW. -+ */ -+ if (result == USB_STOR_XFER_SHORT && -+ srb->sc_data_direction == DMA_FROM_DEVICE && -+ transfer_length - scsi_get_resid(srb) == -+ US_BULK_CS_WRAP_LEN) { -+ struct scatterlist *sg = NULL; -+ unsigned int offset = 0; -+ -+ if (usb_stor_access_xfer_buf((unsigned char *) bcs, -+ US_BULK_CS_WRAP_LEN, srb, &sg, -+ &offset, FROM_XFER_BUF) == -+ US_BULK_CS_WRAP_LEN && -+ bcs->Signature == -+ cpu_to_le32(US_BULK_CS_SIGN)) { -+ usb_stor_dbg(us, "Device skipped data phase\n"); -+ scsi_set_resid(srb, transfer_length); -+ goto skipped_data_phase; -+ } -+ } - } - - /* See flow chart on pg 15 of the Bulk Only Transport spec for -@@ -1153,6 +1178,7 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us) - if (result != USB_STOR_XFER_GOOD) - return USB_STOR_TRANSPORT_ERROR; - -+ skipped_data_phase: - /* check bulk status */ - residue = le32_to_cpu(bcs->Residue); - usb_stor_dbg(us, "Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n", -diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c -index 61b182b..dbfe4ee 100644 ---- a/drivers/video/console/bitblit.c -+++ b/drivers/video/console/bitblit.c -@@ -205,7 +205,6 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, - static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, - int bottom_only) - { -- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; - unsigned int cw = vc->vc_font.width; - unsigned int ch = vc->vc_font.height; - unsigned int rw = info->var.xres - (vc->vc_cols*cw); -@@ -214,7 +213,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, - unsigned int bs = info->var.yres - bh; - struct fb_fillrect region; - -- region.color = attr_bgcol_ec(bgshift, vc, info); -+ region.color = 0; - region.rop = ROP_COPY; - - if (rw && !bottom_only) { -diff --git a/drivers/video/console/fbcon_ccw.c b/drivers/video/console/fbcon_ccw.c -index 41b32ae..5a3cbf6 100644 ---- a/drivers/video/console/fbcon_ccw.c -+++ b/drivers/video/console/fbcon_ccw.c -@@ -197,9 +197,8 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, - unsigned int bh = info->var.xres - (vc->vc_rows*ch); - unsigned int bs = vc->vc_rows*ch; - struct fb_fillrect region; -- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; - -- region.color = attr_bgcol_ec(bgshift,vc,info); -+ region.color = 0; - region.rop = ROP_COPY; - - if (rw && !bottom_only) { -diff --git a/drivers/video/console/fbcon_cw.c b/drivers/video/console/fbcon_cw.c -index a93670e..e7ee44d 100644 ---- a/drivers/video/console/fbcon_cw.c -+++ b/drivers/video/console/fbcon_cw.c -@@ -180,9 +180,8 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, - unsigned int bh = info->var.xres - (vc->vc_rows*ch); - unsigned int rs = info->var.yres - rw; - struct fb_fillrect region; -- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; - -- region.color = attr_bgcol_ec(bgshift,vc,info); -+ region.color = 0; - region.rop = ROP_COPY; - - if (rw && !bottom_only) { -diff --git a/drivers/video/console/fbcon_ud.c b/drivers/video/console/fbcon_ud.c -index ff0872c..19e3714 100644 ---- a/drivers/video/console/fbcon_ud.c -+++ b/drivers/video/console/fbcon_ud.c -@@ -227,9 +227,8 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, - unsigned int rw = info->var.xres - (vc->vc_cols*cw); - unsigned int bh = info->var.yres - (vc->vc_rows*ch); - struct fb_fillrect region; -- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; - -- region.color = attr_bgcol_ec(bgshift,vc,info); -+ region.color = 0; - region.rop = ROP_COPY; - - if (rw && !bottom_only) { -diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c -index a416f9b..827b5f8 100644 ---- a/drivers/virtio/virtio_pci.c -+++ b/drivers/virtio/virtio_pci.c -@@ -791,6 +791,7 @@ static int virtio_pci_restore(struct device *dev) - struct pci_dev *pci_dev = to_pci_dev(dev); - struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev); - struct virtio_driver *drv; -+ unsigned status = 0; - int ret; - - drv = container_of(vp_dev->vdev.dev.driver, -@@ -801,14 +802,40 @@ static int virtio_pci_restore(struct device *dev) - return ret; - - pci_set_master(pci_dev); -+ /* We always start by resetting the device, in case a previous -+ * driver messed it up. */ -+ vp_reset(&vp_dev->vdev); -+ -+ /* Acknowledge that we've seen the device. */ -+ status |= VIRTIO_CONFIG_S_ACKNOWLEDGE; -+ vp_set_status(&vp_dev->vdev, status); -+ -+ /* Maybe driver failed before freeze. -+ * Restore the failed status, for debugging. */ -+ status |= vp_dev->saved_status & VIRTIO_CONFIG_S_FAILED; -+ vp_set_status(&vp_dev->vdev, status); -+ -+ if (!drv) -+ return 0; -+ -+ /* We have a driver! */ -+ status |= VIRTIO_CONFIG_S_DRIVER; -+ vp_set_status(&vp_dev->vdev, status); -+ - vp_finalize_features(&vp_dev->vdev); - -- if (drv && drv->restore) -+ if (drv->restore) { - ret = drv->restore(&vp_dev->vdev); -+ if (ret) { -+ status |= VIRTIO_CONFIG_S_FAILED; -+ vp_set_status(&vp_dev->vdev, status); -+ return ret; -+ } -+ } - - /* Finally, tell the device we're all set */ -- if (!ret) -- vp_set_status(&vp_dev->vdev, vp_dev->saved_status); -+ status |= VIRTIO_CONFIG_S_DRIVER_OK; -+ vp_set_status(&vp_dev->vdev, status); - - return ret; - } -diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c -index ca248b0..196b089 100644 ---- a/fs/btrfs/file-item.c -+++ b/fs/btrfs/file-item.c -@@ -423,7 +423,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end, - ret = 0; - fail: - while (ret < 0 && !list_empty(&tmplist)) { -- sums = list_entry(&tmplist, struct btrfs_ordered_sum, list); -+ sums = list_entry(tmplist.next, struct btrfs_ordered_sum, list); - list_del(&sums->list); - kfree(sums); - } -diff --git a/fs/buffer.c b/fs/buffer.c -index 71e2d0e..4d06a57 100644 ---- a/fs/buffer.c -+++ b/fs/buffer.c -@@ -2077,6 +2077,7 @@ int generic_write_end(struct file *file, struct address_space *mapping, - struct page *page, void *fsdata) - { - struct inode *inode = mapping->host; -+ loff_t old_size = inode->i_size; - int i_size_changed = 0; - - copied = block_write_end(file, mapping, pos, len, copied, page, fsdata); -@@ -2096,6 +2097,8 @@ int generic_write_end(struct file *file, struct address_space *mapping, - unlock_page(page); - page_cache_release(page); - -+ if (old_size < pos) -+ pagecache_isize_extended(inode, old_size, pos); - /* - * Don't mark the inode dirty under page lock. First, it unnecessarily - * makes the holding time of page lock longer. Second, it forces lock -@@ -2313,6 +2316,11 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping, - err = 0; - - balance_dirty_pages_ratelimited(mapping); -+ -+ if (unlikely(fatal_signal_pending(current))) { -+ err = -EINTR; -+ goto out; -+ } - } - - /* page covers the boundary, find the boundary offset */ -diff --git a/fs/dcache.c b/fs/dcache.c -index 58d57da..4366127 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -2824,6 +2824,9 @@ static int prepend(char **buffer, int *buflen, const char *str, int namelen) - * the beginning of the name. The sequence number check at the caller will - * retry it again when a d_move() does happen. So any garbage in the buffer - * due to mismatched pointer and length will be discarded. -+ * -+ * Data dependency barrier is needed to make sure that we see that terminating -+ * NUL. Alpha strikes again, film at 11... - */ - static int prepend_name(char **buffer, int *buflen, struct qstr *name) - { -@@ -2831,6 +2834,8 @@ static int prepend_name(char **buffer, int *buflen, struct qstr *name) - u32 dlen = ACCESS_ONCE(name->len); - char *p; - -+ smp_read_barrier_depends(); -+ - *buflen -= dlen + 1; - if (*buflen < 0) - return -ENAMETOOLONG; -diff --git a/fs/ext3/super.c b/fs/ext3/super.c -index 37fd31e..0498390 100644 ---- a/fs/ext3/super.c -+++ b/fs/ext3/super.c -@@ -1354,13 +1354,6 @@ set_qf_format: - "not specified."); - return 0; - } -- } else { -- if (sbi->s_jquota_fmt) { -- ext3_msg(sb, KERN_ERR, "error: journaled quota format " -- "specified with no journaling " -- "enabled."); -- return 0; -- } - } - #endif - return 1; -diff --git a/fs/ext4/bitmap.c b/fs/ext4/bitmap.c -index 3285aa5..b610779 100644 ---- a/fs/ext4/bitmap.c -+++ b/fs/ext4/bitmap.c -@@ -24,8 +24,7 @@ int ext4_inode_bitmap_csum_verify(struct super_block *sb, ext4_group_t group, - __u32 provided, calculated; - struct ext4_sb_info *sbi = EXT4_SB(sb); - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return 1; - - provided = le16_to_cpu(gdp->bg_inode_bitmap_csum_lo); -@@ -46,8 +45,7 @@ void ext4_inode_bitmap_csum_set(struct super_block *sb, ext4_group_t group, - __u32 csum; - struct ext4_sb_info *sbi = EXT4_SB(sb); - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return; - - csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)bh->b_data, sz); -@@ -65,8 +63,7 @@ int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group, - struct ext4_sb_info *sbi = EXT4_SB(sb); - int sz = EXT4_CLUSTERS_PER_GROUP(sb) / 8; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return 1; - - provided = le16_to_cpu(gdp->bg_block_bitmap_csum_lo); -@@ -91,8 +88,7 @@ void ext4_block_bitmap_csum_set(struct super_block *sb, ext4_group_t group, - __u32 csum; - struct ext4_sb_info *sbi = EXT4_SB(sb); - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return; - - csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)bh->b_data, sz); -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 62f024c..2a6830a 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -2110,6 +2110,7 @@ int do_journal_get_write_access(handle_t *handle, - #define CONVERT_INLINE_DATA 2 - - extern struct inode *ext4_iget(struct super_block *, unsigned long); -+extern struct inode *ext4_iget_normal(struct super_block *, unsigned long); - extern int ext4_write_inode(struct inode *, struct writeback_control *); - extern int ext4_setattr(struct dentry *, struct iattr *); - extern int ext4_getattr(struct vfsmount *mnt, struct dentry *dentry, -@@ -2340,10 +2341,18 @@ extern int ext4_register_li_request(struct super_block *sb, - static inline int ext4_has_group_desc_csum(struct super_block *sb) - { - return EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_GDT_CSUM | -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM); -+ EXT4_FEATURE_RO_COMPAT_GDT_CSUM) || -+ (EXT4_SB(sb)->s_chksum_driver != NULL); - } - -+static inline int ext4_has_metadata_csum(struct super_block *sb) -+{ -+ WARN_ON_ONCE(EXT4_HAS_RO_COMPAT_FEATURE(sb, -+ EXT4_FEATURE_RO_COMPAT_METADATA_CSUM) && -+ !EXT4_SB(sb)->s_chksum_driver); -+ -+ return (EXT4_SB(sb)->s_chksum_driver != NULL); -+} - static inline ext4_fsblk_t ext4_blocks_count(struct ext4_super_block *es) - { - return ((ext4_fsblk_t)le32_to_cpu(es->s_blocks_count_hi) << 32) | -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 4718891..96a1ce15 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -74,8 +74,7 @@ static int ext4_extent_block_csum_verify(struct inode *inode, - { - struct ext4_extent_tail *et; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return 1; - - et = find_ext4_extent_tail(eh); -@@ -89,8 +88,7 @@ static void ext4_extent_block_csum_set(struct inode *inode, - { - struct ext4_extent_tail *et; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return; - - et = find_ext4_extent_tail(eh); -diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c -index 64bb32f1..a8d1a64 100644 ---- a/fs/ext4/ialloc.c -+++ b/fs/ext4/ialloc.c -@@ -864,6 +864,10 @@ got: - struct buffer_head *block_bitmap_bh; - - block_bitmap_bh = ext4_read_block_bitmap(sb, group); -+ if (!block_bitmap_bh) { -+ err = -EIO; -+ goto out; -+ } - BUFFER_TRACE(block_bitmap_bh, "get block bitmap access"); - err = ext4_journal_get_write_access(handle, block_bitmap_bh); - if (err) { -@@ -988,8 +992,7 @@ got: - spin_unlock(&sbi->s_next_gen_lock); - - /* Precompute checksum seed for inode metadata */ -- if (EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) { -+ if (ext4_has_metadata_csum(sb)) { - __u32 csum; - __le32 inum = cpu_to_le32(inode->i_ino); - __le32 gen = cpu_to_le32(inode->i_generation); -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index 82edf5b..8c03b74 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -1128,8 +1128,7 @@ static int ext4_finish_convert_inline_dir(handle_t *handle, - memcpy((void *)de, buf + EXT4_INLINE_DOTDOT_SIZE, - inline_size - EXT4_INLINE_DOTDOT_SIZE); - -- if (EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(inode->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - inode->i_size = inode->i_sb->s_blocksize; -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index b56062d..3a7e034 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -83,8 +83,7 @@ static int ext4_inode_csum_verify(struct inode *inode, struct ext4_inode *raw, - - if (EXT4_SB(inode->i_sb)->s_es->s_creator_os != - cpu_to_le32(EXT4_OS_LINUX) || -- !EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ !ext4_has_metadata_csum(inode->i_sb)) - return 1; - - provided = le16_to_cpu(raw->i_checksum_lo); -@@ -105,8 +104,7 @@ static void ext4_inode_csum_set(struct inode *inode, struct ext4_inode *raw, - - if (EXT4_SB(inode->i_sb)->s_es->s_creator_os != - cpu_to_le32(EXT4_OS_LINUX) || -- !EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ !ext4_has_metadata_csum(inode->i_sb)) - return; - - csum = ext4_inode_csum(inode, raw, ei); -@@ -2633,6 +2631,20 @@ static int ext4_nonda_switch(struct super_block *sb) - return 0; - } - -+/* We always reserve for an inode update; the superblock could be there too */ -+static int ext4_da_write_credits(struct inode *inode, loff_t pos, unsigned len) -+{ -+ if (likely(EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -+ EXT4_FEATURE_RO_COMPAT_LARGE_FILE))) -+ return 1; -+ -+ if (pos + len <= 0x7fffffffULL) -+ return 1; -+ -+ /* We might need to update the superblock to set LARGE_FILE */ -+ return 2; -+} -+ - static int ext4_da_write_begin(struct file *file, struct address_space *mapping, - loff_t pos, unsigned len, unsigned flags, - struct page **pagep, void **fsdata) -@@ -2683,7 +2695,8 @@ retry_grab: - * of file which has an already mapped buffer. - */ - retry_journal: -- handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE, 1); -+ handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE, -+ ext4_da_write_credits(inode, pos, len)); - if (IS_ERR(handle)) { - page_cache_release(page); - return PTR_ERR(handle); -@@ -4061,8 +4074,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) - ei->i_extra_isize = 0; - - /* Precompute checksum seed for inode metadata */ -- if (EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) { -+ if (ext4_has_metadata_csum(sb)) { - struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); - __u32 csum; - __le32 inum = cpu_to_le32(inode->i_ino); -@@ -4250,6 +4262,13 @@ bad_inode: - return ERR_PTR(ret); - } - -+struct inode *ext4_iget_normal(struct super_block *sb, unsigned long ino) -+{ -+ if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO) -+ return ERR_PTR(-EIO); -+ return ext4_iget(sb, ino); -+} -+ - static int ext4_inode_blocks_set(handle_t *handle, - struct ext4_inode *raw_inode, - struct ext4_inode_info *ei) -@@ -4645,8 +4664,12 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr) - ext4_orphan_del(NULL, inode); - goto err_out; - } -- } else -+ } else { -+ loff_t oldsize = inode->i_size; -+ - i_size_write(inode, attr->ia_size); -+ pagecache_isize_extended(inode, oldsize, inode->i_size); -+ } - - /* - * Blocks are going to be removed from the inode. Wait -diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c -index a2a837f..dfe982d 100644 ---- a/fs/ext4/ioctl.c -+++ b/fs/ext4/ioctl.c -@@ -343,8 +343,7 @@ flags_out: - if (!inode_owner_or_capable(inode)) - return -EPERM; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) { -+ if (ext4_has_metadata_csum(inode->i_sb)) { - ext4_warning(sb, "Setting inode version is not " - "supported with metadata_csum enabled."); - return -ENOTTY; -@@ -544,9 +543,17 @@ group_add_out: - } - - case EXT4_IOC_SWAP_BOOT: -+ { -+ int err; - if (!(filp->f_mode & FMODE_WRITE)) - return -EBADF; -- return swap_inode_boot_loader(sb, inode); -+ err = mnt_want_write_file(filp); -+ if (err) -+ return err; -+ err = swap_inode_boot_loader(sb, inode); -+ mnt_drop_write_file(filp); -+ return err; -+ } - - case EXT4_IOC_RESIZE_FS: { - ext4_fsblk_t n_blocks_count; -diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c -index 04434ad..1268a1b 100644 ---- a/fs/ext4/mmp.c -+++ b/fs/ext4/mmp.c -@@ -20,8 +20,7 @@ static __le32 ext4_mmp_csum(struct super_block *sb, struct mmp_struct *mmp) - - int ext4_mmp_csum_verify(struct super_block *sb, struct mmp_struct *mmp) - { -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return 1; - - return mmp->mmp_checksum == ext4_mmp_csum(sb, mmp); -@@ -29,8 +28,7 @@ int ext4_mmp_csum_verify(struct super_block *sb, struct mmp_struct *mmp) - - void ext4_mmp_csum_set(struct super_block *sb, struct mmp_struct *mmp) - { -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return; - - mmp->mmp_checksum = ext4_mmp_csum(sb, mmp); -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index d050e04..2dcbfb6 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -123,8 +123,7 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode, - "directory leaf block found instead of index block"); - return ERR_PTR(-EIO); - } -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM) || -+ if (!ext4_has_metadata_csum(inode->i_sb) || - buffer_verified(bh)) - return bh; - -@@ -339,8 +338,7 @@ int ext4_dirent_csum_verify(struct inode *inode, struct ext4_dir_entry *dirent) - { - struct ext4_dir_entry_tail *t; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return 1; - - t = get_dirent_tail(inode, dirent); -@@ -361,8 +359,7 @@ static void ext4_dirent_csum_set(struct inode *inode, - { - struct ext4_dir_entry_tail *t; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return; - - t = get_dirent_tail(inode, dirent); -@@ -437,8 +434,7 @@ static int ext4_dx_csum_verify(struct inode *inode, - struct dx_tail *t; - int count_offset, limit, count; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return 1; - - c = get_dx_countlimit(inode, dirent, &count_offset); -@@ -467,8 +463,7 @@ static void ext4_dx_csum_set(struct inode *inode, struct ext4_dir_entry *dirent) - struct dx_tail *t; - int count_offset, limit, count; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return; - - c = get_dx_countlimit(inode, dirent, &count_offset); -@@ -556,8 +551,7 @@ static inline unsigned dx_root_limit(struct inode *dir, unsigned infosize) - unsigned entry_space = dir->i_sb->s_blocksize - EXT4_DIR_REC_LEN(1) - - EXT4_DIR_REC_LEN(2) - infosize; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(dir->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(dir->i_sb)) - entry_space -= sizeof(struct dx_tail); - return entry_space / sizeof(struct dx_entry); - } -@@ -566,8 +560,7 @@ static inline unsigned dx_node_limit(struct inode *dir) - { - unsigned entry_space = dir->i_sb->s_blocksize - EXT4_DIR_REC_LEN(0); - -- if (EXT4_HAS_RO_COMPAT_FEATURE(dir->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(dir->i_sb)) - entry_space -= sizeof(struct dx_tail); - return entry_space / sizeof(struct dx_entry); - } -@@ -1429,7 +1422,7 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi - dentry); - return ERR_PTR(-EIO); - } -- inode = ext4_iget(dir->i_sb, ino); -+ inode = ext4_iget_normal(dir->i_sb, ino); - if (inode == ERR_PTR(-ESTALE)) { - EXT4_ERROR_INODE(dir, - "deleted inode referenced: %u", -@@ -1460,7 +1453,7 @@ struct dentry *ext4_get_parent(struct dentry *child) - return ERR_PTR(-EIO); - } - -- return d_obtain_alias(ext4_iget(child->d_inode->i_sb, ino)); -+ return d_obtain_alias(ext4_iget_normal(child->d_inode->i_sb, ino)); - } - - /* -@@ -1534,8 +1527,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, - int csum_size = 0; - int err = 0, i; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(dir->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(dir->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - bh2 = ext4_append(handle, dir, &newblock); -@@ -1704,8 +1696,7 @@ static int add_dirent_to_buf(handle_t *handle, struct dentry *dentry, - int csum_size = 0; - int err; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(inode->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - if (!de) { -@@ -1772,8 +1763,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry, - struct fake_dirent *fde; - int csum_size = 0; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(inode->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - blocksize = dir->i_sb->s_blocksize; -@@ -1889,8 +1879,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, - ext4_lblk_t block, blocks; - int csum_size = 0; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(inode->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - sb = dir->i_sb; -@@ -2152,8 +2141,7 @@ static int ext4_delete_entry(handle_t *handle, - return err; - } - -- if (EXT4_HAS_RO_COMPAT_FEATURE(dir->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(dir->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - BUFFER_TRACE(bh, "get_write_access"); -@@ -2372,8 +2360,7 @@ static int ext4_init_new_dir(handle_t *handle, struct inode *dir, - int csum_size = 0; - int err; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(dir->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(dir->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) { -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index f3b84cd..2400ad1 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -1071,7 +1071,7 @@ static void update_backups(struct super_block *sb, int blk_off, char *data, - break; - - if (meta_bg == 0) -- backup_block = group * bpg + blk_off; -+ backup_block = ((ext4_fsblk_t)group) * bpg + blk_off; - else - backup_block = (ext4_group_first_block_no(sb, group) + - ext4_bg_has_super(sb, group)); -@@ -1200,8 +1200,7 @@ static int ext4_set_bitmap_checksums(struct super_block *sb, - { - struct buffer_head *bh; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return 0; - - bh = ext4_get_bitmap(sb, group_data->inode_bitmap); -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index a46030d..9fb3e6c 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -140,8 +140,7 @@ static __le32 ext4_superblock_csum(struct super_block *sb, - int ext4_superblock_csum_verify(struct super_block *sb, - struct ext4_super_block *es) - { -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return 1; - - return es->s_checksum == ext4_superblock_csum(sb, es); -@@ -151,8 +150,7 @@ void ext4_superblock_csum_set(struct super_block *sb) - { - struct ext4_super_block *es = EXT4_SB(sb)->s_es; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return; - - es->s_checksum = ext4_superblock_csum(sb, es); -@@ -996,7 +994,7 @@ static struct inode *ext4_nfs_get_inode(struct super_block *sb, - * Currently we don't know the generation for parent directory, so - * a generation of 0 means "accept any" - */ -- inode = ext4_iget(sb, ino); -+ inode = ext4_iget_normal(sb, ino); - if (IS_ERR(inode)) - return ERR_CAST(inode); - if (generation && inode->i_generation != generation) { -@@ -1706,13 +1704,6 @@ static int parse_options(char *options, struct super_block *sb, - "not specified"); - return 0; - } -- } else { -- if (sbi->s_jquota_fmt) { -- ext4_msg(sb, KERN_ERR, "journaled quota format " -- "specified with no journaling " -- "enabled"); -- return 0; -- } - } - #endif - if (test_opt(sb, DIOREAD_NOLOCK)) { -@@ -2010,8 +2001,7 @@ static __le16 ext4_group_desc_csum(struct ext4_sb_info *sbi, __u32 block_group, - __u16 crc = 0; - __le32 le_group = cpu_to_le32(block_group); - -- if ((sbi->s_es->s_feature_ro_compat & -- cpu_to_le32(EXT4_FEATURE_RO_COMPAT_METADATA_CSUM))) { -+ if (ext4_has_metadata_csum(sbi->s_sb)) { - /* Use new metadata_csum algorithm */ - __le16 save_csum; - __u32 csum32; -@@ -2029,6 +2019,10 @@ static __le16 ext4_group_desc_csum(struct ext4_sb_info *sbi, __u32 block_group, - } - - /* old crc16 code */ -+ if (!(sbi->s_es->s_feature_ro_compat & -+ cpu_to_le32(EXT4_FEATURE_RO_COMPAT_GDT_CSUM))) -+ return 0; -+ - offset = offsetof(struct ext4_group_desc, bg_checksum); - - crc = crc16(~0, sbi->s_es->s_uuid, sizeof(sbi->s_es->s_uuid)); -@@ -3167,8 +3161,7 @@ static int set_journal_csum_feature_set(struct super_block *sb) - int compat, incompat; - struct ext4_sb_info *sbi = EXT4_SB(sb); - -- if (EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) { -+ if (ext4_has_metadata_csum(sb)) { - /* journal checksum v3 */ - compat = 0; - incompat = JBD2_FEATURE_INCOMPAT_CSUM_V3; -@@ -3475,8 +3468,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - } - - /* Precompute checksum seed for all metadata */ -- if (EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(sb)) - sbi->s_csum_seed = ext4_chksum(sbi, ~0, es->s_uuid, - sizeof(es->s_uuid)); - -@@ -3494,6 +3486,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - #ifdef CONFIG_EXT4_FS_POSIX_ACL - set_opt(sb, POSIX_ACL); - #endif -+ /* don't forget to enable journal_csum when metadata_csum is enabled. */ -+ if (ext4_has_metadata_csum(sb)) -+ set_opt(sb, JOURNAL_CHECKSUM); -+ - if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_DATA) - set_opt(sb, JOURNAL_DATA); - else if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_ORDERED) -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index 55e611c..8825154 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -141,8 +141,7 @@ static int ext4_xattr_block_csum_verify(struct inode *inode, - sector_t block_nr, - struct ext4_xattr_header *hdr) - { -- if (EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM) && -+ if (ext4_has_metadata_csum(inode->i_sb) && - (hdr->h_checksum != ext4_xattr_block_csum(inode, block_nr, hdr))) - return 0; - return 1; -@@ -152,8 +151,7 @@ static void ext4_xattr_block_csum_set(struct inode *inode, - sector_t block_nr, - struct ext4_xattr_header *hdr) - { -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return; - - hdr->h_checksum = ext4_xattr_block_csum(inode, block_nr, hdr); -@@ -189,14 +187,28 @@ ext4_listxattr(struct dentry *dentry, char *buffer, size_t size) - } - - static int --ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end) -+ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end, -+ void *value_start) - { -- while (!IS_LAST_ENTRY(entry)) { -- struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(entry); -+ struct ext4_xattr_entry *e = entry; -+ -+ while (!IS_LAST_ENTRY(e)) { -+ struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(e); - if ((void *)next >= end) - return -EIO; -- entry = next; -+ e = next; - } -+ -+ while (!IS_LAST_ENTRY(entry)) { -+ if (entry->e_value_size != 0 && -+ (value_start + le16_to_cpu(entry->e_value_offs) < -+ (void *)e + sizeof(__u32) || -+ value_start + le16_to_cpu(entry->e_value_offs) + -+ le32_to_cpu(entry->e_value_size) > end)) -+ return -EIO; -+ entry = EXT4_XATTR_NEXT(entry); -+ } -+ - return 0; - } - -@@ -213,7 +225,8 @@ ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh) - return -EIO; - if (!ext4_xattr_block_csum_verify(inode, bh->b_blocknr, BHDR(bh))) - return -EIO; -- error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size); -+ error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size, -+ bh->b_data); - if (!error) - set_buffer_verified(bh); - return error; -@@ -329,7 +342,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name, - header = IHDR(inode, raw_inode); - entry = IFIRST(header); - end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; -- error = ext4_xattr_check_names(entry, end); -+ error = ext4_xattr_check_names(entry, end, entry); - if (error) - goto cleanup; - error = ext4_xattr_find_entry(&entry, name_index, name, -@@ -457,7 +470,7 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size) - raw_inode = ext4_raw_inode(&iloc); - header = IHDR(inode, raw_inode); - end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; -- error = ext4_xattr_check_names(IFIRST(header), end); -+ error = ext4_xattr_check_names(IFIRST(header), end, IFIRST(header)); - if (error) - goto cleanup; - error = ext4_xattr_list_entries(dentry, IFIRST(header), -@@ -972,7 +985,8 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i, - is->s.here = is->s.first; - is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; - if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) { -- error = ext4_xattr_check_names(IFIRST(header), is->s.end); -+ error = ext4_xattr_check_names(IFIRST(header), is->s.end, -+ IFIRST(header)); - if (error) - return error; - /* Find the named attribute. */ -diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c -index 9b329b5..bcbef08 100644 ---- a/fs/jbd2/recovery.c -+++ b/fs/jbd2/recovery.c -@@ -525,6 +525,7 @@ static int do_one_pass(journal_t *journal, - !jbd2_descr_block_csum_verify(journal, - bh->b_data)) { - err = -EIO; -+ brelse(bh); - goto failed; - } - -diff --git a/fs/jffs2/jffs2_fs_sb.h b/fs/jffs2/jffs2_fs_sb.h -index 413ef89..046fee8 100644 ---- a/fs/jffs2/jffs2_fs_sb.h -+++ b/fs/jffs2/jffs2_fs_sb.h -@@ -134,8 +134,6 @@ struct jffs2_sb_info { - struct rw_semaphore wbuf_sem; /* Protects the write buffer */ - - struct delayed_work wbuf_dwork; /* write-buffer write-out work */ -- int wbuf_queued; /* non-zero delayed work is queued */ -- spinlock_t wbuf_dwork_lock; /* protects wbuf_dwork and and wbuf_queued */ - - unsigned char *oobbuf; - int oobavail; /* How many bytes are available for JFFS2 in OOB */ -diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c -index a6597d6..09ed551 100644 ---- a/fs/jffs2/wbuf.c -+++ b/fs/jffs2/wbuf.c -@@ -1162,10 +1162,6 @@ static void delayed_wbuf_sync(struct work_struct *work) - struct jffs2_sb_info *c = work_to_sb(work); - struct super_block *sb = OFNI_BS_2SFFJ(c); - -- spin_lock(&c->wbuf_dwork_lock); -- c->wbuf_queued = 0; -- spin_unlock(&c->wbuf_dwork_lock); -- - if (!(sb->s_flags & MS_RDONLY)) { - jffs2_dbg(1, "%s()\n", __func__); - jffs2_flush_wbuf_gc(c, 0); -@@ -1180,14 +1176,9 @@ void jffs2_dirty_trigger(struct jffs2_sb_info *c) - if (sb->s_flags & MS_RDONLY) - return; - -- spin_lock(&c->wbuf_dwork_lock); -- if (!c->wbuf_queued) { -+ delay = msecs_to_jiffies(dirty_writeback_interval * 10); -+ if (queue_delayed_work(system_long_wq, &c->wbuf_dwork, delay)) - jffs2_dbg(1, "%s()\n", __func__); -- delay = msecs_to_jiffies(dirty_writeback_interval * 10); -- queue_delayed_work(system_long_wq, &c->wbuf_dwork, delay); -- c->wbuf_queued = 1; -- } -- spin_unlock(&c->wbuf_dwork_lock); - } - - int jffs2_nand_flash_setup(struct jffs2_sb_info *c) -@@ -1211,7 +1202,6 @@ int jffs2_nand_flash_setup(struct jffs2_sb_info *c) - - /* Initialise write buffer */ - init_rwsem(&c->wbuf_sem); -- spin_lock_init(&c->wbuf_dwork_lock); - INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); - c->wbuf_pagesize = c->mtd->writesize; - c->wbuf_ofs = 0xFFFFFFFF; -@@ -1251,7 +1241,6 @@ int jffs2_dataflash_setup(struct jffs2_sb_info *c) { - - /* Initialize write buffer */ - init_rwsem(&c->wbuf_sem); -- spin_lock_init(&c->wbuf_dwork_lock); - INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); - c->wbuf_pagesize = c->mtd->erasesize; - -@@ -1311,7 +1300,6 @@ int jffs2_nor_wbuf_flash_setup(struct jffs2_sb_info *c) { - - /* Initialize write buffer */ - init_rwsem(&c->wbuf_sem); -- spin_lock_init(&c->wbuf_dwork_lock); - INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); - - c->wbuf_pagesize = c->mtd->writesize; -@@ -1346,7 +1334,6 @@ int jffs2_ubivol_setup(struct jffs2_sb_info *c) { - return 0; - - init_rwsem(&c->wbuf_sem); -- spin_lock_init(&c->wbuf_dwork_lock); - INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); - - c->wbuf_pagesize = c->mtd->writesize; -diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c -index 1812f02..6ae664b 100644 ---- a/fs/lockd/mon.c -+++ b/fs/lockd/mon.c -@@ -159,6 +159,12 @@ static int nsm_mon_unmon(struct nsm_handle *nsm, u32 proc, struct nsm_res *res, - - msg.rpc_proc = &clnt->cl_procinfo[proc]; - status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN); -+ if (status == -ECONNREFUSED) { -+ dprintk("lockd: NSM upcall RPC failed, status=%d, forcing rebind\n", -+ status); -+ rpc_force_rebind(clnt); -+ status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN); -+ } - if (status < 0) - dprintk("lockd: NSM upcall RPC failed, status=%d\n", - status); -diff --git a/fs/namei.c b/fs/namei.c -index dd2f2c5..0dd72c8 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -3128,7 +3128,8 @@ static int do_tmpfile(int dfd, struct filename *pathname, - if (error) - goto out2; - audit_inode(pathname, nd->path.dentry, 0); -- error = may_open(&nd->path, op->acc_mode, op->open_flag); -+ /* Don't check for other permissions, the inode was just created */ -+ error = may_open(&nd->path, MAY_OPEN, op->open_flag); - if (error) - goto out2; - file->f_path.mnt = nd->path.mnt; -diff --git a/fs/namespace.c b/fs/namespace.c -index c7d4a0a..d9bf3ef 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -2831,6 +2831,9 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, - /* make sure we can reach put_old from new_root */ - if (!is_path_reachable(old_mnt, old.dentry, &new)) - goto out4; -+ /* make certain new is below the root */ -+ if (!is_path_reachable(new_mnt, new.dentry, &root)) -+ goto out4; - root_mp->m_count++; /* pin it so it won't go away */ - lock_mount_hash(); - detach_mnt(new_mnt, &parent_path); -diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index f23a6ca..86f5d3e 100644 ---- a/fs/nfsd/nfs4proc.c -+++ b/fs/nfsd/nfs4proc.c -@@ -1243,7 +1243,8 @@ static bool need_wrongsec_check(struct svc_rqst *rqstp) - */ - if (argp->opcnt == resp->opcnt) - return false; -- -+ if (next->opnum == OP_ILLEGAL) -+ return false; - nextd = OPDESC(next); - /* - * Rest of 2.6.3.1.1: certain operations will return WRONGSEC -diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c -index 1282384..14120a3 100644 ---- a/fs/pstore/inode.c -+++ b/fs/pstore/inode.c -@@ -319,10 +319,10 @@ int pstore_mkfile(enum pstore_type_id type, char *psname, u64 id, int count, - compressed ? ".enc.z" : ""); - break; - case PSTORE_TYPE_CONSOLE: -- sprintf(name, "console-%s", psname); -+ sprintf(name, "console-%s-%lld", psname, id); - break; - case PSTORE_TYPE_FTRACE: -- sprintf(name, "ftrace-%s", psname); -+ sprintf(name, "ftrace-%s-%lld", psname, id); - break; - case PSTORE_TYPE_MCE: - sprintf(name, "mce-%s-%lld", psname, id); -diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c -index ce87c90..89da957 100644 ---- a/fs/quota/dquot.c -+++ b/fs/quota/dquot.c -@@ -637,7 +637,7 @@ int dquot_writeback_dquots(struct super_block *sb, int type) - dqstats_inc(DQST_LOOKUPS); - err = sb->dq_op->write_dquot(dquot); - if (!ret && err) -- err = ret; -+ ret = err; - dqput(dquot); - spin_lock(&dq_list_lock); - } -diff --git a/fs/super.c b/fs/super.c -index 7624267..88a6bc6 100644 ---- a/fs/super.c -+++ b/fs/super.c -@@ -81,6 +81,8 @@ static unsigned long super_cache_scan(struct shrinker *shrink, - inodes = list_lru_count_node(&sb->s_inode_lru, sc->nid); - dentries = list_lru_count_node(&sb->s_dentry_lru, sc->nid); - total_objects = dentries + inodes + fs_objects + 1; -+ if (!total_objects) -+ total_objects = 1; - - /* proportion the scan between the caches */ - dentries = mult_frac(sc->nr_to_scan, dentries, total_objects); -diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c -index ff82293..26b69b2 100644 ---- a/fs/ubifs/commit.c -+++ b/fs/ubifs/commit.c -@@ -166,15 +166,10 @@ static int do_commit(struct ubifs_info *c) - err = ubifs_orphan_end_commit(c); - if (err) - goto out; -- old_ltail_lnum = c->ltail_lnum; -- err = ubifs_log_end_commit(c, new_ltail_lnum); -- if (err) -- goto out; - err = dbg_check_old_index(c, &zroot); - if (err) - goto out; - -- mutex_lock(&c->mst_mutex); - c->mst_node->cmt_no = cpu_to_le64(c->cmt_no); - c->mst_node->log_lnum = cpu_to_le32(new_ltail_lnum); - c->mst_node->root_lnum = cpu_to_le32(zroot.lnum); -@@ -203,8 +198,9 @@ static int do_commit(struct ubifs_info *c) - c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS); - else - c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_NO_ORPHS); -- err = ubifs_write_master(c); -- mutex_unlock(&c->mst_mutex); -+ -+ old_ltail_lnum = c->ltail_lnum; -+ err = ubifs_log_end_commit(c, new_ltail_lnum); - if (err) - goto out; - -diff --git a/fs/ubifs/log.c b/fs/ubifs/log.c -index a902c59..8d59de8 100644 ---- a/fs/ubifs/log.c -+++ b/fs/ubifs/log.c -@@ -106,10 +106,14 @@ static inline long long empty_log_bytes(const struct ubifs_info *c) - h = (long long)c->lhead_lnum * c->leb_size + c->lhead_offs; - t = (long long)c->ltail_lnum * c->leb_size; - -- if (h >= t) -+ if (h > t) - return c->log_bytes - h + t; -- else -+ else if (h != t) - return t - h; -+ else if (c->lhead_lnum != c->ltail_lnum) -+ return 0; -+ else -+ return c->log_bytes; - } - - /** -@@ -447,9 +451,9 @@ out: - * @ltail_lnum: new log tail LEB number - * - * This function is called on when the commit operation was finished. It -- * moves log tail to new position and unmaps LEBs which contain obsolete data. -- * Returns zero in case of success and a negative error code in case of -- * failure. -+ * moves log tail to new position and updates the master node so that it stores -+ * the new log tail LEB number. Returns zero in case of success and a negative -+ * error code in case of failure. - */ - int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum) - { -@@ -477,7 +481,12 @@ int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum) - spin_unlock(&c->buds_lock); - - err = dbg_check_bud_bytes(c); -+ if (err) -+ goto out; - -+ err = ubifs_write_master(c); -+ -+out: - mutex_unlock(&c->log_mutex); - return err; - } -diff --git a/fs/ubifs/master.c b/fs/ubifs/master.c -index ab83ace..1a4bb9e 100644 ---- a/fs/ubifs/master.c -+++ b/fs/ubifs/master.c -@@ -352,10 +352,9 @@ int ubifs_read_master(struct ubifs_info *c) - * ubifs_write_master - write master node. - * @c: UBIFS file-system description object - * -- * This function writes the master node. The caller has to take the -- * @c->mst_mutex lock before calling this function. Returns zero in case of -- * success and a negative error code in case of failure. The master node is -- * written twice to enable recovery. -+ * This function writes the master node. Returns zero in case of success and a -+ * negative error code in case of failure. The master node is written twice to -+ * enable recovery. - */ - int ubifs_write_master(struct ubifs_info *c) - { -diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c -index 5ded849..94d9a64 100644 ---- a/fs/ubifs/super.c -+++ b/fs/ubifs/super.c -@@ -1957,7 +1957,6 @@ static struct ubifs_info *alloc_ubifs_info(struct ubi_volume_desc *ubi) - mutex_init(&c->lp_mutex); - mutex_init(&c->tnc_mutex); - mutex_init(&c->log_mutex); -- mutex_init(&c->mst_mutex); - mutex_init(&c->umount_mutex); - mutex_init(&c->bu_mutex); - mutex_init(&c->write_reserve_mutex); -diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h -index e8c8cfe..7ab9c71 100644 ---- a/fs/ubifs/ubifs.h -+++ b/fs/ubifs/ubifs.h -@@ -1042,7 +1042,6 @@ struct ubifs_debug_info; - * - * @mst_node: master node - * @mst_offs: offset of valid master node -- * @mst_mutex: protects the master node area, @mst_node, and @mst_offs - * - * @max_bu_buf_len: maximum bulk-read buffer length - * @bu_mutex: protects the pre-allocated bulk-read buffer and @c->bu -@@ -1282,7 +1281,6 @@ struct ubifs_info { - - struct ubifs_mst_node *mst_node; - int mst_offs; -- struct mutex mst_mutex; - - int max_bu_buf_len; - struct mutex bu_mutex; -diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c -index c6ff3cf5..0eaaa2d 100644 ---- a/fs/xfs/xfs_mount.c -+++ b/fs/xfs/xfs_mount.c -@@ -321,7 +321,6 @@ reread: - * Initialize the mount structure from the superblock. - */ - xfs_sb_from_disk(sbp, XFS_BUF_TO_SBP(bp)); -- xfs_sb_quota_from_disk(sbp); - - /* - * If we haven't validated the superblock, do so now before we try -diff --git a/fs/xfs/xfs_sb.c b/fs/xfs/xfs_sb.c -index 1e11679..4afd393 100644 ---- a/fs/xfs/xfs_sb.c -+++ b/fs/xfs/xfs_sb.c -@@ -397,10 +397,11 @@ xfs_sb_quota_from_disk(struct xfs_sb *sbp) - } - } - --void --xfs_sb_from_disk( -+static void -+__xfs_sb_from_disk( - struct xfs_sb *to, -- xfs_dsb_t *from) -+ xfs_dsb_t *from, -+ bool convert_xquota) - { - to->sb_magicnum = be32_to_cpu(from->sb_magicnum); - to->sb_blocksize = be32_to_cpu(from->sb_blocksize); -@@ -456,6 +457,17 @@ xfs_sb_from_disk( - to->sb_pad = 0; - to->sb_pquotino = be64_to_cpu(from->sb_pquotino); - to->sb_lsn = be64_to_cpu(from->sb_lsn); -+ /* Convert on-disk flags to in-memory flags? */ -+ if (convert_xquota) -+ xfs_sb_quota_from_disk(to); -+} -+ -+void -+xfs_sb_from_disk( -+ struct xfs_sb *to, -+ xfs_dsb_t *from) -+{ -+ __xfs_sb_from_disk(to, from, true); - } - - static inline void -@@ -571,7 +583,11 @@ xfs_sb_verify( - struct xfs_mount *mp = bp->b_target->bt_mount; - struct xfs_sb sb; - -- xfs_sb_from_disk(&sb, XFS_BUF_TO_SBP(bp)); -+ /* -+ * Use call variant which doesn't convert quota flags from disk -+ * format, because xfs_mount_validate_sb checks the on-disk flags. -+ */ -+ __xfs_sb_from_disk(&sb, XFS_BUF_TO_SBP(bp), false); - - /* - * Only check the in progress field for the primary superblock as -diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h -index bcec4c4..ca52de5 100644 ---- a/include/drm/drm_pciids.h -+++ b/include/drm/drm_pciids.h -@@ -74,7 +74,6 @@ - {0x1002, 0x4C64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ - {0x1002, 0x4C66, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ - {0x1002, 0x4C67, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ -- {0x1002, 0x4C6E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|RADEON_IS_MOBILITY}, \ - {0x1002, 0x4E44, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ - {0x1002, 0x4E45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ - {0x1002, 0x4E46, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ -diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h -index 4afa4f8..a693c6d 100644 ---- a/include/linux/blkdev.h -+++ b/include/linux/blkdev.h -@@ -1232,10 +1232,9 @@ static inline int queue_alignment_offset(struct request_queue *q) - static inline int queue_limit_alignment_offset(struct queue_limits *lim, sector_t sector) - { - unsigned int granularity = max(lim->physical_block_size, lim->io_min); -- unsigned int alignment = (sector << 9) & (granularity - 1); -+ unsigned int alignment = sector_div(sector, granularity >> 9) << 9; - -- return (granularity + lim->alignment_offset - alignment) -- & (granularity - 1); -+ return (granularity + lim->alignment_offset - alignment) % granularity; - } - - static inline int bdev_alignment_offset(struct block_device *bdev) -diff --git a/include/linux/hid.h b/include/linux/hid.h -index 31b9d29..00c88fc 100644 ---- a/include/linux/hid.h -+++ b/include/linux/hid.h -@@ -286,6 +286,7 @@ struct hid_item { - #define HID_QUIRK_HIDINPUT_FORCE 0x00000080 - #define HID_QUIRK_NO_EMPTY_INPUT 0x00000100 - #define HID_QUIRK_NO_INIT_INPUT_REPORTS 0x00000200 -+#define HID_QUIRK_ALWAYS_POLL 0x00000400 - #define HID_QUIRK_SKIP_OUTPUT_REPORTS 0x00010000 - #define HID_QUIRK_FULLSPEED_INTERVAL 0x10000000 - #define HID_QUIRK_NO_INIT_REPORTS 0x20000000 -diff --git a/include/linux/mm.h b/include/linux/mm.h -index c1b7414..0a0b024 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -1123,6 +1123,7 @@ static inline void unmap_shared_mapping_range(struct address_space *mapping, - - extern void truncate_pagecache(struct inode *inode, loff_t new); - extern void truncate_setsize(struct inode *inode, loff_t newsize); -+void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to); - void truncate_pagecache_range(struct inode *inode, loff_t offset, loff_t end); - int truncate_inode_page(struct address_space *mapping, struct page *page); - int generic_error_remove_page(struct address_space *mapping, struct page *page); -diff --git a/include/linux/of.h b/include/linux/of.h -index 435cb99..3f8144d 100644 ---- a/include/linux/of.h -+++ b/include/linux/of.h -@@ -215,14 +215,12 @@ extern int of_property_read_u64(const struct device_node *np, - extern int of_property_read_string(struct device_node *np, - const char *propname, - const char **out_string); --extern int of_property_read_string_index(struct device_node *np, -- const char *propname, -- int index, const char **output); - extern int of_property_match_string(struct device_node *np, - const char *propname, - const char *string); --extern int of_property_count_strings(struct device_node *np, -- const char *propname); -+extern int of_property_read_string_helper(struct device_node *np, -+ const char *propname, -+ const char **out_strs, size_t sz, int index); - extern int of_device_is_compatible(const struct device_node *device, - const char *); - extern int of_device_is_available(const struct device_node *device); -@@ -422,15 +420,9 @@ static inline int of_property_read_string(struct device_node *np, - return -ENOSYS; - } - --static inline int of_property_read_string_index(struct device_node *np, -- const char *propname, int index, -- const char **out_string) --{ -- return -ENOSYS; --} -- --static inline int of_property_count_strings(struct device_node *np, -- const char *propname) -+static inline int of_property_read_string_helper(struct device_node *np, -+ const char *propname, -+ const char **out_strs, size_t sz, int index) - { - return -ENOSYS; - } -@@ -536,6 +528,70 @@ static inline struct device_node *of_find_matching_node( - } - - /** -+ * of_property_read_string_array() - Read an array of strings from a multiple -+ * strings property. -+ * @np: device node from which the property value is to be read. -+ * @propname: name of the property to be searched. -+ * @out_strs: output array of string pointers. -+ * @sz: number of array elements to read. -+ * -+ * Search for a property in a device tree node and retrieve a list of -+ * terminated string values (pointer to data, not a copy) in that property. -+ * -+ * If @out_strs is NULL, the number of strings in the property is returned. -+ */ -+static inline int of_property_read_string_array(struct device_node *np, -+ const char *propname, const char **out_strs, -+ size_t sz) -+{ -+ return of_property_read_string_helper(np, propname, out_strs, sz, 0); -+} -+ -+/** -+ * of_property_count_strings() - Find and return the number of strings from a -+ * multiple strings property. -+ * @np: device node from which the property value is to be read. -+ * @propname: name of the property to be searched. -+ * -+ * Search for a property in a device tree node and retrieve the number of null -+ * terminated string contain in it. Returns the number of strings on -+ * success, -EINVAL if the property does not exist, -ENODATA if property -+ * does not have a value, and -EILSEQ if the string is not null-terminated -+ * within the length of the property data. -+ */ -+static inline int of_property_count_strings(struct device_node *np, -+ const char *propname) -+{ -+ return of_property_read_string_helper(np, propname, NULL, 0, 0); -+} -+ -+/** -+ * of_property_read_string_index() - Find and read a string from a multiple -+ * strings property. -+ * @np: device node from which the property value is to be read. -+ * @propname: name of the property to be searched. -+ * @index: index of the string in the list of strings -+ * @out_string: pointer to null terminated return string, modified only if -+ * return value is 0. -+ * -+ * Search for a property in a device tree node and retrieve a null -+ * terminated string value (pointer to data, not a copy) in the list of strings -+ * contained in that property. -+ * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if -+ * property does not have a value, and -EILSEQ if the string is not -+ * null-terminated within the length of the property data. -+ * -+ * The out_string pointer is modified only if a valid string can be decoded. -+ */ -+static inline int of_property_read_string_index(struct device_node *np, -+ const char *propname, -+ int index, const char **output) -+{ -+ int rc = of_property_read_string_helper(np, propname, output, 1, index); -+ return rc < 0 ? rc : 0; -+} -+ -+/** - * of_property_read_bool - Findfrom a property - * @np: device node from which the property value is to be read. - * @propname: name of the property to be searched. -diff --git a/include/linux/oom.h b/include/linux/oom.h -index 4cd6267..17f0949 100644 ---- a/include/linux/oom.h -+++ b/include/linux/oom.h -@@ -50,6 +50,9 @@ static inline bool oom_task_origin(const struct task_struct *p) - extern unsigned long oom_badness(struct task_struct *p, - struct mem_cgroup *memcg, const nodemask_t *nodemask, - unsigned long totalpages); -+ -+extern int oom_kills_count(void); -+extern void note_oom_kill(void); - extern void oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order, - unsigned int points, unsigned long totalpages, - struct mem_cgroup *memcg, nodemask_t *nodemask, -diff --git a/include/linux/string.h b/include/linux/string.h -index ac889c5..0ed878d 100644 ---- a/include/linux/string.h -+++ b/include/linux/string.h -@@ -129,7 +129,7 @@ int bprintf(u32 *bin_buf, size_t size, const char *fmt, ...) __printf(3, 4); - #endif - - extern ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos, -- const void *from, size_t available); -+ const void *from, size_t available); - - /** - * strstarts - does @str start with @prefix? -@@ -141,7 +141,8 @@ static inline bool strstarts(const char *str, const char *prefix) - return strncmp(str, prefix, strlen(prefix)) == 0; - } - --extern size_t memweight(const void *ptr, size_t bytes); -+size_t memweight(const void *ptr, size_t bytes); -+void memzero_explicit(void *s, size_t count); - - /** - * kbasename - return the last part of a pathname. -diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h -index 8097b9d..51009d2 100644 ---- a/include/linux/sunrpc/xprt.h -+++ b/include/linux/sunrpc/xprt.h -@@ -340,6 +340,7 @@ int xs_swapper(struct rpc_xprt *xprt, int enable); - #define XPRT_CONNECTION_ABORT (7) - #define XPRT_CONNECTION_CLOSE (8) - #define XPRT_CONGESTED (9) -+#define XPRT_CONNECTION_REUSE (10) - - static inline void xprt_set_connected(struct rpc_xprt *xprt) - { -diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h -index 49587dc..8b96ae2 100644 ---- a/include/linux/usb/quirks.h -+++ b/include/linux/usb/quirks.h -@@ -33,4 +33,7 @@ - /* device generates spurious wakeup, ignore remote wakeup capability */ - #define USB_QUIRK_IGNORE_REMOTE_WAKEUP 0x00000200 - -+/* device can't handle device_qualifier descriptor requests */ -+#define USB_QUIRK_DEVICE_QUALIFIER 0x00000100 -+ - #endif /* __LINUX_USB_QUIRKS_H */ -diff --git a/include/net/ipv6.h b/include/net/ipv6.h -index 9ac6578..a60948d 100644 ---- a/include/net/ipv6.h -+++ b/include/net/ipv6.h -@@ -660,6 +660,8 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add - return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr)); - } - -+void ipv6_proxy_select_ident(struct sk_buff *skb); -+ - int ip6_dst_hoplimit(struct dst_entry *dst); - - /* -diff --git a/include/uapi/drm/vmwgfx_drm.h b/include/uapi/drm/vmwgfx_drm.h -index 87792a5..33b7395 100644 ---- a/include/uapi/drm/vmwgfx_drm.h -+++ b/include/uapi/drm/vmwgfx_drm.h -@@ -29,7 +29,7 @@ - #define __VMWGFX_DRM_H__ - - #ifndef __KERNEL__ --#include <drm.h> -+#include <drm/drm.h> - #endif - - #define DRM_VMW_MAX_SURFACE_FACES 6 -diff --git a/kernel/freezer.c b/kernel/freezer.c -index aa6a8aa..8f9279b 100644 ---- a/kernel/freezer.c -+++ b/kernel/freezer.c -@@ -42,6 +42,9 @@ bool freezing_slow_path(struct task_struct *p) - if (p->flags & (PF_NOFREEZE | PF_SUSPEND_TASK)) - return false; - -+ if (test_thread_flag(TIF_MEMDIE)) -+ return false; -+ - if (pm_nosig_freezing || cgroup_freezing(p)) - return true; - -diff --git a/kernel/module.c b/kernel/module.c -index 6716a1f..1d679a6 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -1841,7 +1841,9 @@ static void free_module(struct module *mod) - - /* We leave it in list to prevent duplicate loads, but make sure - * that noone uses it while it's being deconstructed. */ -+ mutex_lock(&module_mutex); - mod->state = MODULE_STATE_UNFORMED; -+ mutex_unlock(&module_mutex); - - /* Remove dynamic debug info */ - ddebug_remove_module(mod->name); -diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c -index 424c2d4..77e6b83 100644 ---- a/kernel/posix-timers.c -+++ b/kernel/posix-timers.c -@@ -634,6 +634,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock, - goto out; - } - } else { -+ memset(&event.sigev_value, 0, sizeof(event.sigev_value)); - event.sigev_notify = SIGEV_SIGNAL; - event.sigev_signo = SIGALRM; - event.sigev_value.sival_int = new_timer->it_id; -diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c -index 37170d4..126586a 100644 ---- a/kernel/power/hibernate.c -+++ b/kernel/power/hibernate.c -@@ -492,8 +492,14 @@ int hibernation_restore(int platform_mode) - error = dpm_suspend_start(PMSG_QUIESCE); - if (!error) { - error = resume_target_kernel(platform_mode); -- dpm_resume_end(PMSG_RECOVER); -+ /* -+ * The above should either succeed and jump to the new kernel, -+ * or return with an error. Otherwise things are just -+ * undefined, so let's be paranoid. -+ */ -+ BUG_ON(!error); - } -+ dpm_resume_end(PMSG_RECOVER); - pm_restore_gfp_mask(); - ftrace_start(); - resume_console(); -diff --git a/kernel/power/process.c b/kernel/power/process.c -index 14f9a8d..f1fe7ec 100644 ---- a/kernel/power/process.c -+++ b/kernel/power/process.c -@@ -107,6 +107,28 @@ static int try_to_freeze_tasks(bool user_only) - return todo ? -EBUSY : 0; - } - -+/* -+ * Returns true if all freezable tasks (except for current) are frozen already -+ */ -+static bool check_frozen_processes(void) -+{ -+ struct task_struct *g, *p; -+ bool ret = true; -+ -+ read_lock(&tasklist_lock); -+ for_each_process_thread(g, p) { -+ if (p != current && !freezer_should_skip(p) && -+ !frozen(p)) { -+ ret = false; -+ goto done; -+ } -+ } -+done: -+ read_unlock(&tasklist_lock); -+ -+ return ret; -+} -+ - /** - * freeze_processes - Signal user space processes to enter the refrigerator. - * The current thread will not be frozen. The same process that calls -@@ -117,6 +139,7 @@ static int try_to_freeze_tasks(bool user_only) - int freeze_processes(void) - { - int error; -+ int oom_kills_saved; - - error = __usermodehelper_disable(UMH_FREEZING); - if (error) -@@ -130,12 +153,27 @@ int freeze_processes(void) - - printk("Freezing user space processes ... "); - pm_freezing = true; -+ oom_kills_saved = oom_kills_count(); - error = try_to_freeze_tasks(true); - if (!error) { -- printk("done."); - __usermodehelper_set_disable_depth(UMH_DISABLED); - oom_killer_disable(); -+ -+ /* -+ * There might have been an OOM kill while we were -+ * freezing tasks and the killed task might be still -+ * on the way out so we have to double check for race. -+ */ -+ if (oom_kills_count() != oom_kills_saved && -+ !check_frozen_processes()) { -+ __usermodehelper_set_disable_depth(UMH_ENABLED); -+ printk("OOM in progress."); -+ error = -EBUSY; -+ goto done; -+ } -+ printk("done."); - } -+done: - printk("\n"); - BUG_ON(in_atomic()); - -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 677ebad..9a3f3c4 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -1895,6 +1895,8 @@ unsigned long to_ratio(u64 period, u64 runtime) - #ifdef CONFIG_SMP - inline struct dl_bw *dl_bw_of(int i) - { -+ rcu_lockdep_assert(rcu_read_lock_sched_held(), -+ "sched RCU must be held"); - return &cpu_rq(i)->rd->dl_bw; - } - -@@ -1903,6 +1905,8 @@ static inline int dl_bw_cpus(int i) - struct root_domain *rd = cpu_rq(i)->rd; - int cpus = 0; - -+ rcu_lockdep_assert(rcu_read_lock_sched_held(), -+ "sched RCU must be held"); - for_each_cpu_and(i, rd->span, cpu_active_mask) - cpus++; - -@@ -3937,13 +3941,14 @@ long sched_setaffinity(pid_t pid, const struct cpumask *in_mask) - * root_domain. - */ - #ifdef CONFIG_SMP -- if (task_has_dl_policy(p)) { -- const struct cpumask *span = task_rq(p)->rd->span; -- -- if (dl_bandwidth_enabled() && !cpumask_subset(span, new_mask)) { -+ if (task_has_dl_policy(p) && dl_bandwidth_enabled()) { -+ rcu_read_lock(); -+ if (!cpumask_subset(task_rq(p)->rd->span, new_mask)) { - retval = -EBUSY; -+ rcu_read_unlock(); - goto out_unlock; - } -+ rcu_read_unlock(); - } - #endif - again: -@@ -7458,6 +7463,8 @@ static int sched_dl_global_constraints(void) - int cpu, ret = 0; - unsigned long flags; - -+ rcu_read_lock(); -+ - /* - * Here we want to check the bandwidth not being set to some - * value smaller than the currently allocated bandwidth in -@@ -7479,6 +7486,8 @@ static int sched_dl_global_constraints(void) - break; - } - -+ rcu_read_unlock(); -+ - return ret; - } - -@@ -7494,6 +7503,7 @@ static void sched_dl_do_global(void) - if (global_rt_runtime() != RUNTIME_INF) - new_bw = to_ratio(global_rt_period(), global_rt_runtime()); - -+ rcu_read_lock(); - /* - * FIXME: As above... - */ -@@ -7504,6 +7514,7 @@ static void sched_dl_do_global(void) - dl_b->bw = new_bw; - raw_spin_unlock_irqrestore(&dl_b->lock, flags); - } -+ rcu_read_unlock(); - } - - static int sched_rt_global_validate(void) -diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c -index 759d5e0..7e3cd7a 100644 ---- a/kernel/trace/trace_syscalls.c -+++ b/kernel/trace/trace_syscalls.c -@@ -313,7 +313,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id) - int size; - - syscall_nr = trace_get_syscall_nr(current, regs); -- if (syscall_nr < 0) -+ if (syscall_nr < 0 || syscall_nr >= NR_syscalls) - return; - - /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE) */ -@@ -360,7 +360,7 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret) - int syscall_nr; - - syscall_nr = trace_get_syscall_nr(current, regs); -- if (syscall_nr < 0) -+ if (syscall_nr < 0 || syscall_nr >= NR_syscalls) - return; - - /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE()) */ -@@ -567,7 +567,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id) - int size; - - syscall_nr = trace_get_syscall_nr(current, regs); -- if (syscall_nr < 0) -+ if (syscall_nr < 0 || syscall_nr >= NR_syscalls) - return; - if (!test_bit(syscall_nr, enabled_perf_enter_syscalls)) - return; -@@ -641,7 +641,7 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret) - int size; - - syscall_nr = trace_get_syscall_nr(current, regs); -- if (syscall_nr < 0) -+ if (syscall_nr < 0 || syscall_nr >= NR_syscalls) - return; - if (!test_bit(syscall_nr, enabled_perf_exit_syscalls)) - return; -diff --git a/lib/bitmap.c b/lib/bitmap.c -index 06f7e4f..e5c4ebe 100644 ---- a/lib/bitmap.c -+++ b/lib/bitmap.c -@@ -131,7 +131,9 @@ void __bitmap_shift_right(unsigned long *dst, - lower = src[off + k]; - if (left && off + k == lim - 1) - lower &= mask; -- dst[k] = upper << (BITS_PER_LONG - rem) | lower >> rem; -+ dst[k] = lower >> rem; -+ if (rem) -+ dst[k] |= upper << (BITS_PER_LONG - rem); - if (left && k == lim - 1) - dst[k] &= mask; - } -@@ -172,7 +174,9 @@ void __bitmap_shift_left(unsigned long *dst, - upper = src[k]; - if (left && k == lim - 1) - upper &= (1UL << left) - 1; -- dst[k + off] = lower >> (BITS_PER_LONG - rem) | upper << rem; -+ dst[k + off] = upper << rem; -+ if (rem) -+ dst[k + off] |= lower >> (BITS_PER_LONG - rem); - if (left && k + off == lim - 1) - dst[k + off] &= (1UL << left) - 1; - } -diff --git a/lib/string.c b/lib/string.c -index e5878de..43d0781 100644 ---- a/lib/string.c -+++ b/lib/string.c -@@ -586,6 +586,22 @@ void *memset(void *s, int c, size_t count) - EXPORT_SYMBOL(memset); - #endif - -+/** -+ * memzero_explicit - Fill a region of memory (e.g. sensitive -+ * keying data) with 0s. -+ * @s: Pointer to the start of the area. -+ * @count: The size of the area. -+ * -+ * memzero_explicit() doesn't need an arch-specific version as -+ * it just invokes the one of memset() implicitly. -+ */ -+void memzero_explicit(void *s, size_t count) -+{ -+ memset(s, 0, count); -+ OPTIMIZER_HIDE_VAR(s); -+} -+EXPORT_SYMBOL(memzero_explicit); -+ - #ifndef __HAVE_ARCH_MEMCPY - /** - * memcpy - Copy one area of memory to another -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 718bfa1..331faa5 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -199,7 +199,7 @@ retry: - preempt_disable(); - if (cmpxchg(&huge_zero_page, NULL, zero_page)) { - preempt_enable(); -- __free_page(zero_page); -+ __free_pages(zero_page, compound_order(zero_page)); - goto retry; - } - -@@ -231,7 +231,7 @@ static unsigned long shrink_huge_zero_page_scan(struct shrinker *shrink, - if (atomic_cmpxchg(&huge_zero_refcount, 1, 0) == 1) { - struct page *zero_page = xchg(&huge_zero_page, NULL); - BUG_ON(zero_page == NULL); -- __free_page(zero_page); -+ __free_pages(zero_page, compound_order(zero_page)); - return HPAGE_PMD_NR; - } - -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index 9b35da2..b58d4fb 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -292,6 +292,9 @@ struct mem_cgroup { - /* vmpressure notifications */ - struct vmpressure vmpressure; - -+ /* css_online() has been completed */ -+ int initialized; -+ - /* - * the counter to account for mem+swap usage. - */ -@@ -1127,9 +1130,21 @@ skip_node: - * skipping css reference should be safe. - */ - if (next_css) { -- if ((next_css == &root->css) || -- ((next_css->flags & CSS_ONLINE) && css_tryget(next_css))) -- return mem_cgroup_from_css(next_css); -+ struct mem_cgroup *memcg = mem_cgroup_from_css(next_css); -+ -+ if (next_css == &root->css) -+ return memcg; -+ -+ if (css_tryget(next_css)) { -+ /* -+ * Make sure the memcg is initialized: -+ * mem_cgroup_css_online() orders the the -+ * initialization against setting the flag. -+ */ -+ if (smp_load_acquire(&memcg->initialized)) -+ return memcg; -+ css_put(next_css); -+ } - - prev_css = next_css; - goto skip_node; -@@ -6538,6 +6553,7 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css) - { - struct mem_cgroup *memcg = mem_cgroup_from_css(css); - struct mem_cgroup *parent = mem_cgroup_from_css(css_parent(css)); -+ int ret; - - if (css->cgroup->id > MEM_CGROUP_ID_MAX) - return -ENOSPC; -@@ -6574,7 +6590,18 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css) - } - mutex_unlock(&memcg_create_mutex); - -- return memcg_init_kmem(memcg, &mem_cgroup_subsys); -+ ret = memcg_init_kmem(memcg, &mem_cgroup_subsys); -+ if (ret) -+ return ret; -+ -+ /* -+ * Make sure the memcg is initialized: mem_cgroup_iter() -+ * orders reading memcg->initialized against its callers -+ * reading the memcg members. -+ */ -+ smp_store_release(&memcg->initialized, 1); -+ -+ return 0; - } - - /* -diff --git a/mm/oom_kill.c b/mm/oom_kill.c -index 3291e82..171c00f 100644 ---- a/mm/oom_kill.c -+++ b/mm/oom_kill.c -@@ -406,6 +406,23 @@ static void dump_header(struct task_struct *p, gfp_t gfp_mask, int order, - dump_tasks(memcg, nodemask); - } - -+/* -+ * Number of OOM killer invocations (including memcg OOM killer). -+ * Primarily used by PM freezer to check for potential races with -+ * OOM killed frozen task. -+ */ -+static atomic_t oom_kills = ATOMIC_INIT(0); -+ -+int oom_kills_count(void) -+{ -+ return atomic_read(&oom_kills); -+} -+ -+void note_oom_kill(void) -+{ -+ atomic_inc(&oom_kills); -+} -+ - #define K(x) ((x) << (PAGE_SHIFT-10)) - /* - * Must be called while holding a reference to p, which will be released upon -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index ff0f6b1..7b2611a 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -1957,7 +1957,7 @@ zonelist_scan: - if (alloc_flags & ALLOC_FAIR) { - if (!zone_local(preferred_zone, zone)) - continue; -- if (zone_page_state(zone, NR_ALLOC_BATCH) <= 0) -+ if (atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH]) <= 0) - continue; - } - /* -@@ -2196,6 +2196,14 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order, - } - - /* -+ * PM-freezer should be notified that there might be an OOM killer on -+ * its way to kill and wake somebody up. This is too early and we might -+ * end up not killing anything but false positives are acceptable. -+ * See freeze_processes. -+ */ -+ note_oom_kill(); -+ -+ /* - * Go through the zonelist yet one more time, keep very high watermark - * here, this is only to catch a parallel oom killing, we must fail if - * we're still under heavy pressure. -@@ -5662,9 +5670,8 @@ static void __setup_per_zone_wmarks(void) - zone->watermark[WMARK_HIGH] = min_wmark_pages(zone) + (tmp >> 1); - - __mod_zone_page_state(zone, NR_ALLOC_BATCH, -- high_wmark_pages(zone) - -- low_wmark_pages(zone) - -- zone_page_state(zone, NR_ALLOC_BATCH)); -+ high_wmark_pages(zone) - low_wmark_pages(zone) - -+ atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH])); - - setup_zone_migrate_reserve(zone); - spin_unlock_irqrestore(&zone->lock, flags); -diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c -index cfd1628..0e9a319 100644 ---- a/mm/page_cgroup.c -+++ b/mm/page_cgroup.c -@@ -171,6 +171,7 @@ static void free_page_cgroup(void *addr) - sizeof(struct page_cgroup) * PAGES_PER_SECTION; - - BUG_ON(PageReserved(page)); -+ kmemleak_free(addr); - free_pages_exact(addr, table_size); - } - } -diff --git a/mm/percpu.c b/mm/percpu.c -index 8cd4308..a2a54a8 100644 ---- a/mm/percpu.c -+++ b/mm/percpu.c -@@ -1917,8 +1917,6 @@ void __init setup_per_cpu_areas(void) - - if (pcpu_setup_first_chunk(ai, fc) < 0) - panic("Failed to initialize percpu areas."); -- -- pcpu_free_alloc_info(ai); - } - - #endif /* CONFIG_SMP */ -diff --git a/mm/truncate.c b/mm/truncate.c -index 353b683..ac18edc 100644 ---- a/mm/truncate.c -+++ b/mm/truncate.c -@@ -20,6 +20,7 @@ - #include <linux/buffer_head.h> /* grr. try_to_release_page, - do_invalidatepage */ - #include <linux/cleancache.h> -+#include <linux/rmap.h> - #include "internal.h" - - -@@ -613,12 +614,67 @@ EXPORT_SYMBOL(truncate_pagecache); - */ - void truncate_setsize(struct inode *inode, loff_t newsize) - { -+ loff_t oldsize = inode->i_size; -+ - i_size_write(inode, newsize); -+ if (newsize > oldsize) -+ pagecache_isize_extended(inode, oldsize, newsize); - truncate_pagecache(inode, newsize); - } - EXPORT_SYMBOL(truncate_setsize); - - /** -+ * pagecache_isize_extended - update pagecache after extension of i_size -+ * @inode: inode for which i_size was extended -+ * @from: original inode size -+ * @to: new inode size -+ * -+ * Handle extension of inode size either caused by extending truncate or by -+ * write starting after current i_size. We mark the page straddling current -+ * i_size RO so that page_mkwrite() is called on the nearest write access to -+ * the page. This way filesystem can be sure that page_mkwrite() is called on -+ * the page before user writes to the page via mmap after the i_size has been -+ * changed. -+ * -+ * The function must be called after i_size is updated so that page fault -+ * coming after we unlock the page will already see the new i_size. -+ * The function must be called while we still hold i_mutex - this not only -+ * makes sure i_size is stable but also that userspace cannot observe new -+ * i_size value before we are prepared to store mmap writes at new inode size. -+ */ -+void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to) -+{ -+ int bsize = 1 << inode->i_blkbits; -+ loff_t rounded_from; -+ struct page *page; -+ pgoff_t index; -+ -+ WARN_ON(to > inode->i_size); -+ -+ if (from >= to || bsize == PAGE_CACHE_SIZE) -+ return; -+ /* Page straddling @from will not have any hole block created? */ -+ rounded_from = round_up(from, bsize); -+ if (to <= rounded_from || !(rounded_from & (PAGE_CACHE_SIZE - 1))) -+ return; -+ -+ index = from >> PAGE_CACHE_SHIFT; -+ page = find_lock_page(inode->i_mapping, index); -+ /* Page not cached? Nothing to do */ -+ if (!page) -+ return; -+ /* -+ * See clear_page_dirty_for_io() for details why set_page_dirty() -+ * is needed. -+ */ -+ if (page_mkclean(page)) -+ set_page_dirty(page); -+ unlock_page(page); -+ page_cache_release(page); -+} -+EXPORT_SYMBOL(pagecache_isize_extended); -+ -+/** - * truncate_pagecache_range - unmap and remove pagecache that is hole-punched - * @inode: inode - * @lstart: offset of beginning of hole -diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c -index 0a31298..2e87eec 100644 ---- a/net/ceph/messenger.c -+++ b/net/ceph/messenger.c -@@ -291,7 +291,11 @@ int ceph_msgr_init(void) - if (ceph_msgr_slab_init()) - return -ENOMEM; - -- ceph_msgr_wq = alloc_workqueue("ceph-msgr", 0, 0); -+ /* -+ * The number of active work items is limited by the number of -+ * connections, so leave @max_active at default. -+ */ -+ ceph_msgr_wq = alloc_workqueue("ceph-msgr", WQ_MEM_RECLAIM, 0); - if (ceph_msgr_wq) - return 0; - -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index 9d43468..017fa5e 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -535,7 +535,7 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi) - return 1; - - attrlen = rtnh_attrlen(rtnh); -- if (attrlen < 0) { -+ if (attrlen > 0) { - struct nlattr *nla, *attrs = rtnh_attrs(rtnh); - - nla = nla_find(attrs, attrlen, RTA_GATEWAY); -diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c -index 2d24f29..8c8493e 100644 ---- a/net/ipv4/gre_offload.c -+++ b/net/ipv4/gre_offload.c -@@ -50,7 +50,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb, - - greh = (struct gre_base_hdr *)skb_transport_header(skb); - -- ghl = skb_inner_network_header(skb) - skb_transport_header(skb); -+ ghl = skb_inner_mac_header(skb) - skb_transport_header(skb); - if (unlikely(ghl < sizeof(*greh))) - goto out; - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index ed88d78..844323b 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1487,6 +1487,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, - struct sk_buff *nskb; - struct sock *sk; - struct inet_sock *inet; -+ int err; - - if (ip_options_echo(&replyopts.opt.opt, skb)) - return; -@@ -1525,8 +1526,13 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, - sock_net_set(sk, net); - __skb_queue_head_init(&sk->sk_write_queue); - sk->sk_sndbuf = sysctl_wmem_default; -- ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, len, 0, -- &ipc, &rt, MSG_DONTWAIT); -+ err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, -+ len, 0, &ipc, &rt, MSG_DONTWAIT); -+ if (unlikely(err)) { -+ ip_flush_pending_frames(sk); -+ goto out; -+ } -+ - nskb = skb_peek(&sk->sk_write_queue); - if (nskb) { - if (arg->csumoffset >= 0) -@@ -1538,7 +1544,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, - skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb)); - ip_push_pending_frames(sk, &fl4); - } -- -+out: - put_cpu_var(unicast_sock); - - ip_rt_put(rt); -diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c -index 65b664d..791a419 100644 ---- a/net/ipv4/ip_tunnel_core.c -+++ b/net/ipv4/ip_tunnel_core.c -@@ -91,11 +91,12 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto) - skb_pull_rcsum(skb, hdr_len); - - if (inner_proto == htons(ETH_P_TEB)) { -- struct ethhdr *eh = (struct ethhdr *)skb->data; -+ struct ethhdr *eh; - - if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) - return -ENOMEM; - -+ eh = (struct ethhdr *)skb->data; - if (likely(ntohs(eh->h_proto) >= ETH_P_802_3_MIN)) - skb->protocol = eh->h_proto; - else -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index f7d71ec..29d240b 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -2954,61 +2954,42 @@ EXPORT_SYMBOL(compat_tcp_getsockopt); - #endif - - #ifdef CONFIG_TCP_MD5SIG --static struct tcp_md5sig_pool __percpu *tcp_md5sig_pool __read_mostly; -+static DEFINE_PER_CPU(struct tcp_md5sig_pool, tcp_md5sig_pool); - static DEFINE_MUTEX(tcp_md5sig_mutex); -- --static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool __percpu *pool) --{ -- int cpu; -- -- for_each_possible_cpu(cpu) { -- struct tcp_md5sig_pool *p = per_cpu_ptr(pool, cpu); -- -- if (p->md5_desc.tfm) -- crypto_free_hash(p->md5_desc.tfm); -- } -- free_percpu(pool); --} -+static bool tcp_md5sig_pool_populated = false; - - static void __tcp_alloc_md5sig_pool(void) - { - int cpu; -- struct tcp_md5sig_pool __percpu *pool; -- -- pool = alloc_percpu(struct tcp_md5sig_pool); -- if (!pool) -- return; - - for_each_possible_cpu(cpu) { -- struct crypto_hash *hash; -- -- hash = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); -- if (IS_ERR_OR_NULL(hash)) -- goto out_free; -+ if (!per_cpu(tcp_md5sig_pool, cpu).md5_desc.tfm) { -+ struct crypto_hash *hash; - -- per_cpu_ptr(pool, cpu)->md5_desc.tfm = hash; -+ hash = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); -+ if (IS_ERR_OR_NULL(hash)) -+ return; -+ per_cpu(tcp_md5sig_pool, cpu).md5_desc.tfm = hash; -+ } - } -- /* before setting tcp_md5sig_pool, we must commit all writes -- * to memory. See ACCESS_ONCE() in tcp_get_md5sig_pool() -+ /* before setting tcp_md5sig_pool_populated, we must commit all writes -+ * to memory. See smp_rmb() in tcp_get_md5sig_pool() - */ - smp_wmb(); -- tcp_md5sig_pool = pool; -- return; --out_free: -- __tcp_free_md5sig_pool(pool); -+ tcp_md5sig_pool_populated = true; - } - - bool tcp_alloc_md5sig_pool(void) - { -- if (unlikely(!tcp_md5sig_pool)) { -+ if (unlikely(!tcp_md5sig_pool_populated)) { - mutex_lock(&tcp_md5sig_mutex); - -- if (!tcp_md5sig_pool) -+ if (!tcp_md5sig_pool_populated) - __tcp_alloc_md5sig_pool(); - - mutex_unlock(&tcp_md5sig_mutex); - } -- return tcp_md5sig_pool != NULL; -+ return tcp_md5sig_pool_populated; - } - EXPORT_SYMBOL(tcp_alloc_md5sig_pool); - -@@ -3022,13 +3003,13 @@ EXPORT_SYMBOL(tcp_alloc_md5sig_pool); - */ - struct tcp_md5sig_pool *tcp_get_md5sig_pool(void) - { -- struct tcp_md5sig_pool __percpu *p; -- - local_bh_disable(); -- p = ACCESS_ONCE(tcp_md5sig_pool); -- if (p) -- return __this_cpu_ptr(p); - -+ if (tcp_md5sig_pool_populated) { -+ /* coupled with smp_wmb() in __tcp_alloc_md5sig_pool() */ -+ smp_rmb(); -+ return this_cpu_ptr(&tcp_md5sig_pool); -+ } - local_bh_enable(); - return NULL; - } -diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c -index 798eb0f..ae4a06b 100644 ---- a/net/ipv6/output_core.c -+++ b/net/ipv6/output_core.c -@@ -3,10 +3,43 @@ - * not configured or static. These functions are needed by GSO/GRO implementation. - */ - #include <linux/export.h> -+#include <net/ip.h> - #include <net/ipv6.h> - #include <net/ip6_fib.h> - #include <net/addrconf.h> - -+/* This function exists only for tap drivers that must support broken -+ * clients requesting UFO without specifying an IPv6 fragment ID. -+ * -+ * This is similar to ipv6_select_ident() but we use an independent hash -+ * seed to limit information leakage. -+ * -+ * The network header must be set before calling this. -+ */ -+void ipv6_proxy_select_ident(struct sk_buff *skb) -+{ -+ static u32 ip6_proxy_idents_hashrnd __read_mostly; -+ struct in6_addr buf[2]; -+ struct in6_addr *addrs; -+ u32 hash, id; -+ -+ addrs = skb_header_pointer(skb, -+ skb_network_offset(skb) + -+ offsetof(struct ipv6hdr, saddr), -+ sizeof(buf), buf); -+ if (!addrs) -+ return; -+ -+ net_get_random_once(&ip6_proxy_idents_hashrnd, -+ sizeof(ip6_proxy_idents_hashrnd)); -+ -+ hash = __ipv6_addr_jhash(&addrs[1], ip6_proxy_idents_hashrnd); -+ hash = __ipv6_addr_jhash(&addrs[0], hash); -+ -+ id = ip_idents_reserve(hash, 1); -+ skb_shinfo(skb)->ip6_frag_id = htonl(id); -+} -+EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident); - - int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) - { -diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c -index 22b223f..74350c3 100644 ---- a/net/mac80211/rate.c -+++ b/net/mac80211/rate.c -@@ -462,7 +462,7 @@ static void rate_fixup_ratelist(struct ieee80211_vif *vif, - */ - if (!(rates[0].flags & IEEE80211_TX_RC_MCS)) { - u32 basic_rates = vif->bss_conf.basic_rates; -- s8 baserate = basic_rates ? ffs(basic_rates - 1) : 0; -+ s8 baserate = basic_rates ? ffs(basic_rates) - 1 : 0; - - rate = &sband->bitrates[rates[0].idx]; - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index c375d73..7c177bc 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -707,7 +707,7 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, - * after validation, the socket and the ring may only be used by a - * single process, otherwise we fall back to copying. - */ -- if (atomic_long_read(&sk->sk_socket->file->f_count) > 2 || -+ if (atomic_long_read(&sk->sk_socket->file->f_count) > 1 || - atomic_read(&nlk->mapped) > 1) - excl = false; - -diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c -index 3ea5cda..5ff8b87 100644 ---- a/net/sunrpc/clnt.c -+++ b/net/sunrpc/clnt.c -@@ -533,6 +533,8 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args) - - if (args->flags & RPC_CLNT_CREATE_AUTOBIND) - clnt->cl_autobind = 1; -+ if (args->flags & RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT) -+ clnt->cl_noretranstimeo = 1; - if (args->flags & RPC_CLNT_CREATE_DISCRTRY) - clnt->cl_discrtry = 1; - if (!(args->flags & RPC_CLNT_CREATE_QUIET)) -@@ -571,6 +573,7 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args, - /* Turn off autobind on clones */ - new->cl_autobind = 0; - new->cl_softrtry = clnt->cl_softrtry; -+ new->cl_noretranstimeo = clnt->cl_noretranstimeo; - new->cl_discrtry = clnt->cl_discrtry; - new->cl_chatty = clnt->cl_chatty; - return new; -diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c -index 0addefc..41c2f9d 100644 ---- a/net/sunrpc/xprtsock.c -+++ b/net/sunrpc/xprtsock.c -@@ -842,6 +842,8 @@ static void xs_error_report(struct sock *sk) - dprintk("RPC: xs_error_report client %p, error=%d...\n", - xprt, -err); - trace_rpc_socket_error(xprt, sk->sk_socket, err); -+ if (test_bit(XPRT_CONNECTION_REUSE, &xprt->state)) -+ goto out; - xprt_wake_pending_tasks(xprt, err); - out: - read_unlock_bh(&sk->sk_callback_lock); -@@ -2251,7 +2253,9 @@ static void xs_tcp_setup_socket(struct work_struct *work) - abort_and_exit = test_and_clear_bit(XPRT_CONNECTION_ABORT, - &xprt->state); - /* "close" the socket, preserving the local port */ -+ set_bit(XPRT_CONNECTION_REUSE, &xprt->state); - xs_tcp_reuse_connection(transport); -+ clear_bit(XPRT_CONNECTION_REUSE, &xprt->state); - - if (abort_and_exit) - goto out_eagain; -diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c -index 3c5cbb9..7e71e06 100644 ---- a/security/integrity/evm/evm_main.c -+++ b/security/integrity/evm/evm_main.c -@@ -269,6 +269,13 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, - goto out; - } - evm_status = evm_verify_current_integrity(dentry); -+ if (evm_status == INTEGRITY_NOXATTRS) { -+ struct integrity_iint_cache *iint; -+ -+ iint = integrity_iint_find(dentry->d_inode); -+ if (iint && (iint->flags & IMA_NEW_FILE)) -+ return 0; -+ } - out: - if (evm_status != INTEGRITY_PASS) - integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode, -@@ -296,9 +303,12 @@ int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, - { - const struct evm_ima_xattr_data *xattr_data = xattr_value; - -- if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0) -- && (xattr_data->type == EVM_XATTR_HMAC)) -- return -EPERM; -+ if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) { -+ if (!xattr_value_len) -+ return -EINVAL; -+ if (xattr_data->type != EVM_IMA_XATTR_DIGSIG) -+ return -EPERM; -+ } - return evm_protect_xattr(dentry, xattr_name, xattr_value, - xattr_value_len); - } -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index e294b86..47b5c69 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -470,6 +470,7 @@ next_inode: - list_entry(sbsec->isec_head.next, - struct inode_security_struct, list); - struct inode *inode = isec->inode; -+ list_del_init(&isec->list); - spin_unlock(&sbsec->isec_lock); - inode = igrab(inode); - if (inode) { -@@ -478,7 +479,6 @@ next_inode: - iput(inode); - } - spin_lock(&sbsec->isec_lock); -- list_del_init(&isec->list); - goto next_inode; - } - spin_unlock(&sbsec->isec_lock); -diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c -index af49721..c4ac3c1 100644 ---- a/sound/core/pcm_compat.c -+++ b/sound/core/pcm_compat.c -@@ -206,6 +206,8 @@ static int snd_pcm_status_user_compat(struct snd_pcm_substream *substream, - if (err < 0) - return err; - -+ if (clear_user(src, sizeof(*src))) -+ return -EFAULT; - if (put_user(status.state, &src->state) || - compat_put_timespec(&status.trigger_tstamp, &src->trigger_tstamp) || - compat_put_timespec(&status.tstamp, &src->tstamp) || -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 7ec9142..103e85a 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -4027,6 +4027,9 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = { - /* BayTrail */ - { PCI_DEVICE(0x8086, 0x0f04), - .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM }, -+ /* Braswell */ -+ { PCI_DEVICE(0x8086, 0x2284), -+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, - /* ICH */ - { PCI_DEVICE(0x8086, 0x2668), - .driver_data = AZX_DRIVER_ICH | AZX_DCAPS_OLD_SSYNC | -diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c -index 8253b48..611110a 100644 ---- a/sound/pci/hda/patch_hdmi.c -+++ b/sound/pci/hda/patch_hdmi.c -@@ -3317,6 +3317,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = { - { .id = 0x80862808, .name = "Broadwell HDMI", .patch = patch_generic_hdmi }, - { .id = 0x80862880, .name = "CedarTrail HDMI", .patch = patch_generic_hdmi }, - { .id = 0x80862882, .name = "Valleyview2 HDMI", .patch = patch_generic_hdmi }, -+{ .id = 0x80862883, .name = "Braswell HDMI", .patch = patch_generic_hdmi }, - { .id = 0x808629fb, .name = "Crestline HDMI", .patch = patch_generic_hdmi }, - {} /* terminator */ - }; -@@ -3373,6 +3374,7 @@ MODULE_ALIAS("snd-hda-codec-id:80862807"); - MODULE_ALIAS("snd-hda-codec-id:80862808"); - MODULE_ALIAS("snd-hda-codec-id:80862880"); - MODULE_ALIAS("snd-hda-codec-id:80862882"); -+MODULE_ALIAS("snd-hda-codec-id:80862883"); - MODULE_ALIAS("snd-hda-codec-id:808629fb"); - - MODULE_LICENSE("GPL"); -diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c -index eb241c6..fd53d37 100644 ---- a/sound/soc/codecs/tlv320aic3x.c -+++ b/sound/soc/codecs/tlv320aic3x.c -@@ -1121,6 +1121,7 @@ static int aic3x_regulator_event(struct notifier_block *nb, - static int aic3x_set_power(struct snd_soc_codec *codec, int power) - { - struct aic3x_priv *aic3x = snd_soc_codec_get_drvdata(codec); -+ unsigned int pll_c, pll_d; - int ret; - - if (power) { -@@ -1138,6 +1139,18 @@ static int aic3x_set_power(struct snd_soc_codec *codec, int power) - /* Sync reg_cache with the hardware */ - regcache_cache_only(aic3x->regmap, false); - regcache_sync(aic3x->regmap); -+ -+ /* Rewrite paired PLL D registers in case cached sync skipped -+ * writing one of them and thus caused other one also not -+ * being written -+ */ -+ pll_c = snd_soc_read(codec, AIC3X_PLL_PROGC_REG); -+ pll_d = snd_soc_read(codec, AIC3X_PLL_PROGD_REG); -+ if (pll_c == aic3x_reg[AIC3X_PLL_PROGC_REG].def || -+ pll_d == aic3x_reg[AIC3X_PLL_PROGD_REG].def) { -+ snd_soc_write(codec, AIC3X_PLL_PROGC_REG, pll_c); -+ snd_soc_write(codec, AIC3X_PLL_PROGD_REG, pll_d); -+ } - } else { - /* - * Do soft reset to this codec instance in order to clear -diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c -index 731d47b..e4da224 100644 ---- a/sound/soc/soc-dapm.c -+++ b/sound/soc/soc-dapm.c -@@ -689,9 +689,9 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w, - int shared; - struct snd_kcontrol *kcontrol; - bool wname_in_long_name, kcname_in_long_name; -- char *long_name; -+ char *long_name = NULL; - const char *name; -- int ret; -+ int ret = 0; - - if (dapm->codec) - prefix = dapm->codec->name_prefix; -@@ -756,15 +756,17 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w, - - kcontrol = snd_soc_cnew(&w->kcontrol_news[kci], NULL, name, - prefix); -- kfree(long_name); -- if (!kcontrol) -- return -ENOMEM; -+ if (!kcontrol) { -+ ret = -ENOMEM; -+ goto exit_free; -+ } -+ - kcontrol->private_free = dapm_kcontrol_free; - - ret = dapm_kcontrol_data_alloc(w, kcontrol); - if (ret) { - snd_ctl_free_one(kcontrol); -- return ret; -+ goto exit_free; - } - - ret = snd_ctl_add(card, kcontrol); -@@ -772,17 +774,18 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w, - dev_err(dapm->dev, - "ASoC: failed to add widget %s dapm kcontrol %s: %d\n", - w->name, name, ret); -- return ret; -+ goto exit_free; - } - } - - ret = dapm_kcontrol_add_widget(kcontrol, w); -- if (ret) -- return ret; -+ if (ret == 0) -+ w->kcontrols[kci] = kcontrol; - -- w->kcontrols[kci] = kcontrol; -+exit_free: -+ kfree(long_name); - -- return 0; -+ return ret; - } - - /* create new dapm mixer control */ -diff --git a/sound/usb/card.c b/sound/usb/card.c -index af19560..ab433a0 100644 ---- a/sound/usb/card.c -+++ b/sound/usb/card.c -@@ -586,18 +586,19 @@ static void snd_usb_audio_disconnect(struct usb_device *dev, - { - struct snd_card *card; - struct list_head *p; -+ bool was_shutdown; - - if (chip == (void *)-1L) - return; - - card = chip->card; - down_write(&chip->shutdown_rwsem); -+ was_shutdown = chip->shutdown; - chip->shutdown = 1; - up_write(&chip->shutdown_rwsem); - - mutex_lock(®ister_mutex); -- chip->num_interfaces--; -- if (chip->num_interfaces <= 0) { -+ if (!was_shutdown) { - struct snd_usb_endpoint *ep; - - snd_card_disconnect(card); -@@ -617,6 +618,10 @@ static void snd_usb_audio_disconnect(struct usb_device *dev, - list_for_each(p, &chip->mixer_list) { - snd_usb_mixer_disconnect(p); - } -+ } -+ -+ chip->num_interfaces--; -+ if (chip->num_interfaces <= 0) { - usb_chip[chip->index] = NULL; - mutex_unlock(®ister_mutex); - snd_card_free_when_closed(card); -diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c -index 714b949..1f0dc1e 100644 ---- a/virt/kvm/iommu.c -+++ b/virt/kvm/iommu.c -@@ -43,13 +43,13 @@ static void kvm_iommu_put_pages(struct kvm *kvm, - gfn_t base_gfn, unsigned long npages); - - static pfn_t kvm_pin_pages(struct kvm_memory_slot *slot, gfn_t gfn, -- unsigned long size) -+ unsigned long npages) - { - gfn_t end_gfn; - pfn_t pfn; - - pfn = gfn_to_pfn_memslot(slot, gfn); -- end_gfn = gfn + (size >> PAGE_SHIFT); -+ end_gfn = gfn + npages; - gfn += 1; - - if (is_error_noslot_pfn(pfn)) -@@ -119,7 +119,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) - * Pin all pages we are about to map in memory. This is - * important because we unmap and unpin in 4kb steps later. - */ -- pfn = kvm_pin_pages(slot, gfn, page_size); -+ pfn = kvm_pin_pages(slot, gfn, page_size >> PAGE_SHIFT); - if (is_error_noslot_pfn(pfn)) { - gfn += 1; - continue; -@@ -131,7 +131,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) - if (r) { - printk(KERN_ERR "kvm_iommu_map_address:" - "iommu failed to map pfn=%llx\n", pfn); -- kvm_unpin_pages(kvm, pfn, page_size); -+ kvm_unpin_pages(kvm, pfn, page_size >> PAGE_SHIFT); - goto unmap_pages; - } - diff --git a/3.17.3/0000_README b/3.14.25/0000_README index 854f93e..0670677 100644 --- a/3.17.3/0000_README +++ b/3.14.25/0000_README @@ -2,11 +2,7 @@ README ----------------------------------------------------------------------------- Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 1002_linux-3.17.3.patch -From: http://www.kernel.org -Desc: Linux 3.17.3 - -Patch: 4420_grsecurity-3.0-3.17.3-201411150027.patch +Patch: 4420_grsecurity-3.0-3.14.25-201411220954.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.14.24/4420_grsecurity-3.0-3.14.24-201411150026.patch b/3.14.25/4420_grsecurity-3.0-3.14.25-201411220954.patch index b8fbeb3..5a48407 100644 --- a/3.14.24/4420_grsecurity-3.0-3.14.24-201411150026.patch +++ b/3.14.25/4420_grsecurity-3.0-3.14.25-201411220954.patch @@ -292,7 +292,7 @@ index 7116fda..2f71588 100644 pcd. [PARIDE] diff --git a/Makefile b/Makefile -index 8fd0610..914c673 100644 +index eb96e40..b2742ca 100644 --- a/Makefile +++ b/Makefile @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -3780,7 +3780,7 @@ index 2dea8b5..6499da2 100644 extern void ux500_cpu_die(unsigned int cpu); diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig -index ca8ecde..58ba893 100644 +index e9c290c..d0e3d41 100644 --- a/arch/arm/mm/Kconfig +++ b/arch/arm/mm/Kconfig @@ -446,6 +446,7 @@ config CPU_32v5 @@ -3799,15 +3799,16 @@ index ca8ecde..58ba893 100644 help This option enables or disables the use of domain switching via the set_fs() function. -@@ -799,6 +801,7 @@ config NEED_KUSER_HELPERS +@@ -798,7 +800,7 @@ config NEED_KUSER_HELPERS + config KUSER_HELPERS bool "Enable kuser helpers in vector page" if !NEED_KUSER_HELPERS +- depends on MMU ++ depends on MMU && (!(CPU_V6 || CPU_V6K || CPU_V7) || GRKERNSEC_OLD_ARM_USERLAND) default y -+ depends on !(CPU_V6 || CPU_V6K || CPU_V7) || GRKERNSEC_OLD_ARM_USERLAND help Warning: disabling this option may break user programs. - -@@ -811,7 +814,7 @@ config KUSER_HELPERS +@@ -812,7 +814,7 @@ config KUSER_HELPERS See Documentation/arm/kernel_user_helpers.txt for details. However, the fixed address nature of these helpers can be used @@ -4827,19 +4828,6 @@ index 6c0f684..5faea9d 100644 #define access_ok(type, addr, size) __range_ok(addr, size) #define user_addr_max get_fs -diff --git a/arch/arm64/lib/clear_user.S b/arch/arm64/lib/clear_user.S -index 6e0ed93..c17967f 100644 ---- a/arch/arm64/lib/clear_user.S -+++ b/arch/arm64/lib/clear_user.S -@@ -46,7 +46,7 @@ USER(9f, strh wzr, [x0], #2 ) - sub x1, x1, #2 - 4: adds x1, x1, #1 - b.mi 5f -- strb wzr, [x0] -+USER(9f, strb wzr, [x0] ) - 5: mov x0, #0 - ret - ENDPROC(__clear_user) diff --git a/arch/avr32/include/asm/cache.h b/arch/avr32/include/asm/cache.h index c3a58a1..78fbf54 100644 --- a/arch/avr32/include/asm/cache.h @@ -5013,7 +5001,7 @@ index b86329d..6709906 100644 { int c, old; diff --git a/arch/frv/include/asm/cache.h b/arch/frv/include/asm/cache.h -index 2797163..c2a401d 100644 +index 2797163..c2a401df9 100644 --- a/arch/frv/include/asm/cache.h +++ b/arch/frv/include/asm/cache.h @@ -12,10 +12,11 @@ @@ -10393,10 +10381,10 @@ index c13c9f2..d572c34 100644 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c -index 50c3dd03..adff164 100644 +index 9af0a5d..06e12f4 100644 --- a/arch/sparc/kernel/smp_64.c +++ b/arch/sparc/kernel/smp_64.c -@@ -870,8 +870,8 @@ extern unsigned long xcall_flush_dcache_page_cheetah; +@@ -874,8 +874,8 @@ extern unsigned long xcall_flush_dcache_page_cheetah; extern unsigned long xcall_flush_dcache_page_spitfire; #ifdef CONFIG_DEBUG_DCFLUSH @@ -10407,7 +10395,7 @@ index 50c3dd03..adff164 100644 #endif static inline void __local_flush_dcache_page(struct page *page) -@@ -895,7 +895,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu) +@@ -899,7 +899,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu) return; #ifdef CONFIG_DEBUG_DCFLUSH @@ -10416,7 +10404,7 @@ index 50c3dd03..adff164 100644 #endif this_cpu = get_cpu(); -@@ -919,7 +919,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu) +@@ -923,7 +923,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu) xcall_deliver(data0, __pa(pg_addr), (u64) pg_addr, cpumask_of(cpu)); #ifdef CONFIG_DEBUG_DCFLUSH @@ -10425,7 +10413,7 @@ index 50c3dd03..adff164 100644 #endif } } -@@ -938,7 +938,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page) +@@ -942,7 +942,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page) preempt_disable(); #ifdef CONFIG_DEBUG_DCFLUSH @@ -10434,7 +10422,7 @@ index 50c3dd03..adff164 100644 #endif data0 = 0; pg_addr = page_address(page); -@@ -955,7 +955,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page) +@@ -959,7 +959,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page) xcall_deliver(data0, __pa(pg_addr), (u64) pg_addr, cpu_online_mask); #ifdef CONFIG_DEBUG_DCFLUSH @@ -12598,7 +12586,7 @@ index 50f8c5e..4f84fff 100644 return diff; } diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile -index 0fcd913..3bb5c42 100644 +index 14fe7cb..829b962 100644 --- a/arch/x86/boot/compressed/Makefile +++ b/arch/x86/boot/compressed/Makefile @@ -16,6 +16,9 @@ KBUILD_CFLAGS += $(cflags-y) @@ -12654,7 +12642,7 @@ index a53440e..c3dbf1e 100644 .previous diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S -index f45ab7a..ebc015f 100644 +index c5b56ed..9f79ed3 100644 --- a/arch/x86/boot/compressed/head_32.S +++ b/arch/x86/boot/compressed/head_32.S @@ -119,10 +119,10 @@ preferred_addr: @@ -12671,7 +12659,7 @@ index f45ab7a..ebc015f 100644 /* Target address to relocate to for decompression */ diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S -index b10fa66..5ee0472 100644 +index 34bbc09..c126b87 100644 --- a/arch/x86/boot/compressed/head_64.S +++ b/arch/x86/boot/compressed/head_64.S @@ -94,10 +94,10 @@ ENTRY(startup_32) @@ -12700,7 +12688,7 @@ index b10fa66..5ee0472 100644 1: /* Target address to relocate to for decompression */ -@@ -363,8 +363,8 @@ gdt: +@@ -366,8 +366,8 @@ gdt: .long gdt .word 0 .quad 0x0000000000000000 /* NULL descriptor */ @@ -12712,7 +12700,7 @@ index b10fa66..5ee0472 100644 .quad 0x0000000000000000 /* TS continued */ gdt_end: diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c -index 196eaf3..c96716d 100644 +index eb25ca1..3de0f7c 100644 --- a/arch/x86/boot/compressed/misc.c +++ b/arch/x86/boot/compressed/misc.c @@ -218,7 +218,7 @@ void __putstr(const char *s) @@ -12760,7 +12748,7 @@ index 196eaf3..c96716d 100644 break; default: /* Ignore other PT_* */ break; } -@@ -430,7 +433,7 @@ asmlinkage void *decompress_kernel(void *rmode, memptr heap, +@@ -437,7 +440,7 @@ asmlinkage void *decompress_kernel(void *rmode, memptr heap, error("Destination address too large"); #endif #ifndef CONFIG_RELOCATABLE @@ -21710,7 +21698,7 @@ index 639d128..e92d7e5 100644 while (amd_iommu_v2_event_descs[i].attr.attr.name) diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c -index 1340ebf..fc6d5c9 100644 +index 5ee8064..4d32df9 100644 --- a/arch/x86/kernel/cpu/perf_event_intel.c +++ b/arch/x86/kernel/cpu/perf_event_intel.c @@ -2318,10 +2318,10 @@ __init int intel_pmu_init(void) @@ -26667,7 +26655,7 @@ index 9c0280f..5bbb1c0 100644 ip = *(u64 *)(fp+8); if (!in_sched_functions(ip)) diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c -index 7461f50..01d0b9c 100644 +index 0686fe3..836eed3 100644 --- a/arch/x86/kernel/ptrace.c +++ b/arch/x86/kernel/ptrace.c @@ -184,14 +184,13 @@ unsigned long kernel_stack_pointer(struct pt_regs *regs) @@ -26781,9 +26769,9 @@ index 7461f50..01d0b9c 100644 } void user_single_step_siginfo(struct task_struct *tsk, -@@ -1450,6 +1463,10 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, - # define IS_IA32 0 - #endif +@@ -1441,6 +1454,10 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, + force_sig_info(SIGTRAP, &info, tsk); + } +#ifdef CONFIG_GRKERNSEC_SETXID +extern void gr_delayed_cred_worker(void); @@ -26792,7 +26780,7 @@ index 7461f50..01d0b9c 100644 /* * We must return the syscall number to actually look up in the table. * This can be -1L to skip running any syscall at all. -@@ -1460,6 +1477,11 @@ long syscall_trace_enter(struct pt_regs *regs) +@@ -1451,6 +1468,11 @@ long syscall_trace_enter(struct pt_regs *regs) user_exit(); @@ -26804,7 +26792,7 @@ index 7461f50..01d0b9c 100644 /* * If we stepped into a sysenter/syscall insn, it trapped in * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP. -@@ -1515,6 +1537,11 @@ void syscall_trace_leave(struct pt_regs *regs) +@@ -1506,6 +1528,11 @@ void syscall_trace_leave(struct pt_regs *regs) */ user_exit(); @@ -28796,7 +28784,7 @@ index 0c90f4b..9fca4d7 100644 vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 51c2851..394306f 100644 +index fab97ad..394306f 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1806,8 +1806,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data) @@ -28819,15 +28807,6 @@ index 51c2851..394306f 100644 if (copy_to_user(user_msr_list->indices, &msrs_to_save, num_msrs_to_save * sizeof(u32))) goto out; -@@ -4911,7 +4913,7 @@ static int handle_emulation_failure(struct kvm_vcpu *vcpu) - - ++vcpu->stat.insn_emulation_fail; - trace_kvm_emulate_insn_failed(vcpu); -- if (!is_guest_mode(vcpu)) { -+ if (!is_guest_mode(vcpu) && kvm_x86_ops->get_cpl(vcpu) == 0) { - vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR; - vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION; - vcpu->run->internal.ndata = 0; @@ -5532,7 +5534,7 @@ static struct notifier_block pvclock_gtod_notifier = { }; #endif @@ -33634,7 +33613,7 @@ index 9f0614d..92ae64a 100644 p += get_opcode(p, &opcode); for (i = 0; i < ARRAY_SIZE(imm_wop); i++) diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c -index c96314a..433b127 100644 +index 0004ac7..2ab49d0 100644 --- a/arch/x86/mm/pgtable.c +++ b/arch/x86/mm/pgtable.c @@ -97,10 +97,71 @@ static inline void pgd_list_del(pgd_t *pgd) @@ -40402,20 +40381,6 @@ index 57ea7f4..af06b76 100644 card->driver->update_phy_reg(card, 4, PHY_LINK_ACTIVE | PHY_CONTENDER, 0); -diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c -index d7d5c8a..6d44568 100644 ---- a/drivers/firewire/core-cdev.c -+++ b/drivers/firewire/core-cdev.c -@@ -1637,8 +1637,7 @@ static int dispatch_ioctl(struct client *client, - _IOC_SIZE(cmd) > sizeof(buffer)) - return -ENOTTY; - -- if (_IOC_DIR(cmd) == _IOC_READ) -- memset(&buffer, 0, _IOC_SIZE(cmd)); -+ memset(&buffer, 0, sizeof(buffer)); - - if (_IOC_DIR(cmd) & _IOC_WRITE) - if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd))) diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c index 2c6d5e1..a2cca6b 100644 --- a/drivers/firewire/core-device.c @@ -44779,7 +44744,7 @@ index 65ee3a0..1852af9 100644 void dm_uevent_add(struct mapped_device *md, struct list_head *elist) diff --git a/drivers/md/md.c b/drivers/md/md.c -index 73aedcb..424968a 100644 +index 40959ee..ba57756 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -194,10 +194,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev); @@ -44851,7 +44816,7 @@ index 73aedcb..424968a 100644 INIT_LIST_HEAD(&rdev->same_set); init_waitqueue_head(&rdev->blocked_wait); -@@ -7075,7 +7075,7 @@ static int md_seq_show(struct seq_file *seq, void *v) +@@ -7079,7 +7079,7 @@ static int md_seq_show(struct seq_file *seq, void *v) spin_unlock(&pers_lock); seq_printf(seq, "\n"); @@ -44860,7 +44825,7 @@ index 73aedcb..424968a 100644 return 0; } if (v == (void*)2) { -@@ -7178,7 +7178,7 @@ static int md_seq_open(struct inode *inode, struct file *file) +@@ -7182,7 +7182,7 @@ static int md_seq_open(struct inode *inode, struct file *file) return error; seq = file->private_data; @@ -44869,7 +44834,7 @@ index 73aedcb..424968a 100644 return error; } -@@ -7192,7 +7192,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait) +@@ -7196,7 +7196,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait) /* always allow read */ mask = POLLIN | POLLRDNORM; @@ -44878,7 +44843,7 @@ index 73aedcb..424968a 100644 mask |= POLLERR | POLLPRI; return mask; } -@@ -7236,7 +7236,7 @@ static int is_mddev_idle(struct mddev *mddev, int init) +@@ -7240,7 +7240,7 @@ static int is_mddev_idle(struct mddev *mddev, int init) struct gendisk *disk = rdev->bdev->bd_contains->bd_disk; curr_events = (int)part_stat_read(&disk->part0, sectors[0]) + (int)part_stat_read(&disk->part0, sectors[1]) - @@ -46162,20 +46127,6 @@ index 98d24ae..bc22415 100644 return 1; } -diff --git a/drivers/media/usb/ttusb-dec/ttusbdecfe.c b/drivers/media/usb/ttusb-dec/ttusbdecfe.c -index 5c45c9d..9c29552 100644 ---- a/drivers/media/usb/ttusb-dec/ttusbdecfe.c -+++ b/drivers/media/usb/ttusb-dec/ttusbdecfe.c -@@ -156,6 +156,9 @@ static int ttusbdecfe_dvbs_diseqc_send_master_cmd(struct dvb_frontend* fe, struc - 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00 }; - -+ if (cmd->msg_len > sizeof(b) - 4) -+ return -EINVAL; -+ - memcpy(&b[4], cmd->msg, cmd->msg_len); - - state->config->send_command(fe, 0x72, diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c index fca336b..fb70ab7 100644 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c @@ -47773,7 +47724,7 @@ index fbf7dcd..ad71499 100644 }; diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c -index f30ceb1..81c589c 100644 +index 07c942b..bce8b8a 100644 --- a/drivers/net/macvtap.c +++ b/drivers/net/macvtap.c @@ -422,7 +422,7 @@ static void macvtap_setup(struct net_device *dev) @@ -47785,7 +47736,7 @@ index f30ceb1..81c589c 100644 .kind = "macvtap", .setup = macvtap_setup, .newlink = macvtap_newlink, -@@ -1018,7 +1018,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd, +@@ -1023,7 +1023,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd, } ret = 0; @@ -47794,7 +47745,7 @@ index f30ceb1..81c589c 100644 put_user(q->flags, &ifr->ifr_flags)) ret = -EFAULT; macvtap_put_vlan(vlan); -@@ -1188,7 +1188,7 @@ static int macvtap_device_event(struct notifier_block *unused, +@@ -1193,7 +1193,7 @@ static int macvtap_device_event(struct notifier_block *unused, return NOTIFY_DONE; } @@ -47825,6 +47776,21 @@ index 5a1897d..e860630 100644 break; err = 0; break; +diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c +index 1aff970..cc2ee29 100644 +--- a/drivers/net/ppp/pptp.c ++++ b/drivers/net/ppp/pptp.c +@@ -506,7 +506,9 @@ static int pptp_getname(struct socket *sock, struct sockaddr *uaddr, + int len = sizeof(struct sockaddr_pppox); + struct sockaddr_pppox sp; + +- sp.sa_family = AF_PPPOX; ++ memset(&sp.sa_addr, 0, sizeof(sp.sa_addr)); ++ ++ sp.sa_family = AF_PPPOX; + sp.sa_protocol = PX_PROTO_PPTP; + sp.sa_addr.pptp = pppox_sk(sock->sk)->proto.pptp.src_addr; + diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index 1252d9c..80e660b 100644 --- a/drivers/net/slip/slhc.c @@ -47852,10 +47818,10 @@ index 979fe43..1f1230c 100644 }; diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index 2c8b1c2..9942a89 100644 +index ec63314..17810e8 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c -@@ -1883,7 +1883,7 @@ unlock: +@@ -1882,7 +1882,7 @@ unlock: } static long __tun_chr_ioctl(struct file *file, unsigned int cmd, @@ -47864,7 +47830,7 @@ index 2c8b1c2..9942a89 100644 { struct tun_file *tfile = file->private_data; struct tun_struct *tun; -@@ -1896,6 +1896,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd, +@@ -1895,6 +1895,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd, unsigned int ifindex; int ret; @@ -48001,7 +47967,7 @@ index a2515887..6d13233 100644 /* we will have to manufacture ethernet headers, prepare template */ diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index 07a3255..4c59b30 100644 +index 841b608..198a8b7 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -47,7 +47,7 @@ module_param(gso, bool, 0444); @@ -48014,10 +47980,10 @@ index 07a3255..4c59b30 100644 #define VIRTNET_DRIVER_VERSION "1.0.0" diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index 0704a04..4208d2d 100644 +index 5441b49..d8030d2 100644 --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c -@@ -2847,7 +2847,7 @@ nla_put_failure: +@@ -2855,7 +2855,7 @@ nla_put_failure: return -EMSGSIZE; } @@ -48026,7 +47992,7 @@ index 0704a04..4208d2d 100644 .kind = "vxlan", .maxtype = IFLA_VXLAN_MAX, .policy = vxlan_policy, -@@ -2894,7 +2894,7 @@ static int vxlan_lowerdev_event(struct notifier_block *unused, +@@ -2902,7 +2902,7 @@ static int vxlan_lowerdev_event(struct notifier_block *unused, return NOTIFY_DONE; } @@ -48718,10 +48684,10 @@ index ea7e70c..bc0c45f 100644 data->sku_cap_band_24GHz_enable ? "" : "NOT", "enabled", data->sku_cap_band_52GHz_enable ? "" : "NOT", "enabled", diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c -index 16be0c0..eb0bc12 100644 +index fb62927..2748d8c 100644 --- a/drivers/net/wireless/iwlwifi/pcie/trans.c +++ b/drivers/net/wireless/iwlwifi/pcie/trans.c -@@ -1371,7 +1371,7 @@ static ssize_t iwl_dbgfs_interrupt_write(struct file *file, +@@ -1373,7 +1373,7 @@ static ssize_t iwl_dbgfs_interrupt_write(struct file *file, struct isr_statistics *isr_stats = &trans_pcie->isr_stats; char buf[8]; @@ -48730,7 +48696,7 @@ index 16be0c0..eb0bc12 100644 u32 reset_flag; memset(buf, 0, sizeof(buf)); -@@ -1392,7 +1392,7 @@ static ssize_t iwl_dbgfs_csr_write(struct file *file, +@@ -1394,7 +1394,7 @@ static ssize_t iwl_dbgfs_csr_write(struct file *file, { struct iwl_trans *trans = file->private_data; char buf[8]; @@ -48740,10 +48706,10 @@ index 16be0c0..eb0bc12 100644 memset(buf, 0, sizeof(buf)); diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index 69d4c31..bd0b316 100644 +index 505ff60..6a1c9aa 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -2541,20 +2541,20 @@ static int __init init_mac80211_hwsim(void) +@@ -2543,20 +2543,20 @@ static int __init init_mac80211_hwsim(void) if (channels < 1) return -EINVAL; @@ -64028,7 +63994,7 @@ index f4ccfe6..a5cf064 100644 static struct callback_op callback_ops[]; diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c -index 15f9d98..082c625 100644 +index 6659ce5..1e6de9b 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -1189,16 +1189,16 @@ static int nfs_size_need_update(const struct inode *inode, const struct nfs_fatt @@ -79642,19 +79608,6 @@ index 939533d..cf0a57c 100644 /** * struct clk_init_data - holds init data that's common to all clocks and is -diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h -index 67301a4..879065d 100644 ---- a/include/linux/clocksource.h -+++ b/include/linux/clocksource.h -@@ -289,7 +289,7 @@ extern struct clocksource* clocksource_get_next(void); - extern void clocksource_change_rating(struct clocksource *cs, int rating); - extern void clocksource_suspend(void); - extern void clocksource_resume(void); --extern struct clocksource * __init __weak clocksource_default_clock(void); -+extern struct clocksource * __init clocksource_default_clock(void); - extern void clocksource_mark_unstable(struct clocksource *cs); - - extern u64 diff --git a/include/linux/compat.h b/include/linux/compat.h index 3f448c6..df3ce1d 100644 --- a/include/linux/compat.h @@ -79989,32 +79942,6 @@ index d08e4d2..95fad61 100644 int cpumask_any_but(const struct cpumask *mask, unsigned int cpu); /** -diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h -index 7032518..60023e5 100644 ---- a/include/linux/crash_dump.h -+++ b/include/linux/crash_dump.h -@@ -14,14 +14,13 @@ - extern unsigned long long elfcorehdr_addr; - extern unsigned long long elfcorehdr_size; - --extern int __weak elfcorehdr_alloc(unsigned long long *addr, -- unsigned long long *size); --extern void __weak elfcorehdr_free(unsigned long long addr); --extern ssize_t __weak elfcorehdr_read(char *buf, size_t count, u64 *ppos); --extern ssize_t __weak elfcorehdr_read_notes(char *buf, size_t count, u64 *ppos); --extern int __weak remap_oldmem_pfn_range(struct vm_area_struct *vma, -- unsigned long from, unsigned long pfn, -- unsigned long size, pgprot_t prot); -+extern int elfcorehdr_alloc(unsigned long long *addr, unsigned long long *size); -+extern void elfcorehdr_free(unsigned long long addr); -+extern ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos); -+extern ssize_t elfcorehdr_read_notes(char *buf, size_t count, u64 *ppos); -+extern int remap_oldmem_pfn_range(struct vm_area_struct *vma, -+ unsigned long from, unsigned long pfn, -+ unsigned long size, pgprot_t prot); - - extern ssize_t copy_oldmem_page(unsigned long, char *, size_t, - unsigned long, int); diff --git a/include/linux/cred.h b/include/linux/cred.h index 04421e8..a85afd4 100644 --- a/include/linux/cred.h @@ -82215,7 +82142,7 @@ index a74c3a8..28d3f21 100644 extern struct key_type key_type_keyring; diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h -index 6b06d37..19f605f 100644 +index e465bb1..19f605f 100644 --- a/include/linux/kgdb.h +++ b/include/linux/kgdb.h @@ -52,7 +52,7 @@ extern int kgdb_connected; @@ -82236,7 +82163,7 @@ index 6b06d37..19f605f 100644 /** * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB. -@@ -279,11 +279,11 @@ struct kgdb_io { +@@ -279,7 +279,7 @@ struct kgdb_io { void (*pre_exception) (void); void (*post_exception) (void); int is_console; @@ -82245,11 +82172,6 @@ index 6b06d37..19f605f 100644 extern struct kgdb_arch arch_kgdb_ops; --extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs); -+extern unsigned long kgdb_arch_pc(int exception, struct pt_regs *regs); - - #ifdef CONFIG_SERIAL_KGDB_NMI - extern int kgdb_register_nmi_console(void); diff --git a/include/linux/kmod.h b/include/linux/kmod.h index 0555cc6..40116ce 100644 --- a/include/linux/kmod.h @@ -82499,19 +82421,6 @@ index c45c089..298841c 100644 { u32 remainder; return div_u64_rem(dividend, divisor, &remainder); -diff --git a/include/linux/memory.h b/include/linux/memory.h -index bb7384e..8b8d8d1 100644 ---- a/include/linux/memory.h -+++ b/include/linux/memory.h -@@ -35,7 +35,7 @@ struct memory_block { - }; - - int arch_get_memory_phys_device(unsigned long start_pfn); --unsigned long __weak memory_block_size_bytes(void); -+unsigned long memory_block_size_bytes(void); - - /* These states are exposed to userspace as text strings in sysfs */ - #define MEM_ONLINE (1<<0) /* exposed to userspace */ diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h index 5bba088..7ad4ae7 100644 --- a/include/linux/mempolicy.h @@ -82538,7 +82447,7 @@ index 5bba088..7ad4ae7 100644 static inline int vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst) diff --git a/include/linux/mm.h b/include/linux/mm.h -index 0a0b024..ebee54f 100644 +index d5039da..71096b6 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -127,6 +127,11 @@ extern unsigned int kobjsize(const void *objp); @@ -82572,7 +82481,7 @@ index 0a0b024..ebee54f 100644 struct mmu_gather; struct inode; -@@ -1112,8 +1118,8 @@ int follow_pfn(struct vm_area_struct *vma, unsigned long address, +@@ -1120,8 +1126,8 @@ int follow_pfn(struct vm_area_struct *vma, unsigned long address, unsigned long *pfn); int follow_phys(struct vm_area_struct *vma, unsigned long address, unsigned int flags, unsigned long *prot, resource_size_t *phys); @@ -82583,7 +82492,7 @@ index 0a0b024..ebee54f 100644 static inline void unmap_shared_mapping_range(struct address_space *mapping, loff_t const holebegin, loff_t const holelen) -@@ -1153,9 +1159,9 @@ static inline int fixup_user_fault(struct task_struct *tsk, +@@ -1161,9 +1167,9 @@ static inline int fixup_user_fault(struct task_struct *tsk, } #endif @@ -82596,7 +82505,7 @@ index 0a0b024..ebee54f 100644 long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, unsigned long start, unsigned long nr_pages, -@@ -1187,34 +1193,6 @@ int set_page_dirty(struct page *page); +@@ -1195,34 +1201,6 @@ int set_page_dirty(struct page *page); int set_page_dirty_lock(struct page *page); int clear_page_dirty_for_io(struct page *page); @@ -82631,7 +82540,7 @@ index 0a0b024..ebee54f 100644 extern pid_t vm_is_stack(struct task_struct *task, struct vm_area_struct *vma, int in_group); -@@ -1314,6 +1292,15 @@ static inline void sync_mm_rss(struct mm_struct *mm) +@@ -1322,6 +1300,15 @@ static inline void sync_mm_rss(struct mm_struct *mm) } #endif @@ -82647,7 +82556,7 @@ index 0a0b024..ebee54f 100644 int vma_wants_writenotify(struct vm_area_struct *vma); extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr, -@@ -1332,8 +1319,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, +@@ -1340,8 +1327,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, { return 0; } @@ -82663,7 +82572,7 @@ index 0a0b024..ebee54f 100644 #endif #ifdef __PAGETABLE_PMD_FOLDED -@@ -1342,8 +1336,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud, +@@ -1350,8 +1344,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud, { return 0; } @@ -82679,7 +82588,7 @@ index 0a0b024..ebee54f 100644 #endif int __pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma, -@@ -1361,11 +1362,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a +@@ -1369,11 +1370,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a NULL: pud_offset(pgd, address); } @@ -82703,7 +82612,7 @@ index 0a0b024..ebee54f 100644 #endif /* CONFIG_MMU && !__ARCH_HAS_4LEVEL_HACK */ #if USE_SPLIT_PTE_PTLOCKS -@@ -1755,7 +1768,7 @@ extern int install_special_mapping(struct mm_struct *mm, +@@ -1763,7 +1776,7 @@ extern int install_special_mapping(struct mm_struct *mm, unsigned long addr, unsigned long len, unsigned long flags, struct page **pages); @@ -82712,7 +82621,7 @@ index 0a0b024..ebee54f 100644 extern unsigned long mmap_region(struct file *file, unsigned long addr, unsigned long len, vm_flags_t vm_flags, unsigned long pgoff); -@@ -1763,6 +1776,7 @@ extern unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, +@@ -1771,6 +1784,7 @@ extern unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, unsigned long pgoff, unsigned long *populate); extern int do_munmap(struct mm_struct *, unsigned long, size_t); @@ -82720,7 +82629,7 @@ index 0a0b024..ebee54f 100644 #ifdef CONFIG_MMU extern int __mm_populate(unsigned long addr, unsigned long len, -@@ -1791,10 +1805,11 @@ struct vm_unmapped_area_info { +@@ -1799,10 +1813,11 @@ struct vm_unmapped_area_info { unsigned long high_limit; unsigned long align_mask; unsigned long align_offset; @@ -82734,7 +82643,7 @@ index 0a0b024..ebee54f 100644 /* * Search for an unmapped address range. -@@ -1806,7 +1821,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info); +@@ -1814,7 +1829,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info); * - satisfies (begin_addr & align_mask) == (align_offset & align_mask) */ static inline unsigned long @@ -82743,7 +82652,7 @@ index 0a0b024..ebee54f 100644 { if (!(info->flags & VM_UNMAPPED_AREA_TOPDOWN)) return unmapped_area(info); -@@ -1869,6 +1884,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add +@@ -1874,6 +1889,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr, struct vm_area_struct **pprev); @@ -82754,7 +82663,7 @@ index 0a0b024..ebee54f 100644 /* Look up the first VMA which intersects the interval start_addr..end_addr-1, NULL if none. Assume start_addr < end_addr. */ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr) -@@ -1897,15 +1916,6 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm, +@@ -1902,15 +1921,6 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm, return vma; } @@ -82770,7 +82679,7 @@ index 0a0b024..ebee54f 100644 #ifdef CONFIG_NUMA_BALANCING unsigned long change_prot_numa(struct vm_area_struct *vma, unsigned long start, unsigned long end); -@@ -1957,6 +1967,11 @@ void vm_stat_account(struct mm_struct *, unsigned long, struct file *, long); +@@ -1962,6 +1972,11 @@ void vm_stat_account(struct mm_struct *, unsigned long, struct file *, long); static inline void vm_stat_account(struct mm_struct *mm, unsigned long flags, struct file *file, long pages) { @@ -82782,7 +82691,7 @@ index 0a0b024..ebee54f 100644 mm->total_vm += pages; } #endif /* CONFIG_PROC_FS */ -@@ -2038,7 +2053,7 @@ extern int unpoison_memory(unsigned long pfn); +@@ -2043,7 +2058,7 @@ extern int unpoison_memory(unsigned long pfn); extern int sysctl_memory_failure_early_kill; extern int sysctl_memory_failure_recovery; extern void shake_page(struct page *p, int access); @@ -82791,7 +82700,7 @@ index 0a0b024..ebee54f 100644 extern int soft_offline_page(struct page *page, int flags); #if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_HUGETLBFS) -@@ -2073,5 +2088,11 @@ void __init setup_nr_node_ids(void); +@@ -2078,5 +2093,11 @@ void __init setup_nr_node_ids(void); static inline void setup_nr_node_ids(void) {} #endif @@ -82868,10 +82777,10 @@ index c5d5278..f0b68c8 100644 } diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index e6800f0..d59674e 100644 +index 1884353..626ca6b 100644 --- a/include/linux/mmzone.h +++ b/include/linux/mmzone.h -@@ -400,7 +400,7 @@ struct zone { +@@ -401,7 +401,7 @@ struct zone { unsigned long flags; /* zone flags, see below */ /* Zone statistics */ @@ -85957,24 +85866,8 @@ index 4a5b9a3..ca27d73 100644 .update = sctp_csum_update, .combine = sctp_csum_combine, }; -diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h -index a3353f4..ba41e01 100644 ---- a/include/net/sctp/sctp.h -+++ b/include/net/sctp/sctp.h -@@ -433,6 +433,11 @@ static inline void sctp_assoc_pending_pmtu(struct sock *sk, struct sctp_associat - asoc->pmtu_pending = 0; - } - -+static inline bool sctp_chunk_pending(const struct sctp_chunk *chunk) -+{ -+ return !list_empty(&chunk->list); -+} -+ - /* Walk through a list of TLV parameters. Don't trust the - * individual parameter lengths and instead depend on - * the chunk length to indicate when to stop. Make sure diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h -index 7f4eeb3..aaa63d9 100644 +index 72a31db..aaa63d9 100644 --- a/include/net/sctp/sm.h +++ b/include/net/sctp/sm.h @@ -80,7 +80,7 @@ typedef void (sctp_timer_event_t) (unsigned long); @@ -85986,19 +85879,6 @@ index 7f4eeb3..aaa63d9 100644 /* A naming convention of "sctp_sf_xxx" applies to all the state functions * currently in use. -@@ -248,9 +248,9 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *, - int, __be16); - struct sctp_chunk *sctp_make_asconf_set_prim(struct sctp_association *asoc, - union sctp_addr *addr); --int sctp_verify_asconf(const struct sctp_association *asoc, -- struct sctp_paramhdr *param_hdr, void *chunk_end, -- struct sctp_paramhdr **errp); -+bool sctp_verify_asconf(const struct sctp_association *asoc, -+ struct sctp_chunk *chunk, bool addr_param_needed, -+ struct sctp_paramhdr **errp); - struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, - struct sctp_chunk *asconf); - int sctp_process_asconf_ack(struct sctp_association *asoc, @@ -292,7 +292,7 @@ __u32 sctp_generate_tag(const struct sctp_endpoint *); __u32 sctp_generate_tsn(const struct sctp_endpoint *); @@ -87234,7 +87114,7 @@ index f486b00..442867f 100644 case SHMDT: return sys_shmdt(compat_ptr(ptr)); diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c -index 1702864..797fa84 100644 +index cadddc8..c263084 100644 --- a/ipc/ipc_sysctl.c +++ b/ipc/ipc_sysctl.c @@ -30,7 +30,7 @@ static void *get_ipc(ctl_table *table) @@ -87279,9 +87159,9 @@ index 1702864..797fa84 100644 { - struct ctl_table ipc_table; + ctl_table_no_const ipc_table; - size_t lenp_bef = *lenp; int oldval; int rc; + diff --git a/ipc/mq_sysctl.c b/ipc/mq_sysctl.c index 5bb8bfe..a38ec05 100644 --- a/ipc/mq_sysctl.c @@ -87513,7 +87393,7 @@ index 8d6e145..33e0b1e 100644 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim; set_fs(fs); diff --git a/kernel/audit.c b/kernel/audit.c -index 2c0ecd1..80d068a 100644 +index b45b2da..159e8c4 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -122,7 +122,7 @@ u32 audit_sig_sid = 0; @@ -88117,10 +87997,10 @@ index 0b097c8..11dd5c5 100644 #ifdef CONFIG_MODULE_UNLOAD { diff --git a/kernel/events/core.c b/kernel/events/core.c -index 4ced342f..6624485 100644 +index 4bbb27a..decf605 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c -@@ -158,8 +158,15 @@ static struct srcu_struct pmus_srcu; +@@ -159,8 +159,15 @@ static struct srcu_struct pmus_srcu; * 0 - disallow raw tracepoint access for unpriv * 1 - disallow cpu events for unpriv * 2 - disallow kernel profiling for unpriv @@ -88137,7 +88017,7 @@ index 4ced342f..6624485 100644 /* Minimum for 512 kiB + 1 user control page */ int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */ -@@ -185,7 +192,7 @@ void update_perf_cpu_limits(void) +@@ -186,7 +193,7 @@ void update_perf_cpu_limits(void) tmp *= sysctl_perf_cpu_time_max_percent; do_div(tmp, 100); @@ -88146,7 +88026,7 @@ index 4ced342f..6624485 100644 } static int perf_rotate_context(struct perf_cpu_context *cpuctx); -@@ -272,7 +279,7 @@ void perf_sample_event_took(u64 sample_len_ns) +@@ -273,7 +280,7 @@ void perf_sample_event_took(u64 sample_len_ns) update_perf_cpu_limits(); } @@ -88155,7 +88035,7 @@ index 4ced342f..6624485 100644 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx, enum event_type_t event_type); -@@ -3010,7 +3017,7 @@ static void __perf_event_read(void *info) +@@ -3011,7 +3018,7 @@ static void __perf_event_read(void *info) static inline u64 perf_event_count(struct perf_event *event) { @@ -88164,7 +88044,7 @@ index 4ced342f..6624485 100644 } static u64 perf_event_read(struct perf_event *event) -@@ -3375,9 +3382,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running) +@@ -3376,9 +3383,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running) mutex_lock(&event->child_mutex); total += perf_event_read(event); *enabled += event->total_time_enabled + @@ -88176,7 +88056,7 @@ index 4ced342f..6624485 100644 list_for_each_entry(child, &event->child_list, child_list) { total += perf_event_read(child); -@@ -3806,10 +3813,10 @@ void perf_event_update_userpage(struct perf_event *event) +@@ -3827,10 +3834,10 @@ void perf_event_update_userpage(struct perf_event *event) userpg->offset -= local64_read(&event->hw.prev_count); userpg->time_enabled = enabled + @@ -88189,7 +88069,7 @@ index 4ced342f..6624485 100644 arch_perf_update_userpage(userpg, now); -@@ -4360,7 +4367,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size, +@@ -4381,7 +4388,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size, /* Data. */ sp = perf_user_stack_pointer(regs); @@ -88198,7 +88078,7 @@ index 4ced342f..6624485 100644 dyn_size = dump_size - rem; perf_output_skip(handle, rem); -@@ -4451,11 +4458,11 @@ static void perf_output_read_one(struct perf_output_handle *handle, +@@ -4472,11 +4479,11 @@ static void perf_output_read_one(struct perf_output_handle *handle, values[n++] = perf_event_count(event); if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) { values[n++] = enabled + @@ -88212,7 +88092,7 @@ index 4ced342f..6624485 100644 } if (read_format & PERF_FORMAT_ID) values[n++] = primary_event_id(event); -@@ -6734,7 +6741,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, +@@ -6755,7 +6762,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, event->parent = parent_event; event->ns = get_pid_ns(task_active_pid_ns(current)); @@ -88221,7 +88101,7 @@ index 4ced342f..6624485 100644 event->state = PERF_EVENT_STATE_INACTIVE; -@@ -7034,6 +7041,11 @@ SYSCALL_DEFINE5(perf_event_open, +@@ -7055,6 +7062,11 @@ SYSCALL_DEFINE5(perf_event_open, if (flags & ~PERF_FLAG_ALL) return -EINVAL; @@ -88233,7 +88113,7 @@ index 4ced342f..6624485 100644 err = perf_copy_attr(attr_uptr, &attr); if (err) return err; -@@ -7372,10 +7384,10 @@ static void sync_child_event(struct perf_event *child_event, +@@ -7393,10 +7405,10 @@ static void sync_child_event(struct perf_event *child_event, /* * Add back the child's count to the parent's count: */ @@ -91264,7 +91144,7 @@ index 732f8ae..42c1919 100644 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) { per_cpu(rcu_torture_count, cpu)[i] = 0; diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c -index b3d116c..ebf6598 100644 +index 6705d94..137e56f 100644 --- a/kernel/rcu/tree.c +++ b/kernel/rcu/tree.c @@ -390,9 +390,9 @@ static void rcu_eqs_enter_common(struct rcu_dynticks *rdtp, long long oldval, @@ -91349,7 +91229,7 @@ index b3d116c..ebf6598 100644 snap = (unsigned int)rdp->dynticks_snap; /* -@@ -1450,9 +1450,9 @@ static int rcu_gp_init(struct rcu_state *rsp) +@@ -1466,9 +1466,9 @@ static int rcu_gp_init(struct rcu_state *rsp) rdp = this_cpu_ptr(rsp->rda); rcu_preempt_check_blocked_tasks(rnp); rnp->qsmask = rnp->qsmaskinit; @@ -91361,7 +91241,7 @@ index b3d116c..ebf6598 100644 if (rnp == rdp->mynode) __note_gp_changes(rsp, rnp, rdp); rcu_preempt_boost_start_gp(rnp); -@@ -1546,7 +1546,7 @@ static void rcu_gp_cleanup(struct rcu_state *rsp) +@@ -1562,7 +1562,7 @@ static void rcu_gp_cleanup(struct rcu_state *rsp) rcu_for_each_node_breadth_first(rsp, rnp) { raw_spin_lock_irq(&rnp->lock); smp_mb__after_unlock_lock(); @@ -91370,7 +91250,7 @@ index b3d116c..ebf6598 100644 rdp = this_cpu_ptr(rsp->rda); if (rnp == rdp->mynode) __note_gp_changes(rsp, rnp, rdp); -@@ -1912,7 +1912,7 @@ rcu_send_cbs_to_orphanage(int cpu, struct rcu_state *rsp, +@@ -1928,7 +1928,7 @@ rcu_send_cbs_to_orphanage(int cpu, struct rcu_state *rsp, rsp->qlen += rdp->qlen; rdp->n_cbs_orphaned += rdp->qlen; rdp->qlen_lazy = 0; @@ -91379,7 +91259,7 @@ index b3d116c..ebf6598 100644 } /* -@@ -2159,7 +2159,7 @@ static void rcu_do_batch(struct rcu_state *rsp, struct rcu_data *rdp) +@@ -2175,7 +2175,7 @@ static void rcu_do_batch(struct rcu_state *rsp, struct rcu_data *rdp) } smp_mb(); /* List handling before counting for rcu_barrier(). */ rdp->qlen_lazy -= count_lazy; @@ -91388,7 +91268,7 @@ index b3d116c..ebf6598 100644 rdp->n_cbs_invoked += count; /* Reinstate batch limit if we have worked down the excess. */ -@@ -2362,7 +2362,7 @@ __rcu_process_callbacks(struct rcu_state *rsp) +@@ -2378,7 +2378,7 @@ __rcu_process_callbacks(struct rcu_state *rsp) /* * Do RCU core processing for the current CPU. */ @@ -91397,7 +91277,7 @@ index b3d116c..ebf6598 100644 { struct rcu_state *rsp; -@@ -2470,7 +2470,7 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu), +@@ -2486,7 +2486,7 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu), WARN_ON_ONCE((unsigned long)head & 0x3); /* Misaligned rcu_head! */ if (debug_rcu_head_queue(head)) { /* Probable double call_rcu(), so leak the callback. */ @@ -91406,7 +91286,7 @@ index b3d116c..ebf6598 100644 WARN_ONCE(1, "__call_rcu(): Leaked duplicate callback\n"); return; } -@@ -2498,7 +2498,7 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu), +@@ -2514,7 +2514,7 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu), local_irq_restore(flags); return; } @@ -91415,7 +91295,7 @@ index b3d116c..ebf6598 100644 if (lazy) rdp->qlen_lazy++; else -@@ -2707,11 +2707,11 @@ void synchronize_sched_expedited(void) +@@ -2723,11 +2723,11 @@ void synchronize_sched_expedited(void) * counter wrap on a 32-bit system. Quite a few more CPUs would of * course be required on a 64-bit system. */ @@ -91429,7 +91309,7 @@ index b3d116c..ebf6598 100644 return; } -@@ -2719,7 +2719,7 @@ void synchronize_sched_expedited(void) +@@ -2735,7 +2735,7 @@ void synchronize_sched_expedited(void) * Take a ticket. Note that atomic_inc_return() implies a * full memory barrier. */ @@ -91438,7 +91318,7 @@ index b3d116c..ebf6598 100644 firstsnap = snap; get_online_cpus(); WARN_ON_ONCE(cpu_is_offline(raw_smp_processor_id())); -@@ -2732,14 +2732,14 @@ void synchronize_sched_expedited(void) +@@ -2748,14 +2748,14 @@ void synchronize_sched_expedited(void) synchronize_sched_expedited_cpu_stop, NULL) == -EAGAIN) { put_online_cpus(); @@ -91455,7 +91335,7 @@ index b3d116c..ebf6598 100644 return; } -@@ -2748,7 +2748,7 @@ void synchronize_sched_expedited(void) +@@ -2764,7 +2764,7 @@ void synchronize_sched_expedited(void) udelay(trycount * num_online_cpus()); } else { wait_rcu_gp(call_rcu_sched); @@ -91464,7 +91344,7 @@ index b3d116c..ebf6598 100644 return; } -@@ -2757,7 +2757,7 @@ void synchronize_sched_expedited(void) +@@ -2773,7 +2773,7 @@ void synchronize_sched_expedited(void) if (ULONG_CMP_GE((ulong)s, (ulong)firstsnap)) { /* ensure test happens before caller kfree */ smp_mb__before_atomic_inc(); /* ^^^ */ @@ -91473,7 +91353,7 @@ index b3d116c..ebf6598 100644 return; } -@@ -2769,10 +2769,10 @@ void synchronize_sched_expedited(void) +@@ -2785,10 +2785,10 @@ void synchronize_sched_expedited(void) * period works for us. */ get_online_cpus(); @@ -91486,7 +91366,7 @@ index b3d116c..ebf6598 100644 /* * Everyone up to our most recent fetch is covered by our grace -@@ -2781,16 +2781,16 @@ void synchronize_sched_expedited(void) +@@ -2797,16 +2797,16 @@ void synchronize_sched_expedited(void) * than we did already did their update. */ do { @@ -91506,7 +91386,7 @@ index b3d116c..ebf6598 100644 put_online_cpus(); } -@@ -2996,7 +2996,7 @@ static void _rcu_barrier(struct rcu_state *rsp) +@@ -3012,7 +3012,7 @@ static void _rcu_barrier(struct rcu_state *rsp) * ACCESS_ONCE() to prevent the compiler from speculating * the increment to precede the early-exit check. */ @@ -91515,7 +91395,7 @@ index b3d116c..ebf6598 100644 WARN_ON_ONCE((rsp->n_barrier_done & 0x1) != 1); _rcu_barrier_trace(rsp, "Inc1", -1, rsp->n_barrier_done); smp_mb(); /* Order ->n_barrier_done increment with below mechanism. */ -@@ -3046,7 +3046,7 @@ static void _rcu_barrier(struct rcu_state *rsp) +@@ -3062,7 +3062,7 @@ static void _rcu_barrier(struct rcu_state *rsp) /* Increment ->n_barrier_done to prevent duplicate work. */ smp_mb(); /* Keep increment after above mechanism. */ @@ -91524,7 +91404,7 @@ index b3d116c..ebf6598 100644 WARN_ON_ONCE((rsp->n_barrier_done & 0x1) != 0); _rcu_barrier_trace(rsp, "Inc2", -1, rsp->n_barrier_done); smp_mb(); /* Keep increment before caller's subsequent code. */ -@@ -3091,10 +3091,10 @@ rcu_boot_init_percpu_data(int cpu, struct rcu_state *rsp) +@@ -3107,10 +3107,10 @@ rcu_boot_init_percpu_data(int cpu, struct rcu_state *rsp) rdp->grpmask = 1UL << (cpu - rdp->mynode->grplo); init_callback_list(rdp); rdp->qlen_lazy = 0; @@ -91537,7 +91417,7 @@ index b3d116c..ebf6598 100644 rdp->cpu = cpu; rdp->rsp = rsp; rcu_boot_init_nocb_percpu_data(rdp); -@@ -3128,8 +3128,8 @@ rcu_init_percpu_data(int cpu, struct rcu_state *rsp, int preemptible) +@@ -3144,8 +3144,8 @@ rcu_init_percpu_data(int cpu, struct rcu_state *rsp, int preemptible) init_callback_list(rdp); /* Re-enable callbacks on this CPU. */ rdp->dynticks->dynticks_nesting = DYNTICK_TASK_EXIT_IDLE; rcu_sysidle_init_percpu_data(rdp->dynticks); @@ -94254,7 +94134,7 @@ index 963b703..438bc51 100644 /** * percpu_ref_init - initialize a percpu refcount diff --git a/lib/radix-tree.c b/lib/radix-tree.c -index bd4a8df..9e4804f 100644 +index 7e30d2a..eccc695 100644 --- a/lib/radix-tree.c +++ b/lib/radix-tree.c @@ -93,7 +93,7 @@ struct radix_tree_preload { @@ -94550,10 +94430,10 @@ index 09d9591..165bb75 100644 bdi_destroy(bdi); return err; diff --git a/mm/filemap.c b/mm/filemap.c -index c2cc7c9..50ef696 100644 +index bdaa215..2949940 100644 --- a/mm/filemap.c +++ b/mm/filemap.c -@@ -1768,7 +1768,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma) +@@ -1998,7 +1998,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma) struct address_space *mapping = file->f_mapping; if (!mapping->a_ops->readpage) @@ -94562,7 +94442,7 @@ index c2cc7c9..50ef696 100644 file_accessed(file); vma->vm_ops = &generic_file_vm_ops; return 0; -@@ -1950,7 +1950,7 @@ static size_t __iovec_copy_from_user_inatomic(char *vaddr, +@@ -2162,7 +2162,7 @@ static size_t __iovec_copy_from_user_inatomic(char *vaddr, while (bytes) { char __user *buf = iov->iov_base + base; @@ -94571,8 +94451,8 @@ index c2cc7c9..50ef696 100644 base = 0; left = __copy_from_user_inatomic(vaddr, buf, copy); -@@ -1979,7 +1979,7 @@ size_t iov_iter_copy_from_user_atomic(struct page *page, - BUG_ON(!in_atomic()); +@@ -2190,7 +2190,7 @@ size_t iov_iter_copy_from_user_atomic(struct page *page, + kaddr = kmap_atomic(page); if (likely(i->nr_segs == 1)) { - int left; @@ -94580,7 +94460,7 @@ index c2cc7c9..50ef696 100644 char __user *buf = i->iov->iov_base + i->iov_offset; left = __copy_from_user_inatomic(kaddr + offset, buf, bytes); copied = bytes - left; -@@ -2007,7 +2007,7 @@ size_t iov_iter_copy_from_user(struct page *page, +@@ -2218,7 +2218,7 @@ size_t iov_iter_copy_from_user(struct page *page, kaddr = kmap(page); if (likely(i->nr_segs == 1)) { @@ -94589,7 +94469,7 @@ index c2cc7c9..50ef696 100644 char __user *buf = i->iov->iov_base + i->iov_offset; left = __copy_from_user(kaddr + offset, buf, bytes); copied = bytes - left; -@@ -2037,7 +2037,7 @@ void iov_iter_advance(struct iov_iter *i, size_t bytes) +@@ -2248,7 +2248,7 @@ void iov_iter_advance(struct iov_iter *i, size_t bytes) * zero-length segments (without overruning the iovec). */ while (bytes || unlikely(i->count && !iov->iov_len)) { @@ -94598,7 +94478,7 @@ index c2cc7c9..50ef696 100644 copy = min(bytes, iov->iov_len - base); BUG_ON(!i->count || i->count < copy); -@@ -2108,6 +2108,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i +@@ -2319,6 +2319,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i *pos = i_size_read(inode); if (limit != RLIM_INFINITY) { @@ -94788,10 +94668,10 @@ index 67d0c17..b22c193 100644 if (!ptep) return VM_FAULT_OOM; diff --git a/mm/internal.h b/mm/internal.h -index 3e91000..4741a60 100644 +index 1a8a0d4..2c580ef 100644 --- a/mm/internal.h +++ b/mm/internal.h -@@ -94,6 +94,7 @@ extern pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address); +@@ -109,6 +109,7 @@ extern pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address); * in mm/page_alloc.c */ extern void __free_pages_bootmem(struct page *page, unsigned int order); @@ -94799,7 +94679,7 @@ index 3e91000..4741a60 100644 extern void prep_compound_page(struct page *page, unsigned long order); #ifdef CONFIG_MEMORY_FAILURE extern bool is_free_buddy_page(struct page *page); -@@ -352,7 +353,7 @@ extern u32 hwpoison_filter_enable; +@@ -370,7 +371,7 @@ extern u32 hwpoison_filter_enable; extern unsigned long vm_mmap_pgoff(struct file *, unsigned long, unsigned long, unsigned long, @@ -94853,7 +94733,7 @@ index d53adf9..03a24bf 100644 set_fs(old_fs); diff --git a/mm/madvise.c b/mm/madvise.c -index 539eeb9..e24a987 100644 +index a402f8f..f5e5daa 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -51,6 +51,10 @@ static long madvise_behavior(struct vm_area_struct *vma, @@ -94933,7 +94813,7 @@ index 539eeb9..e24a987 100644 if (end == start) return error; diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index 33365e9..2234ef9 100644 +index a98c7fc..393f8f1 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -61,7 +61,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0; @@ -95783,7 +95663,7 @@ index 492e36f..b153792 100644 mm = get_task_mm(tsk); if (!mm) diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index 796c7e6..3e6ec8a 100644 +index e8fff0f..8d10fb5 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -747,6 +747,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, @@ -95859,10 +95739,10 @@ index 796c7e6..3e6ec8a 100644 capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE); diff --git a/mm/migrate.c b/mm/migrate.c -index 13f47fb..95c4b9f 100644 +index 3acac4a..a186f71 100644 --- a/mm/migrate.c +++ b/mm/migrate.c -@@ -1488,8 +1488,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages, +@@ -1511,8 +1511,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages, */ tcred = __task_cred(task); if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) && @@ -97619,7 +97499,7 @@ index 9f45f87..749bfd8 100644 unsigned long bg_thresh, unsigned long dirty, diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 7b2611a..4407637 100644 +index 4b25829..382c9bd 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -61,6 +61,7 @@ @@ -97715,7 +97595,7 @@ index 7b2611a..4407637 100644 if (order && (gfp_flags & __GFP_COMP)) prep_compound_page(page, order); -@@ -1957,7 +1997,7 @@ zonelist_scan: +@@ -1960,7 +2000,7 @@ zonelist_scan: if (alloc_flags & ALLOC_FAIR) { if (!zone_local(preferred_zone, zone)) continue; @@ -97724,7 +97604,7 @@ index 7b2611a..4407637 100644 continue; } /* -@@ -2422,7 +2462,7 @@ static void reset_alloc_batches(struct zonelist *zonelist, +@@ -2424,7 +2464,7 @@ static void reset_alloc_batches(struct zonelist *zonelist, continue; mod_zone_page_state(zone, NR_ALLOC_BATCH, high_wmark_pages(zone) - low_wmark_pages(zone) - @@ -97733,7 +97613,7 @@ index 7b2611a..4407637 100644 } } -@@ -5671,7 +5711,7 @@ static void __setup_per_zone_wmarks(void) +@@ -5669,7 +5709,7 @@ static void __setup_per_zone_wmarks(void) __mod_zone_page_state(zone, NR_ALLOC_BATCH, high_wmark_pages(zone) - low_wmark_pages(zone) - @@ -97742,7 +97622,7 @@ index 7b2611a..4407637 100644 setup_zone_migrate_reserve(zone); spin_unlock_irqrestore(&zone->lock, flags); -@@ -6613,4 +6653,4 @@ void dump_page(struct page *page, char *reason) +@@ -6611,4 +6651,4 @@ void dump_page(struct page *page, char *reason) { dump_page_badflags(page, reason, 0); } @@ -97942,7 +97822,7 @@ index cdbd312..2e1e0b9 100644 /* diff --git a/mm/shmem.c b/mm/shmem.c -index f0d698b..7037c25 100644 +index 0f14475..c469130d 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -33,7 +33,7 @@ @@ -97963,7 +97843,7 @@ index f0d698b..7037c25 100644 /* * shmem_fallocate communicates with shmem_fault or shmem_writepage via -@@ -2300,6 +2300,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = { +@@ -2240,6 +2240,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = { static int shmem_xattr_validate(const char *name) { struct { const char *prefix; size_t len; } arr[] = { @@ -97975,7 +97855,7 @@ index f0d698b..7037c25 100644 { XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN }, { XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN } }; -@@ -2355,6 +2360,15 @@ static int shmem_setxattr(struct dentry *dentry, const char *name, +@@ -2295,6 +2300,15 @@ static int shmem_setxattr(struct dentry *dentry, const char *name, if (err) return err; @@ -97991,7 +97871,7 @@ index f0d698b..7037c25 100644 return simple_xattr_set(&info->xattrs, name, value, size, flags); } -@@ -2667,8 +2681,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent) +@@ -2607,8 +2621,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent) int err = -ENOMEM; /* Round up to L1_CACHE_BYTES to resist false sharing */ @@ -99101,7 +98981,7 @@ index 63c3ea5..95c0858 100644 } } diff --git a/mm/swap.c b/mm/swap.c -index 0092097..33361ff 100644 +index c8048d7..099d1a3 100644 --- a/mm/swap.c +++ b/mm/swap.c @@ -31,6 +31,7 @@ @@ -100234,323 +100114,6 @@ index b543470..d2ddae2 100644 if (!can_dir) { printk(KERN_INFO "can: failed to create /proc/net/can . " -diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c -index 6e7a236..06f19b9 100644 ---- a/net/ceph/crypto.c -+++ b/net/ceph/crypto.c -@@ -89,11 +89,82 @@ static struct crypto_blkcipher *ceph_crypto_alloc_cipher(void) - - static const u8 *aes_iv = (u8 *)CEPH_AES_IV; - -+/* -+ * Should be used for buffers allocated with ceph_kvmalloc(). -+ * Currently these are encrypt out-buffer (ceph_buffer) and decrypt -+ * in-buffer (msg front). -+ * -+ * Dispose of @sgt with teardown_sgtable(). -+ * -+ * @prealloc_sg is to avoid memory allocation inside sg_alloc_table() -+ * in cases where a single sg is sufficient. No attempt to reduce the -+ * number of sgs by squeezing physically contiguous pages together is -+ * made though, for simplicity. -+ */ -+static int setup_sgtable(struct sg_table *sgt, struct scatterlist *prealloc_sg, -+ const void *buf, unsigned int buf_len) -+{ -+ struct scatterlist *sg; -+ const bool is_vmalloc = is_vmalloc_addr(buf); -+ unsigned int off = offset_in_page(buf); -+ unsigned int chunk_cnt = 1; -+ unsigned int chunk_len = PAGE_ALIGN(off + buf_len); -+ int i; -+ int ret; -+ -+ if (buf_len == 0) { -+ memset(sgt, 0, sizeof(*sgt)); -+ return -EINVAL; -+ } -+ -+ if (is_vmalloc) { -+ chunk_cnt = chunk_len >> PAGE_SHIFT; -+ chunk_len = PAGE_SIZE; -+ } -+ -+ if (chunk_cnt > 1) { -+ ret = sg_alloc_table(sgt, chunk_cnt, GFP_NOFS); -+ if (ret) -+ return ret; -+ } else { -+ WARN_ON(chunk_cnt != 1); -+ sg_init_table(prealloc_sg, 1); -+ sgt->sgl = prealloc_sg; -+ sgt->nents = sgt->orig_nents = 1; -+ } -+ -+ for_each_sg(sgt->sgl, sg, sgt->orig_nents, i) { -+ struct page *page; -+ unsigned int len = min(chunk_len - off, buf_len); -+ -+ if (is_vmalloc) -+ page = vmalloc_to_page(buf); -+ else -+ page = virt_to_page(buf); -+ -+ sg_set_page(sg, page, len, off); -+ -+ off = 0; -+ buf += len; -+ buf_len -= len; -+ } -+ WARN_ON(buf_len != 0); -+ -+ return 0; -+} -+ -+static void teardown_sgtable(struct sg_table *sgt) -+{ -+ if (sgt->orig_nents > 1) -+ sg_free_table(sgt); -+} -+ - static int ceph_aes_encrypt(const void *key, int key_len, - void *dst, size_t *dst_len, - const void *src, size_t src_len) - { -- struct scatterlist sg_in[2], sg_out[1]; -+ struct scatterlist sg_in[2], prealloc_sg; -+ struct sg_table sg_out; - struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher(); - struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 }; - int ret; -@@ -109,16 +180,18 @@ static int ceph_aes_encrypt(const void *key, int key_len, - - *dst_len = src_len + zero_padding; - -- crypto_blkcipher_setkey((void *)tfm, key, key_len); - sg_init_table(sg_in, 2); - sg_set_buf(&sg_in[0], src, src_len); - sg_set_buf(&sg_in[1], pad, zero_padding); -- sg_init_table(sg_out, 1); -- sg_set_buf(sg_out, dst, *dst_len); -+ ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len); -+ if (ret) -+ goto out_tfm; -+ -+ crypto_blkcipher_setkey((void *)tfm, key, key_len); - iv = crypto_blkcipher_crt(tfm)->iv; - ivsize = crypto_blkcipher_ivsize(tfm); -- - memcpy(iv, aes_iv, ivsize); -+ - /* - print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1, - key, key_len, 1); -@@ -127,16 +200,22 @@ static int ceph_aes_encrypt(const void *key, int key_len, - print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1, - pad, zero_padding, 1); - */ -- ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in, -+ ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in, - src_len + zero_padding); -- crypto_free_blkcipher(tfm); -- if (ret < 0) -+ if (ret < 0) { - pr_err("ceph_aes_crypt failed %d\n", ret); -+ goto out_sg; -+ } - /* - print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1, - dst, *dst_len, 1); - */ -- return 0; -+ -+out_sg: -+ teardown_sgtable(&sg_out); -+out_tfm: -+ crypto_free_blkcipher(tfm); -+ return ret; - } - - static int ceph_aes_encrypt2(const void *key, int key_len, void *dst, -@@ -144,7 +223,8 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst, - const void *src1, size_t src1_len, - const void *src2, size_t src2_len) - { -- struct scatterlist sg_in[3], sg_out[1]; -+ struct scatterlist sg_in[3], prealloc_sg; -+ struct sg_table sg_out; - struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher(); - struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 }; - int ret; -@@ -160,17 +240,19 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst, - - *dst_len = src1_len + src2_len + zero_padding; - -- crypto_blkcipher_setkey((void *)tfm, key, key_len); - sg_init_table(sg_in, 3); - sg_set_buf(&sg_in[0], src1, src1_len); - sg_set_buf(&sg_in[1], src2, src2_len); - sg_set_buf(&sg_in[2], pad, zero_padding); -- sg_init_table(sg_out, 1); -- sg_set_buf(sg_out, dst, *dst_len); -+ ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len); -+ if (ret) -+ goto out_tfm; -+ -+ crypto_blkcipher_setkey((void *)tfm, key, key_len); - iv = crypto_blkcipher_crt(tfm)->iv; - ivsize = crypto_blkcipher_ivsize(tfm); -- - memcpy(iv, aes_iv, ivsize); -+ - /* - print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1, - key, key_len, 1); -@@ -181,23 +263,30 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst, - print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1, - pad, zero_padding, 1); - */ -- ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in, -+ ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in, - src1_len + src2_len + zero_padding); -- crypto_free_blkcipher(tfm); -- if (ret < 0) -+ if (ret < 0) { - pr_err("ceph_aes_crypt2 failed %d\n", ret); -+ goto out_sg; -+ } - /* - print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1, - dst, *dst_len, 1); - */ -- return 0; -+ -+out_sg: -+ teardown_sgtable(&sg_out); -+out_tfm: -+ crypto_free_blkcipher(tfm); -+ return ret; - } - - static int ceph_aes_decrypt(const void *key, int key_len, - void *dst, size_t *dst_len, - const void *src, size_t src_len) - { -- struct scatterlist sg_in[1], sg_out[2]; -+ struct sg_table sg_in; -+ struct scatterlist sg_out[2], prealloc_sg; - struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher(); - struct blkcipher_desc desc = { .tfm = tfm }; - char pad[16]; -@@ -209,16 +298,16 @@ static int ceph_aes_decrypt(const void *key, int key_len, - if (IS_ERR(tfm)) - return PTR_ERR(tfm); - -- crypto_blkcipher_setkey((void *)tfm, key, key_len); -- sg_init_table(sg_in, 1); - sg_init_table(sg_out, 2); -- sg_set_buf(sg_in, src, src_len); - sg_set_buf(&sg_out[0], dst, *dst_len); - sg_set_buf(&sg_out[1], pad, sizeof(pad)); -+ ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len); -+ if (ret) -+ goto out_tfm; - -+ crypto_blkcipher_setkey((void *)tfm, key, key_len); - iv = crypto_blkcipher_crt(tfm)->iv; - ivsize = crypto_blkcipher_ivsize(tfm); -- - memcpy(iv, aes_iv, ivsize); - - /* -@@ -227,12 +316,10 @@ static int ceph_aes_decrypt(const void *key, int key_len, - print_hex_dump(KERN_ERR, "dec in: ", DUMP_PREFIX_NONE, 16, 1, - src, src_len, 1); - */ -- -- ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len); -- crypto_free_blkcipher(tfm); -+ ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len); - if (ret < 0) { - pr_err("ceph_aes_decrypt failed %d\n", ret); -- return ret; -+ goto out_sg; - } - - if (src_len <= *dst_len) -@@ -250,7 +337,12 @@ static int ceph_aes_decrypt(const void *key, int key_len, - print_hex_dump(KERN_ERR, "dec out: ", DUMP_PREFIX_NONE, 16, 1, - dst, *dst_len, 1); - */ -- return 0; -+ -+out_sg: -+ teardown_sgtable(&sg_in); -+out_tfm: -+ crypto_free_blkcipher(tfm); -+ return ret; - } - - static int ceph_aes_decrypt2(const void *key, int key_len, -@@ -258,7 +350,8 @@ static int ceph_aes_decrypt2(const void *key, int key_len, - void *dst2, size_t *dst2_len, - const void *src, size_t src_len) - { -- struct scatterlist sg_in[1], sg_out[3]; -+ struct sg_table sg_in; -+ struct scatterlist sg_out[3], prealloc_sg; - struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher(); - struct blkcipher_desc desc = { .tfm = tfm }; - char pad[16]; -@@ -270,17 +363,17 @@ static int ceph_aes_decrypt2(const void *key, int key_len, - if (IS_ERR(tfm)) - return PTR_ERR(tfm); - -- sg_init_table(sg_in, 1); -- sg_set_buf(sg_in, src, src_len); - sg_init_table(sg_out, 3); - sg_set_buf(&sg_out[0], dst1, *dst1_len); - sg_set_buf(&sg_out[1], dst2, *dst2_len); - sg_set_buf(&sg_out[2], pad, sizeof(pad)); -+ ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len); -+ if (ret) -+ goto out_tfm; - - crypto_blkcipher_setkey((void *)tfm, key, key_len); - iv = crypto_blkcipher_crt(tfm)->iv; - ivsize = crypto_blkcipher_ivsize(tfm); -- - memcpy(iv, aes_iv, ivsize); - - /* -@@ -289,12 +382,10 @@ static int ceph_aes_decrypt2(const void *key, int key_len, - print_hex_dump(KERN_ERR, "dec in: ", DUMP_PREFIX_NONE, 16, 1, - src, src_len, 1); - */ -- -- ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len); -- crypto_free_blkcipher(tfm); -+ ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len); - if (ret < 0) { - pr_err("ceph_aes_decrypt failed %d\n", ret); -- return ret; -+ goto out_sg; - } - - if (src_len <= *dst1_len) -@@ -324,7 +415,11 @@ static int ceph_aes_decrypt2(const void *key, int key_len, - dst2, *dst2_len, 1); - */ - -- return 0; -+out_sg: -+ teardown_sgtable(&sg_in); -+out_tfm: -+ crypto_free_blkcipher(tfm); -+ return ret; - } - - diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c index 2e87eec..6301eb0 100644 --- a/net/ceph/messenger.c @@ -102946,7 +102509,7 @@ index 7b32652..0bc348b 100644 table = kmemdup(ipv6_icmp_table_template, sizeof(ipv6_icmp_table_template), diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index cb57aa8..01c248e 100644 +index b27f6d3..1a2977b 100644 --- a/net/ipv6/ip6_gre.c +++ b/net/ipv6/ip6_gre.c @@ -71,7 +71,7 @@ struct ip6gre_net { @@ -102958,7 +102521,7 @@ index cb57aa8..01c248e 100644 static int ip6gre_tunnel_init(struct net_device *dev); static void ip6gre_tunnel_setup(struct net_device *dev); static void ip6gre_tunnel_link(struct ip6gre_net *ign, struct ip6_tnl *t); -@@ -1291,7 +1291,7 @@ static void ip6gre_fb_tunnel_init(struct net_device *dev) +@@ -1290,7 +1290,7 @@ static void ip6gre_fb_tunnel_init(struct net_device *dev) } @@ -102967,7 +102530,7 @@ index cb57aa8..01c248e 100644 .handler = ip6gre_rcv, .err_handler = ip6gre_err, .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL, -@@ -1643,7 +1643,7 @@ static const struct nla_policy ip6gre_policy[IFLA_GRE_MAX + 1] = { +@@ -1644,7 +1644,7 @@ static const struct nla_policy ip6gre_policy[IFLA_GRE_MAX + 1] = { [IFLA_GRE_FLAGS] = { .type = NLA_U32 }, }; @@ -102976,7 +102539,7 @@ index cb57aa8..01c248e 100644 .kind = "ip6gre", .maxtype = IFLA_GRE_MAX, .policy = ip6gre_policy, -@@ -1657,7 +1657,7 @@ static struct rtnl_link_ops ip6gre_link_ops __read_mostly = { +@@ -1658,7 +1658,7 @@ static struct rtnl_link_ops ip6gre_link_ops __read_mostly = { .fill_info = ip6gre_fill_info, }; @@ -102998,7 +102561,7 @@ index b2f0915..066db10 100644 __skb_pull(skb, len); } diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 9120339..cfdd84f 100644 +index 657639d..8b609c5 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -86,7 +86,7 @@ static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2) @@ -103010,7 +102573,7 @@ index 9120339..cfdd84f 100644 static int ip6_tnl_net_id __read_mostly; struct ip6_tnl_net { -@@ -1715,7 +1715,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = { +@@ -1707,7 +1707,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = { [IFLA_IPTUN_PROTO] = { .type = NLA_U8 }, }; @@ -103020,7 +102583,7 @@ index 9120339..cfdd84f 100644 .maxtype = IFLA_IPTUN_MAX, .policy = ip6_tnl_policy, diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c -index 2d19272..3a46322 100644 +index 9a5339f..8fc3c37 100644 --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -62,7 +62,7 @@ static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2) @@ -103032,7 +102595,7 @@ index 2d19272..3a46322 100644 static int vti6_net_id __read_mostly; struct vti6_net { -@@ -901,7 +901,7 @@ static const struct nla_policy vti6_policy[IFLA_VTI_MAX + 1] = { +@@ -892,7 +892,7 @@ static const struct nla_policy vti6_policy[IFLA_VTI_MAX + 1] = { [IFLA_VTI_OKEY] = { .type = NLA_U32 }, }; @@ -103349,7 +102912,7 @@ index 7cc1102..7785931 100644 table = kmemdup(ipv6_route_table_template, sizeof(ipv6_route_table_template), diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c -index b12b11b..13856f9 100644 +index 317b6db..9dbd284 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c @@ -74,7 +74,7 @@ static void ipip6_tunnel_setup(struct net_device *dev); @@ -103361,7 +102924,7 @@ index b12b11b..13856f9 100644 static int sit_net_id __read_mostly; struct sit_net { -@@ -484,11 +484,11 @@ static void ipip6_tunnel_uninit(struct net_device *dev) +@@ -483,11 +483,11 @@ static void ipip6_tunnel_uninit(struct net_device *dev) */ static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb) { @@ -103375,7 +102938,7 @@ index b12b11b..13856f9 100644 return 1; skb2 = skb_clone(skb, GFP_ATOMIC); -@@ -497,7 +497,7 @@ static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb) +@@ -496,7 +496,7 @@ static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb) return 1; skb_dst_drop(skb2); @@ -103384,7 +102947,7 @@ index b12b11b..13856f9 100644 skb_reset_network_header(skb2); rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, 0); -@@ -1683,7 +1683,7 @@ static void ipip6_dellink(struct net_device *dev, struct list_head *head) +@@ -1680,7 +1680,7 @@ static void ipip6_dellink(struct net_device *dev, struct list_head *head) unregister_netdevice_queue(dev, head); } @@ -103800,7 +103363,7 @@ index 453e974..b3a43a5 100644 if (local->use_chanctx) *chandef = local->monitor_chandef; diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h -index b127902..9dc4947 100644 +index bf7a1bb..1619d8e 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -28,6 +28,7 @@ @@ -103821,7 +103384,7 @@ index b127902..9dc4947 100644 /* number of interfaces with corresponding FIF_ flags */ int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll, diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c -index 8f7fabc..e400523 100644 +index 06f5de4..f2e0437 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -529,7 +529,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up) @@ -103860,7 +103423,7 @@ index 8f7fabc..e400523 100644 drv_stop(local); err_del_bss: sdata->bss = NULL; -@@ -874,7 +874,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, +@@ -876,7 +876,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, } if (going_down) @@ -103869,7 +103432,7 @@ index 8f7fabc..e400523 100644 switch (sdata->vif.type) { case NL80211_IFTYPE_AP_VLAN: -@@ -933,7 +933,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, +@@ -935,7 +935,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, } spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); @@ -103878,16 +103441,16 @@ index 8f7fabc..e400523 100644 ieee80211_clear_tx_pending(local); /* -@@ -973,7 +973,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, - - ieee80211_recalc_ps(local, -1); +@@ -978,7 +978,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, + if (cancel_scan) + flush_delayed_work(&local->scan_work); - if (local->open_count == 0) { + if (local_read(&local->open_count) == 0) { ieee80211_stop_device(local); /* no reconfiguring after stop! */ -@@ -984,7 +984,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, +@@ -989,7 +989,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, ieee80211_configure_filter(local); ieee80211_hw_config(local, hw_reconf_flags); @@ -104022,7 +103585,7 @@ index bffdad7..f9317d1 100644 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c -index de770ec..3fc49d2 100644 +index cf99377..c09b5b7 100644 --- a/net/netfilter/ipset/ip_set_core.c +++ b/net/netfilter/ipset/ip_set_core.c @@ -1922,7 +1922,7 @@ done: @@ -104418,10 +103981,10 @@ index c68e5e0..8d52d50 100644 type = __nf_tables_chain_type_lookup(afi->family, nla); if (type != NULL) diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c -index a155d19..726b0f2 100644 +index 6ff12a1..d1815b6 100644 --- a/net/netfilter/nfnetlink_log.c +++ b/net/netfilter/nfnetlink_log.c -@@ -82,7 +82,7 @@ static int nfnl_log_net_id __read_mostly; +@@ -83,7 +83,7 @@ static int nfnl_log_net_id __read_mostly; struct nfnl_log_net { spinlock_t instances_lock; struct hlist_head instance_table[INSTANCE_BUCKETS]; @@ -104430,7 +103993,7 @@ index a155d19..726b0f2 100644 }; static struct nfnl_log_net *nfnl_log_pernet(struct net *net) -@@ -564,7 +564,7 @@ __build_packet_message(struct nfnl_log_net *log, +@@ -566,7 +566,7 @@ __build_packet_message(struct nfnl_log_net *log, /* global sequence number */ if ((inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) && nla_put_be32(inst->skb, NFULA_SEQ_GLOBAL, @@ -104440,7 +104003,7 @@ index a155d19..726b0f2 100644 if (data_len) { diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c -index 82cb823..5685dd5 100644 +index ad97961..a312654 100644 --- a/net/netfilter/nft_compat.c +++ b/net/netfilter/nft_compat.c @@ -216,7 +216,7 @@ target_dump_info(struct sk_buff *skb, const struct xt_target *t, const void *in) @@ -105213,87 +104776,6 @@ index f226709..0e735a8 100644 _proto("Tx RESPONSE %%%u", ntohl(hdr->serial)); ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len); -diff --git a/net/sctp/associola.c b/net/sctp/associola.c -index 5d97d8f..d477d47 100644 ---- a/net/sctp/associola.c -+++ b/net/sctp/associola.c -@@ -1627,6 +1627,8 @@ struct sctp_chunk *sctp_assoc_lookup_asconf_ack( - * ack chunk whose serial number matches that of the request. - */ - list_for_each_entry(ack, &asoc->asconf_ack_list, transmitted_list) { -+ if (sctp_chunk_pending(ack)) -+ continue; - if (ack->subh.addip_hdr->serial == serial) { - sctp_chunk_hold(ack); - return ack; -diff --git a/net/sctp/auth.c b/net/sctp/auth.c -index 0e85291..fb7976a 100644 ---- a/net/sctp/auth.c -+++ b/net/sctp/auth.c -@@ -862,8 +862,6 @@ int sctp_auth_set_key(struct sctp_endpoint *ep, - list_add(&cur_key->key_list, sh_keys); - - cur_key->key = key; -- sctp_auth_key_hold(key); -- - return 0; - nomem: - if (!replace) -diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c -index 4de12af..7e8a16c 100644 ---- a/net/sctp/inqueue.c -+++ b/net/sctp/inqueue.c -@@ -140,18 +140,9 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue) - } else { - /* Nothing to do. Next chunk in the packet, please. */ - ch = (sctp_chunkhdr_t *) chunk->chunk_end; -- - /* Force chunk->skb->data to chunk->chunk_end. */ -- skb_pull(chunk->skb, -- chunk->chunk_end - chunk->skb->data); -- -- /* Verify that we have at least chunk headers -- * worth of buffer left. -- */ -- if (skb_headlen(chunk->skb) < sizeof(sctp_chunkhdr_t)) { -- sctp_chunk_free(chunk); -- chunk = queue->in_progress = NULL; -- } -+ skb_pull(chunk->skb, chunk->chunk_end - chunk->skb->data); -+ /* We are guaranteed to pull a SCTP header. */ - } - } - -@@ -187,24 +178,14 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue) - skb_pull(chunk->skb, sizeof(sctp_chunkhdr_t)); - chunk->subh.v = NULL; /* Subheader is no longer valid. */ - -- if (chunk->chunk_end < skb_tail_pointer(chunk->skb)) { -+ if (chunk->chunk_end + sizeof(sctp_chunkhdr_t) < -+ skb_tail_pointer(chunk->skb)) { - /* This is not a singleton */ - chunk->singleton = 0; - } else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) { -- /* RFC 2960, Section 6.10 Bundling -- * -- * Partial chunks MUST NOT be placed in an SCTP packet. -- * If the receiver detects a partial chunk, it MUST drop -- * the chunk. -- * -- * Since the end of the chunk is past the end of our buffer -- * (which contains the whole packet, we can freely discard -- * the whole packet. -- */ -- sctp_chunk_free(chunk); -- chunk = queue->in_progress = NULL; -- -- return NULL; -+ /* Discard inside state machine. */ -+ chunk->pdiscard = 1; -+ chunk->chunk_end = skb_tail_pointer(chunk->skb); - } else { - /* We are at the end of the packet, so mark the chunk - * in case we need to send a SACK. diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c index 2b1738e..a9d0fc9 100644 --- a/net/sctp/ipv6.c @@ -105368,182 +104850,6 @@ index a62a215..0976540 100644 } static int sctp_v4_protosw_init(void) -diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c -index fee5552..43abb64 100644 ---- a/net/sctp/sm_make_chunk.c -+++ b/net/sctp/sm_make_chunk.c -@@ -2609,6 +2609,9 @@ do_addr_param: - addr_param = param.v + sizeof(sctp_addip_param_t); - - af = sctp_get_af_specific(param_type2af(param.p->type)); -+ if (af == NULL) -+ break; -+ - af->from_addr_param(&addr, addr_param, - htons(asoc->peer.port), 0); - -@@ -3110,50 +3113,63 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc, - return SCTP_ERROR_NO_ERROR; - } - --/* Verify the ASCONF packet before we process it. */ --int sctp_verify_asconf(const struct sctp_association *asoc, -- struct sctp_paramhdr *param_hdr, void *chunk_end, -- struct sctp_paramhdr **errp) { -- sctp_addip_param_t *asconf_param; -+/* Verify the ASCONF packet before we process it. */ -+bool sctp_verify_asconf(const struct sctp_association *asoc, -+ struct sctp_chunk *chunk, bool addr_param_needed, -+ struct sctp_paramhdr **errp) -+{ -+ sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) chunk->chunk_hdr; - union sctp_params param; -- int length, plen; -+ bool addr_param_seen = false; -+ -+ sctp_walk_params(param, addip, addip_hdr.params) { -+ size_t length = ntohs(param.p->length); - -- param.v = (sctp_paramhdr_t *) param_hdr; -- while (param.v <= chunk_end - sizeof(sctp_paramhdr_t)) { -- length = ntohs(param.p->length); - *errp = param.p; -- -- if (param.v > chunk_end - length || -- length < sizeof(sctp_paramhdr_t)) -- return 0; -- - switch (param.p->type) { -+ case SCTP_PARAM_ERR_CAUSE: -+ break; -+ case SCTP_PARAM_IPV4_ADDRESS: -+ if (length != sizeof(sctp_ipv4addr_param_t)) -+ return false; -+ addr_param_seen = true; -+ break; -+ case SCTP_PARAM_IPV6_ADDRESS: -+ if (length != sizeof(sctp_ipv6addr_param_t)) -+ return false; -+ addr_param_seen = true; -+ break; - case SCTP_PARAM_ADD_IP: - case SCTP_PARAM_DEL_IP: - case SCTP_PARAM_SET_PRIMARY: -- asconf_param = (sctp_addip_param_t *)param.v; -- plen = ntohs(asconf_param->param_hdr.length); -- if (plen < sizeof(sctp_addip_param_t) + -- sizeof(sctp_paramhdr_t)) -- return 0; -+ /* In ASCONF chunks, these need to be first. */ -+ if (addr_param_needed && !addr_param_seen) -+ return false; -+ length = ntohs(param.addip->param_hdr.length); -+ if (length < sizeof(sctp_addip_param_t) + -+ sizeof(sctp_paramhdr_t)) -+ return false; - break; - case SCTP_PARAM_SUCCESS_REPORT: - case SCTP_PARAM_ADAPTATION_LAYER_IND: - if (length != sizeof(sctp_addip_param_t)) -- return 0; -- -+ return false; - break; - default: -- break; -+ /* This is unkown to us, reject! */ -+ return false; - } -- -- param.v += WORD_ROUND(length); - } - -- if (param.v != chunk_end) -- return 0; -+ /* Remaining sanity checks. */ -+ if (addr_param_needed && !addr_param_seen) -+ return false; -+ if (!addr_param_needed && addr_param_seen) -+ return false; -+ if (param.v != chunk->chunk_end) -+ return false; - -- return 1; -+ return true; - } - - /* Process an incoming ASCONF chunk with the next expected serial no. and -@@ -3162,16 +3178,17 @@ int sctp_verify_asconf(const struct sctp_association *asoc, - struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, - struct sctp_chunk *asconf) - { -+ sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) asconf->chunk_hdr; -+ bool all_param_pass = true; -+ union sctp_params param; - sctp_addiphdr_t *hdr; - union sctp_addr_param *addr_param; - sctp_addip_param_t *asconf_param; - struct sctp_chunk *asconf_ack; -- - __be16 err_code; - int length = 0; - int chunk_len; - __u32 serial; -- int all_param_pass = 1; - - chunk_len = ntohs(asconf->chunk_hdr->length) - sizeof(sctp_chunkhdr_t); - hdr = (sctp_addiphdr_t *)asconf->skb->data; -@@ -3199,9 +3216,14 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, - goto done; - - /* Process the TLVs contained within the ASCONF chunk. */ -- while (chunk_len > 0) { -+ sctp_walk_params(param, addip, addip_hdr.params) { -+ /* Skip preceeding address parameters. */ -+ if (param.p->type == SCTP_PARAM_IPV4_ADDRESS || -+ param.p->type == SCTP_PARAM_IPV6_ADDRESS) -+ continue; -+ - err_code = sctp_process_asconf_param(asoc, asconf, -- asconf_param); -+ param.addip); - /* ADDIP 4.1 A7) - * If an error response is received for a TLV parameter, - * all TLVs with no response before the failed TLV are -@@ -3209,28 +3231,20 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, - * the failed response are considered unsuccessful unless - * a specific success indication is present for the parameter. - */ -- if (SCTP_ERROR_NO_ERROR != err_code) -- all_param_pass = 0; -- -+ if (err_code != SCTP_ERROR_NO_ERROR) -+ all_param_pass = false; - if (!all_param_pass) -- sctp_add_asconf_response(asconf_ack, -- asconf_param->crr_id, err_code, -- asconf_param); -+ sctp_add_asconf_response(asconf_ack, param.addip->crr_id, -+ err_code, param.addip); - - /* ADDIP 4.3 D11) When an endpoint receiving an ASCONF to add - * an IP address sends an 'Out of Resource' in its response, it - * MUST also fail any subsequent add or delete requests bundled - * in the ASCONF. - */ -- if (SCTP_ERROR_RSRC_LOW == err_code) -+ if (err_code == SCTP_ERROR_RSRC_LOW) - goto done; -- -- /* Move to the next ASCONF param. */ -- length = ntohs(asconf_param->param_hdr.length); -- asconf_param = (void *)asconf_param + length; -- chunk_len -= length; - } -- - done: - asoc->peer.addip_serial++; - diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c index fef2acd..c705c4f 100644 --- a/net/sctp/sm_sideeffect.c @@ -105557,61 +104863,6 @@ index fef2acd..c705c4f 100644 NULL, sctp_generate_t1_cookie_event, sctp_generate_t1_init_event, -diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c -index 7194fe85..3e287a3 100644 ---- a/net/sctp/sm_statefuns.c -+++ b/net/sctp/sm_statefuns.c -@@ -170,6 +170,9 @@ sctp_chunk_length_valid(struct sctp_chunk *chunk, - { - __u16 chunk_length = ntohs(chunk->chunk_hdr->length); - -+ /* Previously already marked? */ -+ if (unlikely(chunk->pdiscard)) -+ return 0; - if (unlikely(chunk_length < required_length)) - return 0; - -@@ -3591,9 +3594,7 @@ sctp_disposition_t sctp_sf_do_asconf(struct net *net, - struct sctp_chunk *asconf_ack = NULL; - struct sctp_paramhdr *err_param = NULL; - sctp_addiphdr_t *hdr; -- union sctp_addr_param *addr_param; - __u32 serial; -- int length; - - if (!sctp_vtag_verify(chunk, asoc)) { - sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG, -@@ -3618,17 +3619,8 @@ sctp_disposition_t sctp_sf_do_asconf(struct net *net, - hdr = (sctp_addiphdr_t *)chunk->skb->data; - serial = ntohl(hdr->serial); - -- addr_param = (union sctp_addr_param *)hdr->params; -- length = ntohs(addr_param->p.length); -- if (length < sizeof(sctp_paramhdr_t)) -- return sctp_sf_violation_paramlen(net, ep, asoc, type, arg, -- (void *)addr_param, commands); -- - /* Verify the ASCONF chunk before processing it. */ -- if (!sctp_verify_asconf(asoc, -- (sctp_paramhdr_t *)((void *)addr_param + length), -- (void *)chunk->chunk_end, -- &err_param)) -+ if (!sctp_verify_asconf(asoc, chunk, true, &err_param)) - return sctp_sf_violation_paramlen(net, ep, asoc, type, arg, - (void *)err_param, commands); - -@@ -3745,10 +3737,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack(struct net *net, - rcvd_serial = ntohl(addip_hdr->serial); - - /* Verify the ASCONF-ACK chunk before processing it. */ -- if (!sctp_verify_asconf(asoc, -- (sctp_paramhdr_t *)addip_hdr->params, -- (void *)asconf_ack->chunk_end, -- &err_param)) -+ if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param)) - return sctp_sf_violation_paramlen(net, ep, asoc, type, arg, - (void *)err_param, commands); - diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 604a6ac..f87f0a3 100644 --- a/net/sctp/socket.c @@ -107346,7 +106597,7 @@ index 8fac3fd..32ff38d 100644 unsigned int secindex_strings; diff --git a/security/Kconfig b/security/Kconfig -index beb86b5..e66c504 100644 +index beb86b5..addbccd 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -4,6 +4,969 @@ @@ -107980,7 +107231,7 @@ index beb86b5..e66c504 100644 + +config PAX_KERNEXEC_MODULE_TEXT + int "Minimum amount of memory reserved for module code" -+ default "4" if (!GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_SERVER) ++ default "8" if (!GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_SERVER) + default "12" if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_DESKTOP) + depends on PAX_KERNEXEC && X86_32 + help @@ -117468,10 +116719,10 @@ index 0000000..4378111 +} diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data new file mode 100644 -index 0000000..d14887a6 +index 0000000..bbd5d8e --- /dev/null +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data -@@ -0,0 +1,6033 @@ +@@ -0,0 +1,6034 @@ +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL +storvsc_connect_to_vsp_22 storvsc_connect_to_vsp 2 22 NULL @@ -119201,6 +118452,7 @@ index 0000000..d14887a6 +ieee80211_if_read_element_ttl_18869 ieee80211_if_read_element_ttl 3 18869 NULL +xlog_find_verify_log_record_18870 xlog_find_verify_log_record 2 18870 NULL +ceph_setxattr_18913 ceph_setxattr 4 18913 NULL ++page_cache_tree_insert_18916 page_cache_tree_insert 0 18916 NULL +ieee80211_rx_mgmt_disassoc_18927 ieee80211_rx_mgmt_disassoc 3 18927 NULL +snapshot_write_next_18937 snapshot_write_next 0 18937 NULL +clean_journal_18955 clean_journal 0 18955 NULL diff --git a/3.14.24/4425_grsec_remove_EI_PAX.patch b/3.14.25/4425_grsec_remove_EI_PAX.patch index fc51f79..fc51f79 100644 --- a/3.14.24/4425_grsec_remove_EI_PAX.patch +++ b/3.14.25/4425_grsec_remove_EI_PAX.patch diff --git a/3.14.24/4427_force_XATTR_PAX_tmpfs.patch b/3.14.25/4427_force_XATTR_PAX_tmpfs.patch index dcc7fb5..dcc7fb5 100644 --- a/3.14.24/4427_force_XATTR_PAX_tmpfs.patch +++ b/3.14.25/4427_force_XATTR_PAX_tmpfs.patch diff --git a/3.14.24/4430_grsec-remove-localversion-grsec.patch b/3.14.25/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/3.14.24/4430_grsec-remove-localversion-grsec.patch +++ b/3.14.25/4430_grsec-remove-localversion-grsec.patch diff --git a/3.14.24/4435_grsec-mute-warnings.patch b/3.14.25/4435_grsec-mute-warnings.patch index 392cefb..392cefb 100644 --- a/3.14.24/4435_grsec-mute-warnings.patch +++ b/3.14.25/4435_grsec-mute-warnings.patch diff --git a/3.14.24/4440_grsec-remove-protected-paths.patch b/3.14.25/4440_grsec-remove-protected-paths.patch index 741546d..741546d 100644 --- a/3.14.24/4440_grsec-remove-protected-paths.patch +++ b/3.14.25/4440_grsec-remove-protected-paths.patch diff --git a/3.14.24/4450_grsec-kconfig-default-gids.patch b/3.14.25/4450_grsec-kconfig-default-gids.patch index ff7afeb..ff7afeb 100644 --- a/3.14.24/4450_grsec-kconfig-default-gids.patch +++ b/3.14.25/4450_grsec-kconfig-default-gids.patch diff --git a/3.14.24/4465_selinux-avc_audit-log-curr_ip.patch b/3.14.25/4465_selinux-avc_audit-log-curr_ip.patch index f92c155..f92c155 100644 --- a/3.14.24/4465_selinux-avc_audit-log-curr_ip.patch +++ b/3.14.25/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/3.14.24/4470_disable-compat_vdso.patch b/3.14.25/4470_disable-compat_vdso.patch index d5eed75..d5eed75 100644 --- a/3.14.24/4470_disable-compat_vdso.patch +++ b/3.14.25/4470_disable-compat_vdso.patch diff --git a/3.14.24/4475_emutramp_default_on.patch b/3.14.25/4475_emutramp_default_on.patch index cf88fd9..cf88fd9 100644 --- a/3.14.24/4475_emutramp_default_on.patch +++ b/3.14.25/4475_emutramp_default_on.patch diff --git a/3.17.3/1002_linux-3.17.3.patch b/3.17.3/1002_linux-3.17.3.patch deleted file mode 100644 index b3f3caa..0000000 --- a/3.17.3/1002_linux-3.17.3.patch +++ /dev/null @@ -1,11840 +0,0 @@ -diff --git a/Makefile b/Makefile -index 390afde..57a45b1 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 17 --SUBLEVEL = 2 -+SUBLEVEL = 3 - EXTRAVERSION = - NAME = Shuffling Zombie Juror - -diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts -index 4f31b2e..398064c 100644 ---- a/arch/arc/boot/dts/nsimosci.dts -+++ b/arch/arc/boot/dts/nsimosci.dts -@@ -20,7 +20,7 @@ - /* this is for console on PGU */ - /* bootargs = "console=tty0 consoleblank=0"; */ - /* this is for console on serial */ -- bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=ttyS0,115200n8 consoleblank=0 debug"; -+ bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug"; - }; - - aliases { -diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h -index 372466b..a9cbabe 100644 ---- a/arch/arc/include/asm/arcregs.h -+++ b/arch/arc/include/asm/arcregs.h -@@ -191,14 +191,6 @@ - #define PAGES_TO_KB(n_pages) ((n_pages) << (PAGE_SHIFT - 10)) - #define PAGES_TO_MB(n_pages) (PAGES_TO_KB(n_pages) >> 10) - --#ifdef CONFIG_ARC_FPU_SAVE_RESTORE --/* These DPFP regs need to be saved/restored across ctx-sw */ --struct arc_fpu { -- struct { -- unsigned int l, h; -- } aux_dpfp[2]; --}; --#endif - - /* - *************************************************************** -diff --git a/arch/arc/include/asm/kgdb.h b/arch/arc/include/asm/kgdb.h -index b65fca7..fea9316 100644 ---- a/arch/arc/include/asm/kgdb.h -+++ b/arch/arc/include/asm/kgdb.h -@@ -19,7 +19,7 @@ - * register API yet */ - #undef DBG_MAX_REG_NUM - --#define GDB_MAX_REGS 39 -+#define GDB_MAX_REGS 87 - - #define BREAK_INSTR_SIZE 2 - #define CACHE_FLUSH_IS_SAFE 1 -@@ -33,23 +33,27 @@ static inline void arch_kgdb_breakpoint(void) - - extern void kgdb_trap(struct pt_regs *regs); - --enum arc700_linux_regnums { -+/* This is the numbering of registers according to the GDB. See GDB's -+ * arc-tdep.h for details. -+ * -+ * Registers are ordered for GDB 7.5. It is incompatible with GDB 6.8. */ -+enum arc_linux_regnums { - _R0 = 0, - _R1, _R2, _R3, _R4, _R5, _R6, _R7, _R8, _R9, _R10, _R11, _R12, _R13, - _R14, _R15, _R16, _R17, _R18, _R19, _R20, _R21, _R22, _R23, _R24, - _R25, _R26, -- _BTA = 27, -- _LP_START = 28, -- _LP_END = 29, -- _LP_COUNT = 30, -- _STATUS32 = 31, -- _BLINK = 32, -- _FP = 33, -- __SP = 34, -- _EFA = 35, -- _RET = 36, -- _ORIG_R8 = 37, -- _STOP_PC = 38 -+ _FP = 27, -+ __SP = 28, -+ _R30 = 30, -+ _BLINK = 31, -+ _LP_COUNT = 60, -+ _STOP_PC = 64, -+ _RET = 64, -+ _LP_START = 65, -+ _LP_END = 66, -+ _STATUS32 = 67, -+ _ECR = 76, -+ _BTA = 82, - }; - - #else -diff --git a/arch/arc/include/asm/processor.h b/arch/arc/include/asm/processor.h -index 82588f3..38175c0 100644 ---- a/arch/arc/include/asm/processor.h -+++ b/arch/arc/include/asm/processor.h -@@ -20,6 +20,15 @@ - - #include <asm/ptrace.h> - -+#ifdef CONFIG_ARC_FPU_SAVE_RESTORE -+/* These DPFP regs need to be saved/restored across ctx-sw */ -+struct arc_fpu { -+ struct { -+ unsigned int l, h; -+ } aux_dpfp[2]; -+}; -+#endif -+ - /* Arch specific stuff which needs to be saved per task. - * However these items are not so important so as to earn a place in - * struct thread_info -diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug -index b11ad54..2f78e54 100644 ---- a/arch/arm/Kconfig.debug -+++ b/arch/arm/Kconfig.debug -@@ -1142,7 +1142,7 @@ config DEBUG_UART_VIRT - default 0xf1c28000 if DEBUG_SUNXI_UART0 - default 0xf1c28400 if DEBUG_SUNXI_UART1 - default 0xf1f02800 if DEBUG_SUNXI_R_UART -- default 0xf2100000 if DEBUG_PXA_UART1 -+ default 0xf6200000 if DEBUG_PXA_UART1 - default 0xf4090000 if ARCH_LPC32XX - default 0xf4200000 if ARCH_GEMINI - default 0xf7000000 if DEBUG_S3C24XX_UART && (DEBUG_S3C_UART0 || \ -diff --git a/arch/arm/boot/dts/zynq-parallella.dts b/arch/arm/boot/dts/zynq-parallella.dts -index 41afd9d..229140b 100644 ---- a/arch/arm/boot/dts/zynq-parallella.dts -+++ b/arch/arm/boot/dts/zynq-parallella.dts -@@ -34,6 +34,10 @@ - }; - }; - -+&clkc { -+ fclk-enable = <0xf>; -+}; -+ - &gem0 { - status = "okay"; - phy-mode = "rgmii-id"; -diff --git a/arch/arm/mach-pxa/include/mach/addr-map.h b/arch/arm/mach-pxa/include/mach/addr-map.h -index bbf9df3..d28fe29 100644 ---- a/arch/arm/mach-pxa/include/mach/addr-map.h -+++ b/arch/arm/mach-pxa/include/mach/addr-map.h -@@ -39,6 +39,11 @@ - #define DMEMC_SIZE 0x00100000 - - /* -+ * Reserved space for low level debug virtual addresses within -+ * 0xf6200000..0xf6201000 -+ */ -+ -+/* - * Internal Memory Controller (PXA27x and later) - */ - #define IMEMC_PHYS 0x58000000 -diff --git a/arch/mips/include/asm/ftrace.h b/arch/mips/include/asm/ftrace.h -index 992aaba..b463f2a 100644 ---- a/arch/mips/include/asm/ftrace.h -+++ b/arch/mips/include/asm/ftrace.h -@@ -24,7 +24,7 @@ do { \ - asm volatile ( \ - "1: " load " %[tmp_dst], 0(%[tmp_src])\n" \ - " li %[tmp_err], 0\n" \ -- "2:\n" \ -+ "2: .insn\n" \ - \ - ".section .fixup, \"ax\"\n" \ - "3: li %[tmp_err], 1\n" \ -@@ -46,7 +46,7 @@ do { \ - asm volatile ( \ - "1: " store " %[tmp_src], 0(%[tmp_dst])\n"\ - " li %[tmp_err], 0\n" \ -- "2:\n" \ -+ "2: .insn\n" \ - \ - ".section .fixup, \"ax\"\n" \ - "3: li %[tmp_err], 1\n" \ -diff --git a/arch/mips/include/uapi/asm/ptrace.h b/arch/mips/include/uapi/asm/ptrace.h -index bbcfb8b..91a3d19 100644 ---- a/arch/mips/include/uapi/asm/ptrace.h -+++ b/arch/mips/include/uapi/asm/ptrace.h -@@ -9,6 +9,8 @@ - #ifndef _UAPI_ASM_PTRACE_H - #define _UAPI_ASM_PTRACE_H - -+#include <linux/types.h> -+ - /* 0 - 31 are integer registers, 32 - 63 are fp registers. */ - #define FPR_BASE 32 - #define PC 64 -diff --git a/arch/mips/loongson/lemote-2f/clock.c b/arch/mips/loongson/lemote-2f/clock.c -index a217061..462e34d 100644 ---- a/arch/mips/loongson/lemote-2f/clock.c -+++ b/arch/mips/loongson/lemote-2f/clock.c -@@ -91,6 +91,7 @@ EXPORT_SYMBOL(clk_put); - - int clk_set_rate(struct clk *clk, unsigned long rate) - { -+ unsigned int rate_khz = rate / 1000; - struct cpufreq_frequency_table *pos; - int ret = 0; - int regval; -@@ -107,9 +108,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate) - propagate_rate(clk); - - cpufreq_for_each_valid_entry(pos, loongson2_clockmod_table) -- if (rate == pos->frequency) -+ if (rate_khz == pos->frequency) - break; -- if (rate != pos->frequency) -+ if (rate_khz != pos->frequency) - return -ENOTSUPP; - - clk->rate = rate; -diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c -index 7a47277..51a0fde 100644 ---- a/arch/mips/math-emu/cp1emu.c -+++ b/arch/mips/math-emu/cp1emu.c -@@ -1023,7 +1023,7 @@ emul: - goto emul; - - case cop1x_op: -- if (cpu_has_mips_4_5 || cpu_has_mips64) -+ if (cpu_has_mips_4_5 || cpu_has_mips64 || cpu_has_mips32r2) - /* its one of ours */ - goto emul; - -@@ -1068,7 +1068,7 @@ emul: - break; - - case cop1x_op: -- if (!cpu_has_mips_4_5 && !cpu_has_mips64) -+ if (!cpu_has_mips_4_5 && !cpu_has_mips64 && !cpu_has_mips32r2) - return SIGILL; - - sig = fpux_emu(xcp, ctx, ir, fault_addr); -diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c -index a08dd53..b5f228e 100644 ---- a/arch/mips/mm/tlbex.c -+++ b/arch/mips/mm/tlbex.c -@@ -1062,6 +1062,7 @@ static void build_update_entries(u32 **p, unsigned int tmp, unsigned int ptep) - struct mips_huge_tlb_info { - int huge_pte; - int restore_scratch; -+ bool need_reload_pte; - }; - - static struct mips_huge_tlb_info -@@ -1076,6 +1077,7 @@ build_fast_tlb_refill_handler (u32 **p, struct uasm_label **l, - - rv.huge_pte = scratch; - rv.restore_scratch = 0; -+ rv.need_reload_pte = false; - - if (check_for_high_segbits) { - UASM_i_MFC0(p, tmp, C0_BADVADDR); -@@ -1264,6 +1266,7 @@ static void build_r4000_tlb_refill_handler(void) - } else { - htlb_info.huge_pte = K0; - htlb_info.restore_scratch = 0; -+ htlb_info.need_reload_pte = true; - vmalloc_mode = refill_noscratch; - /* - * create the plain linear handler -@@ -1300,7 +1303,8 @@ static void build_r4000_tlb_refill_handler(void) - } - #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT - uasm_l_tlb_huge_update(&l, p); -- UASM_i_LW(&p, K0, 0, K1); -+ if (htlb_info.need_reload_pte) -+ UASM_i_LW(&p, htlb_info.huge_pte, 0, K1); - build_huge_update_entries(&p, htlb_info.huge_pte, K1); - build_huge_tlb_write_entry(&p, &l, &r, K0, tlb_random, - htlb_info.restore_scratch); -diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S -index 5bbd1bc..0905c8d 100644 ---- a/arch/powerpc/kernel/entry_64.S -+++ b/arch/powerpc/kernel/entry_64.S -@@ -659,7 +659,13 @@ _GLOBAL(ret_from_except_lite) - 3: - #endif - bl save_nvgprs -+ /* -+ * Use a non volatile GPR to save and restore our thread_info flags -+ * across the call to restore_interrupts. -+ */ -+ mr r30,r4 - bl restore_interrupts -+ mr r4,r30 - addi r3,r1,STACK_FRAME_OVERHEAD - bl do_notify_resume - b ret_from_except -diff --git a/arch/powerpc/platforms/powernv/opal-lpc.c b/arch/powerpc/platforms/powernv/opal-lpc.c -index ad4b31d..e4169d6 100644 ---- a/arch/powerpc/platforms/powernv/opal-lpc.c -+++ b/arch/powerpc/platforms/powernv/opal-lpc.c -@@ -216,14 +216,54 @@ static ssize_t lpc_debug_read(struct file *filp, char __user *ubuf, - &data, len); - if (rc) - return -ENXIO; -+ -+ /* -+ * Now there is some trickery with the data returned by OPAL -+ * as it's the desired data right justified in a 32-bit BE -+ * word. -+ * -+ * This is a very bad interface and I'm to blame for it :-( -+ * -+ * So we can't just apply a 32-bit swap to what comes from OPAL, -+ * because user space expects the *bytes* to be in their proper -+ * respective positions (ie, LPC position). -+ * -+ * So what we really want to do here is to shift data right -+ * appropriately on a LE kernel. -+ * -+ * IE. If the LPC transaction has bytes B0, B1, B2 and B3 in that -+ * order, we have in memory written to by OPAL at the "data" -+ * pointer: -+ * -+ * Bytes: OPAL "data" LE "data" -+ * 32-bit: B0 B1 B2 B3 B0B1B2B3 B3B2B1B0 -+ * 16-bit: B0 B1 0000B0B1 B1B00000 -+ * 8-bit: B0 000000B0 B0000000 -+ * -+ * So a BE kernel will have the leftmost of the above in the MSB -+ * and rightmost in the LSB and can just then "cast" the u32 "data" -+ * down to the appropriate quantity and write it. -+ * -+ * However, an LE kernel can't. It doesn't need to swap because a -+ * load from data followed by a store to user are going to preserve -+ * the byte ordering which is the wire byte order which is what the -+ * user wants, but in order to "crop" to the right size, we need to -+ * shift right first. -+ */ - switch(len) { - case 4: - rc = __put_user((u32)data, (u32 __user *)ubuf); - break; - case 2: -+#ifdef __LITTLE_ENDIAN__ -+ data >>= 16; -+#endif - rc = __put_user((u16)data, (u16 __user *)ubuf); - break; - default: -+#ifdef __LITTLE_ENDIAN__ -+ data >>= 24; -+#endif - rc = __put_user((u8)data, (u8 __user *)ubuf); - break; - } -@@ -263,12 +303,31 @@ static ssize_t lpc_debug_write(struct file *filp, const char __user *ubuf, - else if (todo > 1 && (pos & 1) == 0) - len = 2; - } -+ -+ /* -+ * Similarly to the read case, we have some trickery here but -+ * it's different to handle. We need to pass the value to OPAL in -+ * a register whose layout depends on the access size. We want -+ * to reproduce the memory layout of the user, however we aren't -+ * doing a load from user and a store to another memory location -+ * which would achieve that. Here we pass the value to OPAL via -+ * a register which is expected to contain the "BE" interpretation -+ * of the byte sequence. IE: for a 32-bit access, byte 0 should be -+ * in the MSB. So here we *do* need to byteswap on LE. -+ * -+ * User bytes: LE "data" OPAL "data" -+ * 32-bit: B0 B1 B2 B3 B3B2B1B0 B0B1B2B3 -+ * 16-bit: B0 B1 0000B1B0 0000B0B1 -+ * 8-bit: B0 000000B0 000000B0 -+ */ - switch(len) { - case 4: - rc = __get_user(data, (u32 __user *)ubuf); -+ data = cpu_to_be32(data); - break; - case 2: - rc = __get_user(data, (u16 __user *)ubuf); -+ data = cpu_to_be16(data); - break; - default: - rc = __get_user(data, (u8 __user *)ubuf); -diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c -index a2450b8..92eb35e 100644 ---- a/arch/powerpc/platforms/pseries/dlpar.c -+++ b/arch/powerpc/platforms/pseries/dlpar.c -@@ -379,7 +379,7 @@ static int dlpar_online_cpu(struct device_node *dn) - BUG_ON(get_cpu_current_state(cpu) - != CPU_STATE_OFFLINE); - cpu_maps_update_done(); -- rc = cpu_up(cpu); -+ rc = device_online(get_cpu_device(cpu)); - if (rc) - goto out; - cpu_maps_update_begin(); -@@ -462,7 +462,7 @@ static int dlpar_offline_cpu(struct device_node *dn) - if (get_cpu_current_state(cpu) == CPU_STATE_ONLINE) { - set_preferred_offline_state(cpu, CPU_STATE_OFFLINE); - cpu_maps_update_done(); -- rc = cpu_down(cpu); -+ rc = device_offline(get_cpu_device(cpu)); - if (rc) - goto out; - cpu_maps_update_begin(); -diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c -index 355a16c..b93bed7 100644 ---- a/arch/s390/kernel/topology.c -+++ b/arch/s390/kernel/topology.c -@@ -464,15 +464,17 @@ static struct sched_domain_topology_level s390_topology[] = { - - static int __init topology_init(void) - { -- if (!MACHINE_HAS_TOPOLOGY) { -+ if (MACHINE_HAS_TOPOLOGY) -+ set_topology_timer(); -+ else - topology_update_polarization_simple(); -- goto out; -- } -- set_topology_timer(); --out: -- -- set_sched_topology(s390_topology); -- - return device_create_file(cpu_subsys.dev_root, &dev_attr_dispatching); - } - device_initcall(topology_init); -+ -+static int __init early_topology_init(void) -+{ -+ set_sched_topology(s390_topology); -+ return 0; -+} -+early_initcall(early_topology_init); -diff --git a/arch/sh/kernel/cpu/sh3/setup-sh770x.c b/arch/sh/kernel/cpu/sh3/setup-sh770x.c -index 9139d14..538c10d 100644 ---- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c -+++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c -@@ -118,7 +118,7 @@ static struct plat_sci_port scif0_platform_data = { - }; - - static struct resource scif0_resources[] = { -- DEFINE_RES_MEM(0xfffffe80, 0x100), -+ DEFINE_RES_MEM(0xfffffe80, 0x10), - DEFINE_RES_IRQ(evt2irq(0x4e0)), - }; - -@@ -143,7 +143,7 @@ static struct plat_sci_port scif1_platform_data = { - }; - - static struct resource scif1_resources[] = { -- DEFINE_RES_MEM(0xa4000150, 0x100), -+ DEFINE_RES_MEM(0xa4000150, 0x10), - DEFINE_RES_IRQ(evt2irq(0x900)), - }; - -@@ -169,7 +169,7 @@ static struct plat_sci_port scif2_platform_data = { - }; - - static struct resource scif2_resources[] = { -- DEFINE_RES_MEM(0xa4000140, 0x100), -+ DEFINE_RES_MEM(0xa4000140, 0x10), - DEFINE_RES_IRQ(evt2irq(0x880)), - }; - -diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c -index 3716e69..e8ab93c 100644 ---- a/arch/um/drivers/ubd_kern.c -+++ b/arch/um/drivers/ubd_kern.c -@@ -1277,7 +1277,7 @@ static void do_ubd_request(struct request_queue *q) - - while(1){ - struct ubd *dev = q->queuedata; -- if(dev->end_sg == 0){ -+ if(dev->request == NULL){ - struct request *req = blk_fetch_request(q); - if(req == NULL) - return; -@@ -1299,7 +1299,8 @@ static void do_ubd_request(struct request_queue *q) - return; - } - prepare_flush_request(req, io_req); -- submit_request(io_req, dev); -+ if (submit_request(io_req, dev) == false) -+ return; - } - - while(dev->start_sg < dev->end_sg){ -diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S -index 4299eb0..92a2e93 100644 ---- a/arch/x86/ia32/ia32entry.S -+++ b/arch/x86/ia32/ia32entry.S -@@ -151,6 +151,16 @@ ENTRY(ia32_sysenter_target) - 1: movl (%rbp),%ebp - _ASM_EXTABLE(1b,ia32_badarg) - ASM_CLAC -+ -+ /* -+ * Sysenter doesn't filter flags, so we need to clear NT -+ * ourselves. To save a few cycles, we can check whether -+ * NT was set instead of doing an unconditional popfq. -+ */ -+ testl $X86_EFLAGS_NT,EFLAGS-ARGOFFSET(%rsp) -+ jnz sysenter_fix_flags -+sysenter_flags_fixed: -+ - orl $TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET) - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET) - CFI_REMEMBER_STATE -@@ -184,6 +194,8 @@ sysexit_from_sys_call: - TRACE_IRQS_ON - ENABLE_INTERRUPTS_SYSEXIT32 - -+ CFI_RESTORE_STATE -+ - #ifdef CONFIG_AUDITSYSCALL - .macro auditsys_entry_common - movl %esi,%r9d /* 6th arg: 4th syscall arg */ -@@ -226,7 +238,6 @@ sysexit_from_sys_call: - .endm - - sysenter_auditsys: -- CFI_RESTORE_STATE - auditsys_entry_common - movl %ebp,%r9d /* reload 6th syscall arg */ - jmp sysenter_dispatch -@@ -235,6 +246,11 @@ sysexit_audit: - auditsys_exit sysexit_from_sys_call - #endif - -+sysenter_fix_flags: -+ pushq_cfi $(X86_EFLAGS_IF|X86_EFLAGS_FIXED) -+ popfq_cfi -+ jmp sysenter_flags_fixed -+ - sysenter_tracesys: - #ifdef CONFIG_AUDITSYSCALL - testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET) -diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h -index 1a055c8..ca3347a 100644 ---- a/arch/x86/include/asm/elf.h -+++ b/arch/x86/include/asm/elf.h -@@ -160,8 +160,9 @@ do { \ - #define elf_check_arch(x) \ - ((x)->e_machine == EM_X86_64) - --#define compat_elf_check_arch(x) \ -- (elf_check_arch_ia32(x) || (x)->e_machine == EM_X86_64) -+#define compat_elf_check_arch(x) \ -+ (elf_check_arch_ia32(x) || \ -+ (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine == EM_X86_64)) - - #if __USER32_DS != __USER_DS - # error "The following code assumes __USER32_DS == __USER_DS" -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 92d3486..0d47ae1 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -991,6 +991,20 @@ static inline void kvm_inject_gp(struct kvm_vcpu *vcpu, u32 error_code) - kvm_queue_exception_e(vcpu, GP_VECTOR, error_code); - } - -+static inline u64 get_canonical(u64 la) -+{ -+ return ((int64_t)la << 16) >> 16; -+} -+ -+static inline bool is_noncanonical_address(u64 la) -+{ -+#ifdef CONFIG_X86_64 -+ return get_canonical(la) != la; -+#else -+ return false; -+#endif -+} -+ - #define TSS_IOPB_BASE_OFFSET 0x66 - #define TSS_BASE_SIZE 0x68 - #define TSS_IOPB_SIZE (65536 / 8) -@@ -1049,7 +1063,7 @@ int kvm_cpu_get_interrupt(struct kvm_vcpu *v); - void kvm_vcpu_reset(struct kvm_vcpu *vcpu); - - void kvm_define_shared_msr(unsigned index, u32 msr); --void kvm_set_shared_msr(unsigned index, u64 val, u64 mask); -+int kvm_set_shared_msr(unsigned index, u64 val, u64 mask); - - bool kvm_is_linear_rip(struct kvm_vcpu *vcpu, unsigned long linear_rip); - -diff --git a/arch/x86/include/uapi/asm/vmx.h b/arch/x86/include/uapi/asm/vmx.h -index 0e79420..990a2fe 100644 ---- a/arch/x86/include/uapi/asm/vmx.h -+++ b/arch/x86/include/uapi/asm/vmx.h -@@ -67,6 +67,7 @@ - #define EXIT_REASON_EPT_MISCONFIG 49 - #define EXIT_REASON_INVEPT 50 - #define EXIT_REASON_PREEMPTION_TIMER 52 -+#define EXIT_REASON_INVVPID 53 - #define EXIT_REASON_WBINVD 54 - #define EXIT_REASON_XSETBV 55 - #define EXIT_REASON_APIC_WRITE 56 -@@ -114,6 +115,7 @@ - { EXIT_REASON_EOI_INDUCED, "EOI_INDUCED" }, \ - { EXIT_REASON_INVALID_STATE, "INVALID_STATE" }, \ - { EXIT_REASON_INVD, "INVD" }, \ -+ { EXIT_REASON_INVVPID, "INVVPID" }, \ - { EXIT_REASON_INVPCID, "INVPCID" } - - #endif /* _UAPIVMX_H */ -diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c -index b436fc7..a142e77 100644 ---- a/arch/x86/kernel/acpi/boot.c -+++ b/arch/x86/kernel/acpi/boot.c -@@ -397,7 +397,7 @@ static int mp_register_gsi(struct device *dev, u32 gsi, int trigger, - - /* Don't set up the ACPI SCI because it's already set up */ - if (acpi_gbl_FADT.sci_interrupt == gsi) -- return gsi; -+ return mp_map_gsi_to_irq(gsi, IOAPIC_MAP_ALLOC); - - trigger = trigger == ACPI_EDGE_SENSITIVE ? 0 : 1; - polarity = polarity == ACPI_ACTIVE_HIGH ? 0 : 1; -@@ -604,14 +604,18 @@ void __init acpi_pic_sci_set_trigger(unsigned int irq, u16 trigger) - - int acpi_gsi_to_irq(u32 gsi, unsigned int *irqp) - { -- int irq = mp_map_gsi_to_irq(gsi, IOAPIC_MAP_ALLOC | IOAPIC_MAP_CHECK); -+ int irq; - -- if (irq >= 0) { -+ if (acpi_irq_model == ACPI_IRQ_MODEL_PIC) { -+ *irqp = gsi; -+ } else { -+ irq = mp_map_gsi_to_irq(gsi, -+ IOAPIC_MAP_ALLOC | IOAPIC_MAP_CHECK); -+ if (irq < 0) -+ return -1; - *irqp = irq; -- return 0; - } -- -- return -1; -+ return 0; - } - EXPORT_SYMBOL_GPL(acpi_gsi_to_irq); - -diff --git a/arch/x86/kernel/apb_timer.c b/arch/x86/kernel/apb_timer.c -index af5b08a..7c38324 100644 ---- a/arch/x86/kernel/apb_timer.c -+++ b/arch/x86/kernel/apb_timer.c -@@ -185,8 +185,6 @@ static void apbt_setup_irq(struct apbt_dev *adev) - - irq_modify_status(adev->irq, 0, IRQ_MOVE_PCNTXT); - irq_set_affinity(adev->irq, cpumask_of(adev->cpu)); -- /* APB timer irqs are set up as mp_irqs, timer is edge type */ -- __irq_set_handler(adev->irq, handle_edge_irq, 0, "edge"); - } - - /* Should be called with per cpu */ -diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c -index 6776027..24b5894 100644 ---- a/arch/x86/kernel/apic/apic.c -+++ b/arch/x86/kernel/apic/apic.c -@@ -1297,7 +1297,7 @@ void setup_local_APIC(void) - unsigned int value, queued; - int i, j, acked = 0; - unsigned long long tsc = 0, ntsc; -- long long max_loops = cpu_khz; -+ long long max_loops = cpu_khz ? cpu_khz : 1000000; - - if (cpu_has_tsc) - rdtscll(tsc); -@@ -1383,7 +1383,7 @@ void setup_local_APIC(void) - break; - } - if (queued) { -- if (cpu_has_tsc) { -+ if (cpu_has_tsc && cpu_khz) { - rdtscll(ntsc); - max_loops = (cpu_khz << 10) - (ntsc - tsc); - } else -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index e4ab2b4..3126558 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -1184,7 +1184,7 @@ void syscall_init(void) - /* Flags to clear on syscall */ - wrmsrl(MSR_SYSCALL_MASK, - X86_EFLAGS_TF|X86_EFLAGS_DF|X86_EFLAGS_IF| -- X86_EFLAGS_IOPL|X86_EFLAGS_AC); -+ X86_EFLAGS_IOPL|X86_EFLAGS_AC|X86_EFLAGS_NT); - } - - /* -diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c -index 50ce751..1ef4562 100644 ---- a/arch/x86/kernel/cpu/intel.c -+++ b/arch/x86/kernel/cpu/intel.c -@@ -397,6 +397,13 @@ static void init_intel(struct cpuinfo_x86 *c) - } - - l2 = init_intel_cacheinfo(c); -+ -+ /* Detect legacy cache sizes if init_intel_cacheinfo did not */ -+ if (l2 == 0) { -+ cpu_detect_cache_sizes(c); -+ l2 = c->x86_cache_size; -+ } -+ - if (c->cpuid_level > 9) { - unsigned eax = cpuid_eax(10); - /* Check for version and the number of counters */ -@@ -500,6 +507,13 @@ static unsigned int intel_size_cache(struct cpuinfo_x86 *c, unsigned int size) - */ - if ((c->x86 == 6) && (c->x86_model == 11) && (size == 0)) - size = 256; -+ -+ /* -+ * Intel Quark SoC X1000 contains a 4-way set associative -+ * 16K cache with a 16 byte cache line and 256 lines per tag -+ */ -+ if ((c->x86 == 5) && (c->x86_model == 9)) -+ size = 16; - return size; - } - #endif -@@ -701,7 +715,8 @@ static const struct cpu_dev intel_cpu_dev = { - [3] = "OverDrive PODP5V83", - [4] = "Pentium MMX", - [7] = "Mobile Pentium 75 - 200", -- [8] = "Mobile Pentium MMX" -+ [8] = "Mobile Pentium MMX", -+ [9] = "Quark SoC X1000", - } - }, - { .family = 6, .model_names = -diff --git a/arch/x86/kernel/iosf_mbi.c b/arch/x86/kernel/iosf_mbi.c -index 9030e83..c957e11 100644 ---- a/arch/x86/kernel/iosf_mbi.c -+++ b/arch/x86/kernel/iosf_mbi.c -@@ -26,6 +26,7 @@ - #include <asm/iosf_mbi.h> - - #define PCI_DEVICE_ID_BAYTRAIL 0x0F00 -+#define PCI_DEVICE_ID_BRASWELL 0x2280 - #define PCI_DEVICE_ID_QUARK_X1000 0x0958 - - static DEFINE_SPINLOCK(iosf_mbi_lock); -@@ -204,6 +205,7 @@ static int iosf_mbi_probe(struct pci_dev *pdev, - - static const struct pci_device_id iosf_mbi_pci_ids[] = { - { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_BAYTRAIL) }, -+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_BRASWELL) }, - { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_QUARK_X1000) }, - { 0, }, - }; -diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c -index 2851d63..ed37a76 100644 ---- a/arch/x86/kernel/signal.c -+++ b/arch/x86/kernel/signal.c -@@ -675,6 +675,11 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs) - * handler too. - */ - regs->flags &= ~(X86_EFLAGS_DF|X86_EFLAGS_RF|X86_EFLAGS_TF); -+ /* -+ * Ensure the signal handler starts with the new fpu state. -+ */ -+ if (used_math()) -+ drop_init_fpu(current); - } - signal_setup_done(failed, ksig, test_thread_flag(TIF_SINGLESTEP)); - } -diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c -index b6025f9..b7e50bb 100644 ---- a/arch/x86/kernel/tsc.c -+++ b/arch/x86/kernel/tsc.c -@@ -1166,14 +1166,17 @@ void __init tsc_init(void) - - x86_init.timers.tsc_pre_init(); - -- if (!cpu_has_tsc) -+ if (!cpu_has_tsc) { -+ setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER); - return; -+ } - - tsc_khz = x86_platform.calibrate_tsc(); - cpu_khz = tsc_khz; - - if (!tsc_khz) { - mark_tsc_unstable("could not calculate TSC khz"); -+ setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER); - return; - } - -diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c -index 940b142..4c540c4 100644 ---- a/arch/x86/kernel/xsave.c -+++ b/arch/x86/kernel/xsave.c -@@ -271,8 +271,6 @@ int save_xstate_sig(void __user *buf, void __user *buf_fx, int size) - if (use_fxsr() && save_xstate_epilog(buf_fx, ia32_fxstate)) - return -1; - -- drop_init_fpu(tsk); /* trigger finit */ -- - return 0; - } - -@@ -402,8 +400,11 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size) - set_used_math(); - } - -- if (use_eager_fpu()) -+ if (use_eager_fpu()) { -+ preempt_disable(); - math_state_restore(); -+ preempt_enable(); -+ } - - return err; - } else { -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 03954f7..77c77fe 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -504,11 +504,6 @@ static void rsp_increment(struct x86_emulate_ctxt *ctxt, int inc) - masked_increment(reg_rmw(ctxt, VCPU_REGS_RSP), stack_mask(ctxt), inc); - } - --static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel) --{ -- register_address_increment(ctxt, &ctxt->_eip, rel); --} -- - static u32 desc_limit_scaled(struct desc_struct *desc) - { - u32 limit = get_desc_limit(desc); -@@ -568,6 +563,40 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt) - return emulate_exception(ctxt, NM_VECTOR, 0, false); - } - -+static inline int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst, -+ int cs_l) -+{ -+ switch (ctxt->op_bytes) { -+ case 2: -+ ctxt->_eip = (u16)dst; -+ break; -+ case 4: -+ ctxt->_eip = (u32)dst; -+ break; -+#ifdef CONFIG_X86_64 -+ case 8: -+ if ((cs_l && is_noncanonical_address(dst)) || -+ (!cs_l && (dst >> 32) != 0)) -+ return emulate_gp(ctxt, 0); -+ ctxt->_eip = dst; -+ break; -+#endif -+ default: -+ WARN(1, "unsupported eip assignment size\n"); -+ } -+ return X86EMUL_CONTINUE; -+} -+ -+static inline int assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst) -+{ -+ return assign_eip_far(ctxt, dst, ctxt->mode == X86EMUL_MODE_PROT64); -+} -+ -+static inline int jmp_rel(struct x86_emulate_ctxt *ctxt, int rel) -+{ -+ return assign_eip_near(ctxt, ctxt->_eip + rel); -+} -+ - static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg) - { - u16 selector; -@@ -613,7 +642,8 @@ static bool insn_aligned(struct x86_emulate_ctxt *ctxt, unsigned size) - - static int __linearize(struct x86_emulate_ctxt *ctxt, - struct segmented_address addr, -- unsigned size, bool write, bool fetch, -+ unsigned *max_size, unsigned size, -+ bool write, bool fetch, - ulong *linear) - { - struct desc_struct desc; -@@ -624,10 +654,15 @@ static int __linearize(struct x86_emulate_ctxt *ctxt, - unsigned cpl; - - la = seg_base(ctxt, addr.seg) + addr.ea; -+ *max_size = 0; - switch (ctxt->mode) { - case X86EMUL_MODE_PROT64: - if (((signed long)la << 16) >> 16 != la) - return emulate_gp(ctxt, 0); -+ -+ *max_size = min_t(u64, ~0u, (1ull << 48) - la); -+ if (size > *max_size) -+ goto bad; - break; - default: - usable = ctxt->ops->get_segment(ctxt, &sel, &desc, NULL, -@@ -645,20 +680,25 @@ static int __linearize(struct x86_emulate_ctxt *ctxt, - if ((ctxt->mode == X86EMUL_MODE_REAL) && !fetch && - (ctxt->d & NoBigReal)) { - /* la is between zero and 0xffff */ -- if (la > 0xffff || (u32)(la + size - 1) > 0xffff) -+ if (la > 0xffff) - goto bad; -+ *max_size = 0x10000 - la; - } else if ((desc.type & 8) || !(desc.type & 4)) { - /* expand-up segment */ -- if (addr.ea > lim || (u32)(addr.ea + size - 1) > lim) -+ if (addr.ea > lim) - goto bad; -+ *max_size = min_t(u64, ~0u, (u64)lim + 1 - addr.ea); - } else { - /* expand-down segment */ -- if (addr.ea <= lim || (u32)(addr.ea + size - 1) <= lim) -+ if (addr.ea <= lim) - goto bad; - lim = desc.d ? 0xffffffff : 0xffff; -- if (addr.ea > lim || (u32)(addr.ea + size - 1) > lim) -+ if (addr.ea > lim) - goto bad; -+ *max_size = min_t(u64, ~0u, (u64)lim + 1 - addr.ea); - } -+ if (size > *max_size) -+ goto bad; - cpl = ctxt->ops->cpl(ctxt); - if (!(desc.type & 8)) { - /* data segment */ -@@ -693,7 +733,8 @@ static int linearize(struct x86_emulate_ctxt *ctxt, - unsigned size, bool write, - ulong *linear) - { -- return __linearize(ctxt, addr, size, write, false, linear); -+ unsigned max_size; -+ return __linearize(ctxt, addr, &max_size, size, write, false, linear); - } - - -@@ -718,17 +759,27 @@ static int segmented_read_std(struct x86_emulate_ctxt *ctxt, - static int __do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt, int op_size) - { - int rc; -- unsigned size; -+ unsigned size, max_size; - unsigned long linear; - int cur_size = ctxt->fetch.end - ctxt->fetch.data; - struct segmented_address addr = { .seg = VCPU_SREG_CS, - .ea = ctxt->eip + cur_size }; - -- size = 15UL ^ cur_size; -- rc = __linearize(ctxt, addr, size, false, true, &linear); -+ /* -+ * We do not know exactly how many bytes will be needed, and -+ * __linearize is expensive, so fetch as much as possible. We -+ * just have to avoid going beyond the 15 byte limit, the end -+ * of the segment, or the end of the page. -+ * -+ * __linearize is called with size 0 so that it does not do any -+ * boundary check itself. Instead, we use max_size to check -+ * against op_size. -+ */ -+ rc = __linearize(ctxt, addr, &max_size, 0, false, true, &linear); - if (unlikely(rc != X86EMUL_CONTINUE)) - return rc; - -+ size = min_t(unsigned, 15UL ^ cur_size, max_size); - size = min_t(unsigned, size, PAGE_SIZE - offset_in_page(linear)); - - /* -@@ -738,7 +789,8 @@ static int __do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt, int op_size) - * still, we must have hit the 15-byte boundary. - */ - if (unlikely(size < op_size)) -- return X86EMUL_UNHANDLEABLE; -+ return emulate_gp(ctxt, 0); -+ - rc = ctxt->ops->fetch(ctxt, linear, ctxt->fetch.end, - size, &ctxt->exception); - if (unlikely(rc != X86EMUL_CONTINUE)) -@@ -750,8 +802,10 @@ static int __do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt, int op_size) - static __always_inline int do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt, - unsigned size) - { -- if (unlikely(ctxt->fetch.end - ctxt->fetch.ptr < size)) -- return __do_insn_fetch_bytes(ctxt, size); -+ unsigned done_size = ctxt->fetch.end - ctxt->fetch.ptr; -+ -+ if (unlikely(done_size < size)) -+ return __do_insn_fetch_bytes(ctxt, size - done_size); - else - return X86EMUL_CONTINUE; - } -@@ -1415,7 +1469,9 @@ static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt, - - /* Does not support long mode */ - static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, -- u16 selector, int seg, u8 cpl, bool in_task_switch) -+ u16 selector, int seg, u8 cpl, -+ bool in_task_switch, -+ struct desc_struct *desc) - { - struct desc_struct seg_desc, old_desc; - u8 dpl, rpl; -@@ -1547,6 +1603,8 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, - } - load: - ctxt->ops->set_segment(ctxt, selector, &seg_desc, base3, seg); -+ if (desc) -+ *desc = seg_desc; - return X86EMUL_CONTINUE; - exception: - emulate_exception(ctxt, err_vec, err_code, true); -@@ -1557,7 +1615,7 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt, - u16 selector, int seg) - { - u8 cpl = ctxt->ops->cpl(ctxt); -- return __load_segment_descriptor(ctxt, selector, seg, cpl, false); -+ return __load_segment_descriptor(ctxt, selector, seg, cpl, false, NULL); - } - - static void write_register_operand(struct operand *op) -@@ -1951,17 +2009,31 @@ static int em_iret(struct x86_emulate_ctxt *ctxt) - static int em_jmp_far(struct x86_emulate_ctxt *ctxt) - { - int rc; -- unsigned short sel; -+ unsigned short sel, old_sel; -+ struct desc_struct old_desc, new_desc; -+ const struct x86_emulate_ops *ops = ctxt->ops; -+ u8 cpl = ctxt->ops->cpl(ctxt); -+ -+ /* Assignment of RIP may only fail in 64-bit mode */ -+ if (ctxt->mode == X86EMUL_MODE_PROT64) -+ ops->get_segment(ctxt, &old_sel, &old_desc, NULL, -+ VCPU_SREG_CS); - - memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2); - -- rc = load_segment_descriptor(ctxt, sel, VCPU_SREG_CS); -+ rc = __load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, cpl, false, -+ &new_desc); - if (rc != X86EMUL_CONTINUE) - return rc; - -- ctxt->_eip = 0; -- memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes); -- return X86EMUL_CONTINUE; -+ rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l); -+ if (rc != X86EMUL_CONTINUE) { -+ WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64); -+ /* assigning eip failed; restore the old cs */ -+ ops->set_segment(ctxt, old_sel, &old_desc, 0, VCPU_SREG_CS); -+ return rc; -+ } -+ return rc; - } - - static int em_grp45(struct x86_emulate_ctxt *ctxt) -@@ -1972,13 +2044,15 @@ static int em_grp45(struct x86_emulate_ctxt *ctxt) - case 2: /* call near abs */ { - long int old_eip; - old_eip = ctxt->_eip; -- ctxt->_eip = ctxt->src.val; -+ rc = assign_eip_near(ctxt, ctxt->src.val); -+ if (rc != X86EMUL_CONTINUE) -+ break; - ctxt->src.val = old_eip; - rc = em_push(ctxt); - break; - } - case 4: /* jmp abs */ -- ctxt->_eip = ctxt->src.val; -+ rc = assign_eip_near(ctxt, ctxt->src.val); - break; - case 5: /* jmp far */ - rc = em_jmp_far(ctxt); -@@ -2013,30 +2087,47 @@ static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt) - - static int em_ret(struct x86_emulate_ctxt *ctxt) - { -- ctxt->dst.type = OP_REG; -- ctxt->dst.addr.reg = &ctxt->_eip; -- ctxt->dst.bytes = ctxt->op_bytes; -- return em_pop(ctxt); -+ int rc; -+ unsigned long eip; -+ -+ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); -+ if (rc != X86EMUL_CONTINUE) -+ return rc; -+ -+ return assign_eip_near(ctxt, eip); - } - - static int em_ret_far(struct x86_emulate_ctxt *ctxt) - { - int rc; -- unsigned long cs; -+ unsigned long eip, cs; -+ u16 old_cs; - int cpl = ctxt->ops->cpl(ctxt); -+ struct desc_struct old_desc, new_desc; -+ const struct x86_emulate_ops *ops = ctxt->ops; - -- rc = emulate_pop(ctxt, &ctxt->_eip, ctxt->op_bytes); -+ if (ctxt->mode == X86EMUL_MODE_PROT64) -+ ops->get_segment(ctxt, &old_cs, &old_desc, NULL, -+ VCPU_SREG_CS); -+ -+ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); - if (rc != X86EMUL_CONTINUE) - return rc; -- if (ctxt->op_bytes == 4) -- ctxt->_eip = (u32)ctxt->_eip; - rc = emulate_pop(ctxt, &cs, ctxt->op_bytes); - if (rc != X86EMUL_CONTINUE) - return rc; - /* Outer-privilege level return is not implemented */ - if (ctxt->mode >= X86EMUL_MODE_PROT16 && (cs & 3) > cpl) - return X86EMUL_UNHANDLEABLE; -- rc = load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS); -+ rc = __load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, 0, false, -+ &new_desc); -+ if (rc != X86EMUL_CONTINUE) -+ return rc; -+ rc = assign_eip_far(ctxt, eip, new_desc.l); -+ if (rc != X86EMUL_CONTINUE) { -+ WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64); -+ ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS); -+ } - return rc; - } - -@@ -2297,7 +2388,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) - { - const struct x86_emulate_ops *ops = ctxt->ops; - struct desc_struct cs, ss; -- u64 msr_data; -+ u64 msr_data, rcx, rdx; - int usermode; - u16 cs_sel = 0, ss_sel = 0; - -@@ -2313,6 +2404,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) - else - usermode = X86EMUL_MODE_PROT32; - -+ rcx = reg_read(ctxt, VCPU_REGS_RCX); -+ rdx = reg_read(ctxt, VCPU_REGS_RDX); -+ - cs.dpl = 3; - ss.dpl = 3; - ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data); -@@ -2330,6 +2424,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) - ss_sel = cs_sel + 8; - cs.d = 0; - cs.l = 1; -+ if (is_noncanonical_address(rcx) || -+ is_noncanonical_address(rdx)) -+ return emulate_gp(ctxt, 0); - break; - } - cs_sel |= SELECTOR_RPL_MASK; -@@ -2338,8 +2435,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) - ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS); - ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS); - -- ctxt->_eip = reg_read(ctxt, VCPU_REGS_RDX); -- *reg_write(ctxt, VCPU_REGS_RSP) = reg_read(ctxt, VCPU_REGS_RCX); -+ ctxt->_eip = rdx; -+ *reg_write(ctxt, VCPU_REGS_RSP) = rcx; - - return X86EMUL_CONTINUE; - } -@@ -2457,19 +2554,24 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt, - * Now load segment descriptors. If fault happens at this stage - * it is handled in a context of new task - */ -- ret = __load_segment_descriptor(ctxt, tss->ldt, VCPU_SREG_LDTR, cpl, true); -+ ret = __load_segment_descriptor(ctxt, tss->ldt, VCPU_SREG_LDTR, cpl, -+ true, NULL); - if (ret != X86EMUL_CONTINUE) - return ret; -- ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl, true); -+ ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl, -+ true, NULL); - if (ret != X86EMUL_CONTINUE) - return ret; -- ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl, true); -+ ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl, -+ true, NULL); - if (ret != X86EMUL_CONTINUE) - return ret; -- ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl, true); -+ ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl, -+ true, NULL); - if (ret != X86EMUL_CONTINUE) - return ret; -- ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl, true); -+ ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl, -+ true, NULL); - if (ret != X86EMUL_CONTINUE) - return ret; - -@@ -2594,25 +2696,32 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt, - * Now load segment descriptors. If fault happenes at this stage - * it is handled in a context of new task - */ -- ret = __load_segment_descriptor(ctxt, tss->ldt_selector, VCPU_SREG_LDTR, cpl, true); -+ ret = __load_segment_descriptor(ctxt, tss->ldt_selector, VCPU_SREG_LDTR, -+ cpl, true, NULL); - if (ret != X86EMUL_CONTINUE) - return ret; -- ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl, true); -+ ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl, -+ true, NULL); - if (ret != X86EMUL_CONTINUE) - return ret; -- ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl, true); -+ ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl, -+ true, NULL); - if (ret != X86EMUL_CONTINUE) - return ret; -- ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl, true); -+ ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl, -+ true, NULL); - if (ret != X86EMUL_CONTINUE) - return ret; -- ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl, true); -+ ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl, -+ true, NULL); - if (ret != X86EMUL_CONTINUE) - return ret; -- ret = __load_segment_descriptor(ctxt, tss->fs, VCPU_SREG_FS, cpl, true); -+ ret = __load_segment_descriptor(ctxt, tss->fs, VCPU_SREG_FS, cpl, -+ true, NULL); - if (ret != X86EMUL_CONTINUE) - return ret; -- ret = __load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS, cpl, true); -+ ret = __load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS, cpl, -+ true, NULL); - if (ret != X86EMUL_CONTINUE) - return ret; - -@@ -2880,10 +2989,13 @@ static int em_aad(struct x86_emulate_ctxt *ctxt) - - static int em_call(struct x86_emulate_ctxt *ctxt) - { -+ int rc; - long rel = ctxt->src.val; - - ctxt->src.val = (unsigned long)ctxt->_eip; -- jmp_rel(ctxt, rel); -+ rc = jmp_rel(ctxt, rel); -+ if (rc != X86EMUL_CONTINUE) -+ return rc; - return em_push(ctxt); - } - -@@ -2892,34 +3004,50 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt) - u16 sel, old_cs; - ulong old_eip; - int rc; -+ struct desc_struct old_desc, new_desc; -+ const struct x86_emulate_ops *ops = ctxt->ops; -+ int cpl = ctxt->ops->cpl(ctxt); - -- old_cs = get_segment_selector(ctxt, VCPU_SREG_CS); - old_eip = ctxt->_eip; -+ ops->get_segment(ctxt, &old_cs, &old_desc, NULL, VCPU_SREG_CS); - - memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2); -- if (load_segment_descriptor(ctxt, sel, VCPU_SREG_CS)) -+ rc = __load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, cpl, false, -+ &new_desc); -+ if (rc != X86EMUL_CONTINUE) - return X86EMUL_CONTINUE; - -- ctxt->_eip = 0; -- memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes); -+ rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l); -+ if (rc != X86EMUL_CONTINUE) -+ goto fail; - - ctxt->src.val = old_cs; - rc = em_push(ctxt); - if (rc != X86EMUL_CONTINUE) -- return rc; -+ goto fail; - - ctxt->src.val = old_eip; -- return em_push(ctxt); -+ rc = em_push(ctxt); -+ /* If we failed, we tainted the memory, but the very least we should -+ restore cs */ -+ if (rc != X86EMUL_CONTINUE) -+ goto fail; -+ return rc; -+fail: -+ ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS); -+ return rc; -+ - } - - static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt) - { - int rc; -+ unsigned long eip; - -- ctxt->dst.type = OP_REG; -- ctxt->dst.addr.reg = &ctxt->_eip; -- ctxt->dst.bytes = ctxt->op_bytes; -- rc = emulate_pop(ctxt, &ctxt->dst.val, ctxt->op_bytes); -+ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); -+ if (rc != X86EMUL_CONTINUE) -+ return rc; -+ rc = assign_eip_near(ctxt, eip); - if (rc != X86EMUL_CONTINUE) - return rc; - rsp_increment(ctxt, ctxt->src.val); -@@ -3250,20 +3378,24 @@ static int em_lmsw(struct x86_emulate_ctxt *ctxt) - - static int em_loop(struct x86_emulate_ctxt *ctxt) - { -+ int rc = X86EMUL_CONTINUE; -+ - register_address_increment(ctxt, reg_rmw(ctxt, VCPU_REGS_RCX), -1); - if ((address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) != 0) && - (ctxt->b == 0xe2 || test_cc(ctxt->b ^ 0x5, ctxt->eflags))) -- jmp_rel(ctxt, ctxt->src.val); -+ rc = jmp_rel(ctxt, ctxt->src.val); - -- return X86EMUL_CONTINUE; -+ return rc; - } - - static int em_jcxz(struct x86_emulate_ctxt *ctxt) - { -+ int rc = X86EMUL_CONTINUE; -+ - if (address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) == 0) -- jmp_rel(ctxt, ctxt->src.val); -+ rc = jmp_rel(ctxt, ctxt->src.val); - -- return X86EMUL_CONTINUE; -+ return rc; - } - - static int em_in(struct x86_emulate_ctxt *ctxt) -@@ -3351,6 +3483,12 @@ static int em_bswap(struct x86_emulate_ctxt *ctxt) - return X86EMUL_CONTINUE; - } - -+static int em_clflush(struct x86_emulate_ctxt *ctxt) -+{ -+ /* emulating clflush regardless of cpuid */ -+ return X86EMUL_CONTINUE; -+} -+ - static bool valid_cr(int nr) - { - switch (nr) { -@@ -3683,6 +3821,16 @@ static const struct opcode group11[] = { - X7(D(Undefined)), - }; - -+static const struct gprefix pfx_0f_ae_7 = { -+ I(SrcMem | ByteOp, em_clflush), N, N, N, -+}; -+ -+static const struct group_dual group15 = { { -+ N, N, N, N, N, N, N, GP(0, &pfx_0f_ae_7), -+}, { -+ N, N, N, N, N, N, N, N, -+} }; -+ - static const struct gprefix pfx_0f_6f_0f_7f = { - I(Mmx, em_mov), I(Sse | Aligned, em_mov), N, I(Sse | Unaligned, em_mov), - }; -@@ -3887,10 +4035,11 @@ static const struct opcode twobyte_table[256] = { - N, I(ImplicitOps | EmulateOnUD, em_syscall), - II(ImplicitOps | Priv, em_clts, clts), N, - DI(ImplicitOps | Priv, invd), DI(ImplicitOps | Priv, wbinvd), N, N, -- N, D(ImplicitOps | ModRM), N, N, -+ N, D(ImplicitOps | ModRM | SrcMem | NoAccess), N, N, - /* 0x10 - 0x1F */ - N, N, N, N, N, N, N, N, -- D(ImplicitOps | ModRM), N, N, N, N, N, N, D(ImplicitOps | ModRM), -+ D(ImplicitOps | ModRM | SrcMem | NoAccess), -+ N, N, N, N, N, N, D(ImplicitOps | ModRM | SrcMem | NoAccess), - /* 0x20 - 0x2F */ - DIP(ModRM | DstMem | Priv | Op3264 | NoMod, cr_read, check_cr_read), - DIP(ModRM | DstMem | Priv | Op3264 | NoMod, dr_read, check_dr_read), -@@ -3942,7 +4091,7 @@ static const struct opcode twobyte_table[256] = { - F(DstMem | SrcReg | ModRM | BitOp | Lock | PageTable, em_bts), - F(DstMem | SrcReg | Src2ImmByte | ModRM, em_shrd), - F(DstMem | SrcReg | Src2CL | ModRM, em_shrd), -- D(ModRM), F(DstReg | SrcMem | ModRM, em_imul), -+ GD(0, &group15), F(DstReg | SrcMem | ModRM, em_imul), - /* 0xB0 - 0xB7 */ - I2bv(DstMem | SrcReg | ModRM | Lock | PageTable, em_cmpxchg), - I(DstReg | SrcMemFAddr | ModRM | Src2SS, em_lseg), -@@ -4458,10 +4607,10 @@ done_prefixes: - /* Decode and fetch the destination operand: register or memory. */ - rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask); - --done: - if (ctxt->rip_relative) - ctxt->memopp->addr.mem.ea += ctxt->_eip; - -+done: - return (rc != X86EMUL_CONTINUE) ? EMULATION_FAILED : EMULATION_OK; - } - -@@ -4711,7 +4860,7 @@ special_insn: - break; - case 0x70 ... 0x7f: /* jcc (short) */ - if (test_cc(ctxt->b, ctxt->eflags)) -- jmp_rel(ctxt, ctxt->src.val); -+ rc = jmp_rel(ctxt, ctxt->src.val); - break; - case 0x8d: /* lea r16/r32, m */ - ctxt->dst.val = ctxt->src.addr.mem.ea; -@@ -4741,7 +4890,7 @@ special_insn: - break; - case 0xe9: /* jmp rel */ - case 0xeb: /* jmp rel short */ -- jmp_rel(ctxt, ctxt->src.val); -+ rc = jmp_rel(ctxt, ctxt->src.val); - ctxt->dst.type = OP_NONE; /* Disable writeback. */ - break; - case 0xf4: /* hlt */ -@@ -4864,13 +5013,11 @@ twobyte_insn: - break; - case 0x80 ... 0x8f: /* jnz rel, etc*/ - if (test_cc(ctxt->b, ctxt->eflags)) -- jmp_rel(ctxt, ctxt->src.val); -+ rc = jmp_rel(ctxt, ctxt->src.val); - break; - case 0x90 ... 0x9f: /* setcc r/m8 */ - ctxt->dst.val = test_cc(ctxt->b, ctxt->eflags); - break; -- case 0xae: /* clflush */ -- break; - case 0xb6 ... 0xb7: /* movzx */ - ctxt->dst.bytes = ctxt->op_bytes; - ctxt->dst.val = (ctxt->src.bytes == 1) ? (u8) ctxt->src.val -diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c -index 518d864..298781d 100644 ---- a/arch/x86/kvm/i8254.c -+++ b/arch/x86/kvm/i8254.c -@@ -262,8 +262,10 @@ void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu) - return; - - timer = &pit->pit_state.timer; -+ mutex_lock(&pit->pit_state.lock); - if (hrtimer_cancel(timer)) - hrtimer_start_expires(timer, HRTIMER_MODE_ABS); -+ mutex_unlock(&pit->pit_state.lock); - } - - static void destroy_pit_timer(struct kvm_pit *pit) -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index ddf7427..78dadc3 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -3234,7 +3234,7 @@ static int wrmsr_interception(struct vcpu_svm *svm) - msr.host_initiated = false; - - svm->next_rip = kvm_rip_read(&svm->vcpu) + 2; -- if (svm_set_msr(&svm->vcpu, &msr)) { -+ if (kvm_set_msr(&svm->vcpu, &msr)) { - trace_kvm_msr_write_ex(ecx, data); - kvm_inject_gp(&svm->vcpu, 0); - } else { -@@ -3534,9 +3534,9 @@ static int handle_exit(struct kvm_vcpu *vcpu) - - if (exit_code >= ARRAY_SIZE(svm_exit_handlers) - || !svm_exit_handlers[exit_code]) { -- kvm_run->exit_reason = KVM_EXIT_UNKNOWN; -- kvm_run->hw.hardware_exit_reason = exit_code; -- return 0; -+ WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_code); -+ kvm_queue_exception(vcpu, UD_VECTOR); -+ return 1; - } - - return svm_exit_handlers[exit_code](svm); -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 6a118fa..41a5426 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -2632,12 +2632,15 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - default: - msr = find_msr_entry(vmx, msr_index); - if (msr) { -+ u64 old_msr_data = msr->data; - msr->data = data; - if (msr - vmx->guest_msrs < vmx->save_nmsrs) { - preempt_disable(); -- kvm_set_shared_msr(msr->index, msr->data, -- msr->mask); -+ ret = kvm_set_shared_msr(msr->index, msr->data, -+ msr->mask); - preempt_enable(); -+ if (ret) -+ msr->data = old_msr_data; - } - break; - } -@@ -5263,7 +5266,7 @@ static int handle_wrmsr(struct kvm_vcpu *vcpu) - msr.data = data; - msr.index = ecx; - msr.host_initiated = false; -- if (vmx_set_msr(vcpu, &msr) != 0) { -+ if (kvm_set_msr(vcpu, &msr) != 0) { - trace_kvm_msr_write_ex(ecx, data); - kvm_inject_gp(vcpu, 0); - return 1; -@@ -6636,6 +6639,12 @@ static int handle_invept(struct kvm_vcpu *vcpu) - return 1; - } - -+static int handle_invvpid(struct kvm_vcpu *vcpu) -+{ -+ kvm_queue_exception(vcpu, UD_VECTOR); -+ return 1; -+} -+ - /* - * The exit handlers return 1 if the exit was handled fully and guest execution - * may resume. Otherwise they set the kvm_run parameter to indicate what needs -@@ -6681,6 +6690,7 @@ static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = { - [EXIT_REASON_MWAIT_INSTRUCTION] = handle_mwait, - [EXIT_REASON_MONITOR_INSTRUCTION] = handle_monitor, - [EXIT_REASON_INVEPT] = handle_invept, -+ [EXIT_REASON_INVVPID] = handle_invvpid, - }; - - static const int kvm_vmx_max_exit_handlers = -@@ -6914,7 +6924,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu) - case EXIT_REASON_VMPTRST: case EXIT_REASON_VMREAD: - case EXIT_REASON_VMRESUME: case EXIT_REASON_VMWRITE: - case EXIT_REASON_VMOFF: case EXIT_REASON_VMON: -- case EXIT_REASON_INVEPT: -+ case EXIT_REASON_INVEPT: case EXIT_REASON_INVVPID: - /* - * VMX instructions trap unconditionally. This allows L1 to - * emulate them for its L2 guest, i.e., allows 3-level nesting! -@@ -7055,10 +7065,10 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu) - && kvm_vmx_exit_handlers[exit_reason]) - return kvm_vmx_exit_handlers[exit_reason](vcpu); - else { -- vcpu->run->exit_reason = KVM_EXIT_UNKNOWN; -- vcpu->run->hw.hardware_exit_reason = exit_reason; -+ WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_reason); -+ kvm_queue_exception(vcpu, UD_VECTOR); -+ return 1; - } -- return 0; - } - - static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr) -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 8f1e22d..9d292e8 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -229,20 +229,25 @@ static void kvm_shared_msr_cpu_online(void) - shared_msr_update(i, shared_msrs_global.msrs[i]); - } - --void kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) -+int kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) - { - unsigned int cpu = smp_processor_id(); - struct kvm_shared_msrs *smsr = per_cpu_ptr(shared_msrs, cpu); -+ int err; - - if (((value ^ smsr->values[slot].curr) & mask) == 0) -- return; -+ return 0; - smsr->values[slot].curr = value; -- wrmsrl(shared_msrs_global.msrs[slot], value); -+ err = wrmsrl_safe(shared_msrs_global.msrs[slot], value); -+ if (err) -+ return 1; -+ - if (!smsr->registered) { - smsr->urn.on_user_return = kvm_on_user_return; - user_return_notifier_register(&smsr->urn); - smsr->registered = true; - } -+ return 0; - } - EXPORT_SYMBOL_GPL(kvm_set_shared_msr); - -@@ -984,7 +989,6 @@ void kvm_enable_efer_bits(u64 mask) - } - EXPORT_SYMBOL_GPL(kvm_enable_efer_bits); - -- - /* - * Writes msr value into into the appropriate "register". - * Returns 0 on success, non-0 otherwise. -@@ -992,8 +996,34 @@ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits); - */ - int kvm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) - { -+ switch (msr->index) { -+ case MSR_FS_BASE: -+ case MSR_GS_BASE: -+ case MSR_KERNEL_GS_BASE: -+ case MSR_CSTAR: -+ case MSR_LSTAR: -+ if (is_noncanonical_address(msr->data)) -+ return 1; -+ break; -+ case MSR_IA32_SYSENTER_EIP: -+ case MSR_IA32_SYSENTER_ESP: -+ /* -+ * IA32_SYSENTER_ESP and IA32_SYSENTER_EIP cause #GP if -+ * non-canonical address is written on Intel but not on -+ * AMD (which ignores the top 32-bits, because it does -+ * not implement 64-bit SYSENTER). -+ * -+ * 64-bit code should hence be able to write a non-canonical -+ * value on AMD. Making the address canonical ensures that -+ * vmentry does not fail on Intel after writing a non-canonical -+ * value, and that something deterministic happens if the guest -+ * invokes 64-bit SYSENTER. -+ */ -+ msr->data = get_canonical(msr->data); -+ } - return kvm_x86_ops->set_msr(vcpu, msr); - } -+EXPORT_SYMBOL_GPL(kvm_set_msr); - - /* - * Adapt set_msr() to msr_io()'s calling convention -diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c -index ae242a7..36de293 100644 ---- a/arch/x86/mm/pageattr.c -+++ b/arch/x86/mm/pageattr.c -@@ -409,7 +409,7 @@ phys_addr_t slow_virt_to_phys(void *__virt_addr) - psize = page_level_size(level); - pmask = page_level_mask(level); - offset = virt_addr & ~pmask; -- phys_addr = pte_pfn(*pte) << PAGE_SHIFT; -+ phys_addr = (phys_addr_t)pte_pfn(*pte) << PAGE_SHIFT; - return (phys_addr | offset); - } - EXPORT_SYMBOL_GPL(slow_virt_to_phys); -diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c -index 5c8cb80..c881ba8 100644 ---- a/arch/x86/net/bpf_jit_comp.c -+++ b/arch/x86/net/bpf_jit_comp.c -@@ -211,12 +211,17 @@ struct jit_context { - bool seen_ld_abs; - }; - -+/* maximum number of bytes emitted while JITing one eBPF insn */ -+#define BPF_MAX_INSN_SIZE 128 -+#define BPF_INSN_SAFETY 64 -+ - static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image, - int oldproglen, struct jit_context *ctx) - { - struct bpf_insn *insn = bpf_prog->insnsi; - int insn_cnt = bpf_prog->len; -- u8 temp[64]; -+ bool seen_ld_abs = ctx->seen_ld_abs | (oldproglen == 0); -+ u8 temp[BPF_MAX_INSN_SIZE + BPF_INSN_SAFETY]; - int i; - int proglen = 0; - u8 *prog = temp; -@@ -254,7 +259,7 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image, - EMIT2(0x31, 0xc0); /* xor eax, eax */ - EMIT3(0x4D, 0x31, 0xED); /* xor r13, r13 */ - -- if (ctx->seen_ld_abs) { -+ if (seen_ld_abs) { - /* r9d : skb->len - skb->data_len (headlen) - * r10 : skb->data - */ -@@ -655,7 +660,7 @@ xadd: if (is_imm8(insn->off)) - case BPF_JMP | BPF_CALL: - func = (u8 *) __bpf_call_base + imm32; - jmp_offset = func - (image + addrs[i]); -- if (ctx->seen_ld_abs) { -+ if (seen_ld_abs) { - EMIT2(0x41, 0x52); /* push %r10 */ - EMIT2(0x41, 0x51); /* push %r9 */ - /* need to adjust jmp offset, since -@@ -669,7 +674,7 @@ xadd: if (is_imm8(insn->off)) - return -EINVAL; - } - EMIT1_off32(0xE8, jmp_offset); -- if (ctx->seen_ld_abs) { -+ if (seen_ld_abs) { - EMIT2(0x41, 0x59); /* pop %r9 */ - EMIT2(0x41, 0x5A); /* pop %r10 */ - } -@@ -774,7 +779,8 @@ emit_jmp: - goto common_load; - case BPF_LD | BPF_ABS | BPF_W: - func = CHOOSE_LOAD_FUNC(imm32, sk_load_word); --common_load: ctx->seen_ld_abs = true; -+common_load: -+ ctx->seen_ld_abs = seen_ld_abs = true; - jmp_offset = func - (image + addrs[i]); - if (!func || !is_simm32(jmp_offset)) { - pr_err("unsupported bpf func %d addr %p image %p\n", -@@ -848,6 +854,11 @@ common_load: ctx->seen_ld_abs = true; - } - - ilen = prog - temp; -+ if (ilen > BPF_MAX_INSN_SIZE) { -+ pr_err("bpf_jit_compile fatal insn size error\n"); -+ return -EFAULT; -+ } -+ - if (image) { - if (unlikely(proglen + ilen > oldproglen)) { - pr_err("bpf_jit_compile fatal error\n"); -@@ -904,9 +915,11 @@ void bpf_int_jit_compile(struct bpf_prog *prog) - goto out; - } - if (image) { -- if (proglen != oldproglen) -+ if (proglen != oldproglen) { - pr_err("bpf_jit: proglen=%d != oldproglen=%d\n", - proglen, oldproglen); -+ goto out; -+ } - break; - } - if (proglen == oldproglen) { -diff --git a/arch/x86/platform/intel-mid/sfi.c b/arch/x86/platform/intel-mid/sfi.c -index 3c53a90..c14ad34 100644 ---- a/arch/x86/platform/intel-mid/sfi.c -+++ b/arch/x86/platform/intel-mid/sfi.c -@@ -106,6 +106,7 @@ int __init sfi_parse_mtmr(struct sfi_table_header *table) - mp_irq.dstapic = MP_APIC_ALL; - mp_irq.dstirq = pentry->irq; - mp_save_irq(&mp_irq); -+ mp_map_gsi_to_irq(pentry->irq, IOAPIC_MAP_ALLOC); - } - - return 0; -@@ -176,6 +177,7 @@ int __init sfi_parse_mrtc(struct sfi_table_header *table) - mp_irq.dstapic = MP_APIC_ALL; - mp_irq.dstirq = pentry->irq; - mp_save_irq(&mp_irq); -+ mp_map_gsi_to_irq(pentry->irq, IOAPIC_MAP_ALLOC); - } - return 0; - } -diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c -index c1b9242..74a4168 100644 ---- a/block/blk-mq-tag.c -+++ b/block/blk-mq-tag.c -@@ -463,8 +463,8 @@ static void bt_update_count(struct blk_mq_bitmap_tags *bt, - } - - bt->wake_cnt = BT_WAIT_BATCH; -- if (bt->wake_cnt > depth / 4) -- bt->wake_cnt = max(1U, depth / 4); -+ if (bt->wake_cnt > depth / BT_WAIT_QUEUES) -+ bt->wake_cnt = max(1U, depth / BT_WAIT_QUEUES); - - bt->depth = depth; - } -diff --git a/block/blk-settings.c b/block/blk-settings.c -index f1a1795..aa02247 100644 ---- a/block/blk-settings.c -+++ b/block/blk-settings.c -@@ -574,7 +574,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, - bottom = max(b->physical_block_size, b->io_min) + alignment; - - /* Verify that top and bottom intervals line up */ -- if (max(top, bottom) & (min(top, bottom) - 1)) { -+ if (max(top, bottom) % min(top, bottom)) { - t->misaligned = 1; - ret = -1; - } -@@ -619,7 +619,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, - - /* Find lowest common alignment_offset */ - t->alignment_offset = lcm(t->alignment_offset, alignment) -- & (max(t->physical_block_size, t->io_min) - 1); -+ % max(t->physical_block_size, t->io_min); - - /* Verify that new alignment_offset is on a logical block boundary */ - if (t->alignment_offset & (t->logical_block_size - 1)) { -diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c -index 9b8eaec..a6d6270 100644 ---- a/block/scsi_ioctl.c -+++ b/block/scsi_ioctl.c -@@ -509,7 +509,7 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode, - - if (bytes && blk_rq_map_kern(q, rq, buffer, bytes, __GFP_WAIT)) { - err = DRIVER_ERROR << 24; -- goto out; -+ goto error; - } - - memset(sense, 0, sizeof(sense)); -@@ -518,7 +518,6 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode, - - blk_execute_rq(q, disk, rq, 0); - --out: - err = rq->errors & 0xff; /* only 8 bit SCSI status */ - if (err) { - if (rq->sense_len && rq->sense) { -diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c -index a19c027..83187f4 100644 ---- a/crypto/algif_skcipher.c -+++ b/crypto/algif_skcipher.c -@@ -49,7 +49,7 @@ struct skcipher_ctx { - struct ablkcipher_request req; - }; - --#define MAX_SGL_ENTS ((PAGE_SIZE - sizeof(struct skcipher_sg_list)) / \ -+#define MAX_SGL_ENTS ((4096 - sizeof(struct skcipher_sg_list)) / \ - sizeof(struct scatterlist) - 1) - - static inline int skcipher_sndbuf(struct sock *sk) -diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c -index 67075f8..5e9cbd6 100644 ---- a/drivers/acpi/device_pm.c -+++ b/drivers/acpi/device_pm.c -@@ -710,7 +710,7 @@ int acpi_pm_device_run_wake(struct device *phys_dev, bool enable) - return -ENODEV; - } - -- return acpi_device_wakeup(adev, enable, ACPI_STATE_S0); -+ return acpi_device_wakeup(adev, ACPI_STATE_S0, enable); - } - EXPORT_SYMBOL(acpi_pm_device_run_wake); - #endif /* CONFIG_PM_RUNTIME */ -diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c -index cb6066c..c874859 100644 ---- a/drivers/acpi/ec.c -+++ b/drivers/acpi/ec.c -@@ -126,6 +126,7 @@ static int EC_FLAGS_MSI; /* Out-of-spec MSI controller */ - static int EC_FLAGS_VALIDATE_ECDT; /* ASUStec ECDTs need to be validated */ - static int EC_FLAGS_SKIP_DSDT_SCAN; /* Not all BIOS survive early DSDT scan */ - static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */ -+static int EC_FLAGS_QUERY_HANDSHAKE; /* Needs QR_EC issued when SCI_EVT set */ - - /* -------------------------------------------------------------------------- - Transaction Management -@@ -210,13 +211,8 @@ static bool advance_transaction(struct acpi_ec *ec) - } - return wakeup; - } else { -- /* -- * There is firmware refusing to respond QR_EC when SCI_EVT -- * is not set, for which case, we complete the QR_EC -- * without issuing it to the firmware. -- * https://bugzilla.kernel.org/show_bug.cgi?id=86211 -- */ -- if (!(status & ACPI_EC_FLAG_SCI) && -+ if (EC_FLAGS_QUERY_HANDSHAKE && -+ !(status & ACPI_EC_FLAG_SCI) && - (t->command == ACPI_EC_COMMAND_QUERY)) { - t->flags |= ACPI_EC_COMMAND_POLL; - t->rdata[t->ri++] = 0x00; -@@ -981,6 +977,18 @@ static int ec_enlarge_storm_threshold(const struct dmi_system_id *id) - } - - /* -+ * Acer EC firmware refuses to respond QR_EC when SCI_EVT is not set, for -+ * which case, we complete the QR_EC without issuing it to the firmware. -+ * https://bugzilla.kernel.org/show_bug.cgi?id=86211 -+ */ -+static int ec_flag_query_handshake(const struct dmi_system_id *id) -+{ -+ pr_debug("Detected the EC firmware requiring QR_EC issued when SCI_EVT set\n"); -+ EC_FLAGS_QUERY_HANDSHAKE = 1; -+ return 0; -+} -+ -+/* - * On some hardware it is necessary to clear events accumulated by the EC during - * sleep. These ECs stop reporting GPEs until they are manually polled, if too - * many events are accumulated. (e.g. Samsung Series 5/9 notebooks) -@@ -1054,6 +1062,9 @@ static struct dmi_system_id ec_dmi_table[] __initdata = { - { - ec_clear_on_resume, "Samsung hardware", { - DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL}, -+ { -+ ec_flag_query_handshake, "Acer hardware", { -+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), }, NULL}, - {}, - }; - -diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c -index 1121153..db90aa3 100644 ---- a/drivers/ata/libata-sff.c -+++ b/drivers/ata/libata-sff.c -@@ -2008,13 +2008,15 @@ static int ata_bus_softreset(struct ata_port *ap, unsigned int devmask, - - DPRINTK("ata%u: bus reset via SRST\n", ap->print_id); - -- /* software reset. causes dev0 to be selected */ -- iowrite8(ap->ctl, ioaddr->ctl_addr); -- udelay(20); /* FIXME: flush */ -- iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr); -- udelay(20); /* FIXME: flush */ -- iowrite8(ap->ctl, ioaddr->ctl_addr); -- ap->last_ctl = ap->ctl; -+ if (ap->ioaddr.ctl_addr) { -+ /* software reset. causes dev0 to be selected */ -+ iowrite8(ap->ctl, ioaddr->ctl_addr); -+ udelay(20); /* FIXME: flush */ -+ iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr); -+ udelay(20); /* FIXME: flush */ -+ iowrite8(ap->ctl, ioaddr->ctl_addr); -+ ap->last_ctl = ap->ctl; -+ } - - /* wait the port to become ready */ - return ata_sff_wait_after_reset(&ap->link, devmask, deadline); -@@ -2215,10 +2217,6 @@ void ata_sff_error_handler(struct ata_port *ap) - - spin_unlock_irqrestore(ap->lock, flags); - -- /* ignore ata_sff_softreset if ctl isn't accessible */ -- if (softreset == ata_sff_softreset && !ap->ioaddr.ctl_addr) -- softreset = NULL; -- - /* ignore built-in hardresets if SCR access is not available */ - if ((hardreset == sata_std_hardreset || - hardreset == sata_sff_hardreset) && !sata_scr_valid(&ap->link)) -diff --git a/drivers/ata/pata_serverworks.c b/drivers/ata/pata_serverworks.c -index fc5f31d..57de021 100644 ---- a/drivers/ata/pata_serverworks.c -+++ b/drivers/ata/pata_serverworks.c -@@ -251,12 +251,18 @@ static void serverworks_set_dmamode(struct ata_port *ap, struct ata_device *adev - pci_write_config_byte(pdev, 0x54, ultra_cfg); - } - --static struct scsi_host_template serverworks_sht = { -+static struct scsi_host_template serverworks_osb4_sht = { -+ ATA_BMDMA_SHT(DRV_NAME), -+ .sg_tablesize = LIBATA_DUMB_MAX_PRD, -+}; -+ -+static struct scsi_host_template serverworks_csb_sht = { - ATA_BMDMA_SHT(DRV_NAME), - }; - - static struct ata_port_operations serverworks_osb4_port_ops = { - .inherits = &ata_bmdma_port_ops, -+ .qc_prep = ata_bmdma_dumb_qc_prep, - .cable_detect = serverworks_cable_detect, - .mode_filter = serverworks_osb4_filter, - .set_piomode = serverworks_set_piomode, -@@ -265,6 +271,7 @@ static struct ata_port_operations serverworks_osb4_port_ops = { - - static struct ata_port_operations serverworks_csb_port_ops = { - .inherits = &serverworks_osb4_port_ops, -+ .qc_prep = ata_bmdma_qc_prep, - .mode_filter = serverworks_csb_filter, - }; - -@@ -404,6 +411,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id - } - }; - const struct ata_port_info *ppi[] = { &info[id->driver_data], NULL }; -+ struct scsi_host_template *sht = &serverworks_csb_sht; - int rc; - - rc = pcim_enable_device(pdev); -@@ -417,6 +425,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id - /* Select non UDMA capable OSB4 if we can't do fixups */ - if (rc < 0) - ppi[0] = &info[1]; -+ sht = &serverworks_osb4_sht; - } - /* setup CSB5/CSB6 : South Bridge and IDE option RAID */ - else if ((pdev->device == PCI_DEVICE_ID_SERVERWORKS_CSB5IDE) || -@@ -433,7 +442,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id - ppi[1] = &ata_dummy_port_info; - } - -- return ata_pci_bmdma_init_one(pdev, ppi, &serverworks_sht, NULL, 0); -+ return ata_pci_bmdma_init_one(pdev, ppi, sht, NULL, 0); - } - - #ifdef CONFIG_PM_SLEEP -diff --git a/drivers/base/core.c b/drivers/base/core.c -index 20da3ad..0e9468c 100644 ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -724,12 +724,12 @@ class_dir_create_and_add(struct class *class, struct kobject *parent_kobj) - return &dir->kobj; - } - -+static DEFINE_MUTEX(gdp_mutex); - - static struct kobject *get_device_parent(struct device *dev, - struct device *parent) - { - if (dev->class) { -- static DEFINE_MUTEX(gdp_mutex); - struct kobject *kobj = NULL; - struct kobject *parent_kobj; - struct kobject *k; -@@ -793,7 +793,9 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) - glue_dir->kset != &dev->class->p->glue_dirs) - return; - -+ mutex_lock(&gdp_mutex); - kobject_put(glue_dir); -+ mutex_unlock(&gdp_mutex); - } - - static void cleanup_device_parent(struct device *dev) -diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c -index b67d9ae..ebc2f9d 100644 ---- a/drivers/base/power/main.c -+++ b/drivers/base/power/main.c -@@ -1266,6 +1266,8 @@ static int dpm_suspend_late(pm_message_t state) - } - mutex_unlock(&dpm_list_mtx); - async_synchronize_full(); -+ if (!error) -+ error = async_error; - if (error) { - suspend_stats.failed_suspend_late++; - dpm_save_failed_step(SUSPEND_SUSPEND_LATE); -diff --git a/drivers/block/drbd/drbd_interval.c b/drivers/block/drbd/drbd_interval.c -index 89c497c..04a14e0 100644 ---- a/drivers/block/drbd/drbd_interval.c -+++ b/drivers/block/drbd/drbd_interval.c -@@ -79,6 +79,7 @@ bool - drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) - { - struct rb_node **new = &root->rb_node, *parent = NULL; -+ sector_t this_end = this->sector + (this->size >> 9); - - BUG_ON(!IS_ALIGNED(this->size, 512)); - -@@ -87,6 +88,8 @@ drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) - rb_entry(*new, struct drbd_interval, rb); - - parent = *new; -+ if (here->end < this_end) -+ here->end = this_end; - if (this->sector < here->sector) - new = &(*new)->rb_left; - else if (this->sector > here->sector) -@@ -99,6 +102,7 @@ drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) - return false; - } - -+ this->end = this_end; - rb_link_node(&this->rb, parent, new); - rb_insert_augmented(&this->rb, root, &augment_callbacks); - return true; -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index 4b97baf..33f0f97 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -3382,7 +3382,7 @@ static int rbd_obj_read_sync(struct rbd_device *rbd_dev, - page_count = (u32) calc_pages_for(offset, length); - pages = ceph_alloc_page_vector(page_count, GFP_KERNEL); - if (IS_ERR(pages)) -- ret = PTR_ERR(pages); -+ return PTR_ERR(pages); - - ret = -ENOMEM; - obj_request = rbd_obj_request_create(object_name, offset, length, -@@ -5087,7 +5087,8 @@ static int rbd_dev_device_setup(struct rbd_device *rbd_dev) - set_capacity(rbd_dev->disk, rbd_dev->mapping.size / SECTOR_SIZE); - set_disk_ro(rbd_dev->disk, rbd_dev->mapping.read_only); - -- rbd_dev->rq_wq = alloc_workqueue("%s", 0, 0, rbd_dev->disk->disk_name); -+ rbd_dev->rq_wq = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0, -+ rbd_dev->disk->disk_name); - if (!rbd_dev->rq_wq) { - ret = -ENOMEM; - goto err_out_mapping; -diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c -index 64c60ed..63fc7f0 100644 ---- a/drivers/block/xen-blkback/blkback.c -+++ b/drivers/block/xen-blkback/blkback.c -@@ -763,6 +763,7 @@ again: - BUG_ON(new_map_idx >= segs_to_map); - if (unlikely(map[new_map_idx].status != 0)) { - pr_debug(DRV_PFX "invalid buffer -- could not remap it\n"); -+ put_free_pages(blkif, &pages[seg_idx]->page, 1); - pages[seg_idx]->handle = BLKBACK_INVALID_HANDLE; - ret |= 1; - goto next; -diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c -index 3a8b810..54f4089 100644 ---- a/drivers/block/xen-blkback/xenbus.c -+++ b/drivers/block/xen-blkback/xenbus.c -@@ -270,6 +270,9 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif) - blkif->blk_rings.common.sring = NULL; - } - -+ /* Remove all persistent grants and the cache of ballooned pages. */ -+ xen_blkbk_free_caches(blkif); -+ - return 0; - } - -@@ -281,9 +284,6 @@ static void xen_blkif_free(struct xen_blkif *blkif) - xen_blkif_disconnect(blkif); - xen_vbd_free(&blkif->vbd); - -- /* Remove all persistent grants and the cache of ballooned pages. */ -- xen_blkbk_free_caches(blkif); -- - /* Make sure everything is drained before shutting down */ - BUG_ON(blkif->persistent_gnt_c != 0); - BUG_ON(atomic_read(&blkif->persistent_gnt_in_use) != 0); -diff --git a/drivers/char/random.c b/drivers/char/random.c -index c18d41d..8c86a95 100644 ---- a/drivers/char/random.c -+++ b/drivers/char/random.c -@@ -1106,7 +1106,7 @@ static void extract_buf(struct entropy_store *r, __u8 *out) - __mix_pool_bytes(r, hash.w, sizeof(hash.w)); - spin_unlock_irqrestore(&r->lock, flags); - -- memset(workspace, 0, sizeof(workspace)); -+ memzero_explicit(workspace, sizeof(workspace)); - - /* - * In case the hash function has some recognizable output -@@ -1118,7 +1118,7 @@ static void extract_buf(struct entropy_store *r, __u8 *out) - hash.w[2] ^= rol32(hash.w[2], 16); - - memcpy(out, &hash, EXTRACT_SIZE); -- memset(&hash, 0, sizeof(hash)); -+ memzero_explicit(&hash, sizeof(hash)); - } - - /* -@@ -1175,7 +1175,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf, - } - - /* Wipe data just returned from memory */ -- memset(tmp, 0, sizeof(tmp)); -+ memzero_explicit(tmp, sizeof(tmp)); - - return ret; - } -@@ -1218,7 +1218,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf, - } - - /* Wipe data just returned from memory */ -- memset(tmp, 0, sizeof(tmp)); -+ memzero_explicit(tmp, sizeof(tmp)); - - return ret; - } -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index 61190f6..c05821e 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -512,7 +512,18 @@ show_one(cpuinfo_max_freq, cpuinfo.max_freq); - show_one(cpuinfo_transition_latency, cpuinfo.transition_latency); - show_one(scaling_min_freq, min); - show_one(scaling_max_freq, max); --show_one(scaling_cur_freq, cur); -+ -+static ssize_t show_scaling_cur_freq( -+ struct cpufreq_policy *policy, char *buf) -+{ -+ ssize_t ret; -+ -+ if (cpufreq_driver && cpufreq_driver->setpolicy && cpufreq_driver->get) -+ ret = sprintf(buf, "%u\n", cpufreq_driver->get(policy->cpu)); -+ else -+ ret = sprintf(buf, "%u\n", policy->cur); -+ return ret; -+} - - static int cpufreq_set_policy(struct cpufreq_policy *policy, - struct cpufreq_policy *new_policy); -@@ -906,11 +917,11 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy, - if (ret) - goto err_out_kobj_put; - } -- if (has_target()) { -- ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr); -- if (ret) -- goto err_out_kobj_put; -- } -+ -+ ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr); -+ if (ret) -+ goto err_out_kobj_put; -+ - if (cpufreq_driver->bios_limit) { - ret = sysfs_create_file(&policy->kobj, &bios_limit.attr); - if (ret) -diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index 0668b38..27bb6d3 100644 ---- a/drivers/cpufreq/intel_pstate.c -+++ b/drivers/cpufreq/intel_pstate.c -@@ -52,6 +52,17 @@ static inline int32_t div_fp(int32_t x, int32_t y) - return div_s64((int64_t)x << FRAC_BITS, y); - } - -+static inline int ceiling_fp(int32_t x) -+{ -+ int mask, ret; -+ -+ ret = fp_toint(x); -+ mask = (1 << FRAC_BITS) - 1; -+ if (x & mask) -+ ret += 1; -+ return ret; -+} -+ - struct sample { - int32_t core_pct_busy; - u64 aperf; -@@ -64,6 +75,7 @@ struct pstate_data { - int current_pstate; - int min_pstate; - int max_pstate; -+ int scaling; - int turbo_pstate; - }; - -@@ -113,6 +125,7 @@ struct pstate_funcs { - int (*get_max)(void); - int (*get_min)(void); - int (*get_turbo)(void); -+ int (*get_scaling)(void); - void (*set)(struct cpudata*, int pstate); - void (*get_vid)(struct cpudata *); - }; -@@ -138,6 +151,7 @@ struct perf_limits { - - static struct perf_limits limits = { - .no_turbo = 0, -+ .turbo_disabled = 0, - .max_perf_pct = 100, - .max_perf = int_tofp(1), - .min_perf_pct = 0, -@@ -218,6 +232,18 @@ static inline void intel_pstate_reset_all_pid(void) - } - } - -+static inline void update_turbo_state(void) -+{ -+ u64 misc_en; -+ struct cpudata *cpu; -+ -+ cpu = all_cpu_data[0]; -+ rdmsrl(MSR_IA32_MISC_ENABLE, misc_en); -+ limits.turbo_disabled = -+ (misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE || -+ cpu->pstate.max_pstate == cpu->pstate.turbo_pstate); -+} -+ - /************************** debugfs begin ************************/ - static int pid_param_set(void *data, u64 val) - { -@@ -274,6 +300,20 @@ static void __init intel_pstate_debug_expose_params(void) - return sprintf(buf, "%u\n", limits.object); \ - } - -+static ssize_t show_no_turbo(struct kobject *kobj, -+ struct attribute *attr, char *buf) -+{ -+ ssize_t ret; -+ -+ update_turbo_state(); -+ if (limits.turbo_disabled) -+ ret = sprintf(buf, "%u\n", limits.turbo_disabled); -+ else -+ ret = sprintf(buf, "%u\n", limits.no_turbo); -+ -+ return ret; -+} -+ - static ssize_t store_no_turbo(struct kobject *a, struct attribute *b, - const char *buf, size_t count) - { -@@ -283,11 +323,14 @@ static ssize_t store_no_turbo(struct kobject *a, struct attribute *b, - ret = sscanf(buf, "%u", &input); - if (ret != 1) - return -EINVAL; -- limits.no_turbo = clamp_t(int, input, 0 , 1); -+ -+ update_turbo_state(); - if (limits.turbo_disabled) { - pr_warn("Turbo disabled by BIOS or unavailable on processor\n"); -- limits.no_turbo = limits.turbo_disabled; -+ return -EPERM; - } -+ limits.no_turbo = clamp_t(int, input, 0, 1); -+ - return count; - } - -@@ -323,7 +366,6 @@ static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b, - return count; - } - --show_one(no_turbo, no_turbo); - show_one(max_perf_pct, max_perf_pct); - show_one(min_perf_pct, min_perf_pct); - -@@ -394,7 +436,7 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate) - cpudata->vid.ratio); - - vid_fp = clamp_t(int32_t, vid_fp, cpudata->vid.min, cpudata->vid.max); -- vid = fp_toint(vid_fp); -+ vid = ceiling_fp(vid_fp); - - if (pstate > cpudata->pstate.max_pstate) - vid = cpudata->vid.turbo; -@@ -404,6 +446,22 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate) - wrmsrl(MSR_IA32_PERF_CTL, val); - } - -+#define BYT_BCLK_FREQS 5 -+static int byt_freq_table[BYT_BCLK_FREQS] = { 833, 1000, 1333, 1167, 800}; -+ -+static int byt_get_scaling(void) -+{ -+ u64 value; -+ int i; -+ -+ rdmsrl(MSR_FSB_FREQ, value); -+ i = value & 0x3; -+ -+ BUG_ON(i > BYT_BCLK_FREQS); -+ -+ return byt_freq_table[i] * 100; -+} -+ - static void byt_get_vid(struct cpudata *cpudata) - { - u64 value; -@@ -449,6 +507,11 @@ static int core_get_turbo_pstate(void) - return ret; - } - -+static inline int core_get_scaling(void) -+{ -+ return 100000; -+} -+ - static void core_set_pstate(struct cpudata *cpudata, int pstate) - { - u64 val; -@@ -473,6 +536,7 @@ static struct cpu_defaults core_params = { - .get_max = core_get_max_pstate, - .get_min = core_get_min_pstate, - .get_turbo = core_get_turbo_pstate, -+ .get_scaling = core_get_scaling, - .set = core_set_pstate, - }, - }; -@@ -491,6 +555,7 @@ static struct cpu_defaults byt_params = { - .get_min = byt_get_min_pstate, - .get_turbo = byt_get_turbo_pstate, - .set = byt_set_pstate, -+ .get_scaling = byt_get_scaling, - .get_vid = byt_get_vid, - }, - }; -@@ -501,7 +566,7 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max) - int max_perf_adj; - int min_perf; - -- if (limits.no_turbo) -+ if (limits.no_turbo || limits.turbo_disabled) - max_perf = cpu->pstate.max_pstate; - - max_perf_adj = fp_toint(mul_fp(int_tofp(max_perf), limits.max_perf)); -@@ -516,6 +581,8 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate) - { - int max_perf, min_perf; - -+ update_turbo_state(); -+ - intel_pstate_get_min_max(cpu, &min_perf, &max_perf); - - pstate = clamp_t(int, pstate, min_perf, max_perf); -@@ -523,7 +590,7 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate) - if (pstate == cpu->pstate.current_pstate) - return; - -- trace_cpu_frequency(pstate * 100000, cpu->cpu); -+ trace_cpu_frequency(pstate * cpu->pstate.scaling, cpu->cpu); - - cpu->pstate.current_pstate = pstate; - -@@ -535,6 +602,7 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu) - cpu->pstate.min_pstate = pstate_funcs.get_min(); - cpu->pstate.max_pstate = pstate_funcs.get_max(); - cpu->pstate.turbo_pstate = pstate_funcs.get_turbo(); -+ cpu->pstate.scaling = pstate_funcs.get_scaling(); - - if (pstate_funcs.get_vid) - pstate_funcs.get_vid(cpu); -@@ -550,7 +618,9 @@ static inline void intel_pstate_calc_busy(struct cpudata *cpu) - core_pct = div64_u64(core_pct, int_tofp(sample->mperf)); - - sample->freq = fp_toint( -- mul_fp(int_tofp(cpu->pstate.max_pstate * 1000), core_pct)); -+ mul_fp(int_tofp( -+ cpu->pstate.max_pstate * cpu->pstate.scaling / 100), -+ core_pct)); - - sample->core_pct_busy = (int32_t)core_pct; - } -@@ -671,7 +741,9 @@ static int intel_pstate_init_cpu(unsigned int cpunum) - { - struct cpudata *cpu; - -- all_cpu_data[cpunum] = kzalloc(sizeof(struct cpudata), GFP_KERNEL); -+ if (!all_cpu_data[cpunum]) -+ all_cpu_data[cpunum] = kzalloc(sizeof(struct cpudata), -+ GFP_KERNEL); - if (!all_cpu_data[cpunum]) - return -ENOMEM; - -@@ -714,9 +786,10 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy) - if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) { - limits.min_perf_pct = 100; - limits.min_perf = int_tofp(1); -+ limits.max_policy_pct = 100; - limits.max_perf_pct = 100; - limits.max_perf = int_tofp(1); -- limits.no_turbo = limits.turbo_disabled; -+ limits.no_turbo = 0; - return 0; - } - limits.min_perf_pct = (policy->min * 100) / policy->cpuinfo.max_freq; -@@ -751,15 +824,12 @@ static void intel_pstate_stop_cpu(struct cpufreq_policy *policy) - - del_timer_sync(&all_cpu_data[cpu_num]->timer); - intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate); -- kfree(all_cpu_data[cpu_num]); -- all_cpu_data[cpu_num] = NULL; - } - - static int intel_pstate_cpu_init(struct cpufreq_policy *policy) - { - struct cpudata *cpu; - int rc; -- u64 misc_en; - - rc = intel_pstate_init_cpu(policy->cpu); - if (rc) -@@ -767,23 +837,18 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy) - - cpu = all_cpu_data[policy->cpu]; - -- rdmsrl(MSR_IA32_MISC_ENABLE, misc_en); -- if (misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE || -- cpu->pstate.max_pstate == cpu->pstate.turbo_pstate) { -- limits.turbo_disabled = 1; -- limits.no_turbo = 1; -- } - if (limits.min_perf_pct == 100 && limits.max_perf_pct == 100) - policy->policy = CPUFREQ_POLICY_PERFORMANCE; - else - policy->policy = CPUFREQ_POLICY_POWERSAVE; - -- policy->min = cpu->pstate.min_pstate * 100000; -- policy->max = cpu->pstate.turbo_pstate * 100000; -+ policy->min = cpu->pstate.min_pstate * cpu->pstate.scaling; -+ policy->max = cpu->pstate.turbo_pstate * cpu->pstate.scaling; - - /* cpuinfo and default policy values */ -- policy->cpuinfo.min_freq = cpu->pstate.min_pstate * 100000; -- policy->cpuinfo.max_freq = cpu->pstate.turbo_pstate * 100000; -+ policy->cpuinfo.min_freq = cpu->pstate.min_pstate * cpu->pstate.scaling; -+ policy->cpuinfo.max_freq = -+ cpu->pstate.turbo_pstate * cpu->pstate.scaling; - policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL; - cpumask_set_cpu(policy->cpu, policy->cpus); - -@@ -841,6 +906,7 @@ static void copy_cpu_funcs(struct pstate_funcs *funcs) - pstate_funcs.get_max = funcs->get_max; - pstate_funcs.get_min = funcs->get_min; - pstate_funcs.get_turbo = funcs->get_turbo; -+ pstate_funcs.get_scaling = funcs->get_scaling; - pstate_funcs.set = funcs->set; - pstate_funcs.get_vid = funcs->get_vid; - } -diff --git a/drivers/edac/cpc925_edac.c b/drivers/edac/cpc925_edac.c -index df6575f..682288c 100644 ---- a/drivers/edac/cpc925_edac.c -+++ b/drivers/edac/cpc925_edac.c -@@ -562,7 +562,7 @@ static void cpc925_mc_check(struct mem_ctl_info *mci) - - if (apiexcp & UECC_EXCP_DETECTED) { - cpc925_mc_printk(mci, KERN_INFO, "DRAM UECC Fault\n"); -- edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, -+ edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, - pfn, offset, 0, - csrow, -1, -1, - mci->ctl_name, ""); -diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c -index 3cda79b..ece3aef 100644 ---- a/drivers/edac/e7xxx_edac.c -+++ b/drivers/edac/e7xxx_edac.c -@@ -226,7 +226,7 @@ static void process_ce(struct mem_ctl_info *mci, struct e7xxx_error_info *info) - static void process_ce_no_info(struct mem_ctl_info *mci) - { - edac_dbg(3, "\n"); -- edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, 0, 0, 0, -1, -1, -1, -+ edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, 0, 0, 0, -1, -1, -1, - "e7xxx CE log register overflow", ""); - } - -diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c -index 022a702..aa98b13 100644 ---- a/drivers/edac/i3200_edac.c -+++ b/drivers/edac/i3200_edac.c -@@ -242,11 +242,11 @@ static void i3200_process_error_info(struct mem_ctl_info *mci, - -1, -1, - "i3000 UE", ""); - } else if (log & I3200_ECCERRLOG_CE) { -- edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, -+ edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, - 0, 0, eccerrlog_syndrome(log), - eccerrlog_row(channel, log), - -1, -1, -- "i3000 UE", ""); -+ "i3000 CE", ""); - } - } - } -diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c -index 3382f63..4382343 100644 ---- a/drivers/edac/i82860_edac.c -+++ b/drivers/edac/i82860_edac.c -@@ -124,7 +124,7 @@ static int i82860_process_error_info(struct mem_ctl_info *mci, - dimm->location[0], dimm->location[1], -1, - "i82860 UE", ""); - else -- edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, -+ edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, - info->eap, 0, info->derrsyn, - dimm->location[0], dimm->location[1], -1, - "i82860 CE", ""); -diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c -index 5389350..70bedf9 100644 ---- a/drivers/gpu/drm/ast/ast_mode.c -+++ b/drivers/gpu/drm/ast/ast_mode.c -@@ -1080,8 +1080,8 @@ static u32 copy_cursor_image(u8 *src, u8 *dst, int width, int height) - srcdata32[1].ul = *((u32 *)(srcxor + 4)) & 0xf0f0f0f0; - data32.b[0] = srcdata32[0].b[1] | (srcdata32[0].b[0] >> 4); - data32.b[1] = srcdata32[0].b[3] | (srcdata32[0].b[2] >> 4); -- data32.b[2] = srcdata32[0].b[1] | (srcdata32[1].b[0] >> 4); -- data32.b[3] = srcdata32[0].b[3] | (srcdata32[1].b[2] >> 4); -+ data32.b[2] = srcdata32[1].b[1] | (srcdata32[1].b[0] >> 4); -+ data32.b[3] = srcdata32[1].b[3] | (srcdata32[1].b[2] >> 4); - - writel(data32.ul, dstxor); - csum += data32.ul; -diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.c b/drivers/gpu/drm/cirrus/cirrus_drv.c -index 919c73b..4977631 100644 ---- a/drivers/gpu/drm/cirrus/cirrus_drv.c -+++ b/drivers/gpu/drm/cirrus/cirrus_drv.c -@@ -32,6 +32,8 @@ static struct drm_driver driver; - static const struct pci_device_id pciidlist[] = { - { PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_5446, 0x1af4, 0x1100, 0, - 0, 0 }, -+ { PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_5446, PCI_VENDOR_ID_XEN, -+ 0x0001, 0, 0, 0 }, - {0,} - }; - -diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c -index d384139..d182058 100644 ---- a/drivers/gpu/drm/i915/i915_gem_userptr.c -+++ b/drivers/gpu/drm/i915/i915_gem_userptr.c -@@ -293,15 +293,23 @@ i915_gem_userptr_release__mmu_notifier(struct drm_i915_gem_object *obj) - static struct i915_mmu_notifier * - i915_mmu_notifier_find(struct i915_mm_struct *mm) - { -- if (mm->mn == NULL) { -- down_write(&mm->mm->mmap_sem); -- mutex_lock(&to_i915(mm->dev)->mm_lock); -- if (mm->mn == NULL) -- mm->mn = i915_mmu_notifier_create(mm->mm); -- mutex_unlock(&to_i915(mm->dev)->mm_lock); -- up_write(&mm->mm->mmap_sem); -+ struct i915_mmu_notifier *mn = mm->mn; -+ -+ mn = mm->mn; -+ if (mn) -+ return mn; -+ -+ down_write(&mm->mm->mmap_sem); -+ mutex_lock(&to_i915(mm->dev)->mm_lock); -+ if ((mn = mm->mn) == NULL) { -+ mn = i915_mmu_notifier_create(mm->mm); -+ if (!IS_ERR(mn)) -+ mm->mn = mn; - } -- return mm->mn; -+ mutex_unlock(&to_i915(mm->dev)->mm_lock); -+ up_write(&mm->mm->mmap_sem); -+ -+ return mn; - } - - static int -@@ -681,16 +689,15 @@ i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj) - static void - i915_gem_userptr_put_pages(struct drm_i915_gem_object *obj) - { -- struct scatterlist *sg; -- int i; -+ struct sg_page_iter sg_iter; - - BUG_ON(obj->userptr.work != NULL); - - if (obj->madv != I915_MADV_WILLNEED) - obj->dirty = 0; - -- for_each_sg(obj->pages->sgl, sg, obj->pages->nents, i) { -- struct page *page = sg_page(sg); -+ for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents, 0) { -+ struct page *page = sg_page_iter_page(&sg_iter); - - if (obj->dirty) - set_page_dirty(page); -diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c -index 0050ee9..5d387a8 100644 ---- a/drivers/gpu/drm/i915/i915_irq.c -+++ b/drivers/gpu/drm/i915/i915_irq.c -@@ -3482,12 +3482,13 @@ static void gen8_irq_reset(struct drm_device *dev) - void gen8_irq_power_well_post_enable(struct drm_i915_private *dev_priv) - { - unsigned long irqflags; -+ uint32_t extra_ier = GEN8_PIPE_VBLANK | GEN8_PIPE_FIFO_UNDERRUN; - - spin_lock_irqsave(&dev_priv->irq_lock, irqflags); - GEN8_IRQ_INIT_NDX(DE_PIPE, PIPE_B, dev_priv->de_irq_mask[PIPE_B], -- ~dev_priv->de_irq_mask[PIPE_B]); -+ ~dev_priv->de_irq_mask[PIPE_B] | extra_ier); - GEN8_IRQ_INIT_NDX(DE_PIPE, PIPE_C, dev_priv->de_irq_mask[PIPE_C], -- ~dev_priv->de_irq_mask[PIPE_C]); -+ ~dev_priv->de_irq_mask[PIPE_C] | extra_ier); - spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags); - } - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index d8324c6..b71a026 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -4470,7 +4470,7 @@ static void vlv_update_cdclk(struct drm_device *dev) - * BSpec erroneously claims we should aim for 4MHz, but - * in fact 1MHz is the correct frequency. - */ -- I915_WRITE(GMBUSFREQ_VLV, dev_priv->vlv_cdclk_freq); -+ I915_WRITE(GMBUSFREQ_VLV, DIV_ROUND_UP(dev_priv->vlv_cdclk_freq, 1000)); - } - - /* Adjust CDclk dividers to allow high res or save power if possible */ -@@ -12507,6 +12507,9 @@ static struct intel_quirk intel_quirks[] = { - /* Acer C720 Chromebook (Core i3 4005U) */ - { 0x0a16, 0x1025, 0x0a11, quirk_backlight_present }, - -+ /* Apple Macbook 2,1 (Core 2 T7400) */ -+ { 0x27a2, 0x8086, 0x7270, quirk_backlight_present }, -+ - /* Toshiba CB35 Chromebook (Celeron 2955U) */ - { 0x0a06, 0x1179, 0x0a88, quirk_backlight_present }, - -diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c -index fdff1d4..9222e20 100644 ---- a/drivers/gpu/drm/i915/intel_dp.c -+++ b/drivers/gpu/drm/i915/intel_dp.c -@@ -2364,6 +2364,13 @@ intel_dp_dpcd_read_wake(struct drm_dp_aux *aux, unsigned int offset, - ssize_t ret; - int i; - -+ /* -+ * Sometime we just get the same incorrect byte repeated -+ * over the entire buffer. Doing just one throw away read -+ * initially seems to "solve" it. -+ */ -+ drm_dp_dpcd_read(aux, DP_DPCD_REV, buffer, 1); -+ - for (i = 0; i < 3; i++) { - ret = drm_dp_dpcd_read(aux, offset, buffer, size); - if (ret == size) -diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c -index 8e37444..cbe8a8d 100644 ---- a/drivers/gpu/drm/i915/intel_panel.c -+++ b/drivers/gpu/drm/i915/intel_panel.c -@@ -398,6 +398,9 @@ intel_panel_detect(struct drm_device *dev) - } - } - -+#define DIV_ROUND_CLOSEST_ULL(ll, d) \ -+({ unsigned long long _tmp = (ll)+(d)/2; do_div(_tmp, d); _tmp; }) -+ - /** - * scale - scale values from one range to another - * -@@ -419,9 +422,8 @@ static uint32_t scale(uint32_t source_val, - source_val = clamp(source_val, source_min, source_max); - - /* avoid overflows */ -- target_val = (uint64_t)(source_val - source_min) * -- (target_max - target_min); -- do_div(target_val, source_max - source_min); -+ target_val = DIV_ROUND_CLOSEST_ULL((uint64_t)(source_val - source_min) * -+ (target_max - target_min), source_max - source_min); - target_val += target_min; - - return target_val; -diff --git a/drivers/gpu/drm/nouveau/Makefile b/drivers/gpu/drm/nouveau/Makefile -index f5d7f7c..0197d6c 100644 ---- a/drivers/gpu/drm/nouveau/Makefile -+++ b/drivers/gpu/drm/nouveau/Makefile -@@ -129,7 +129,7 @@ nouveau-y += core/subdev/fb/gddr5.o - nouveau-y += core/subdev/gpio/base.o - nouveau-y += core/subdev/gpio/nv10.o - nouveau-y += core/subdev/gpio/nv50.o --nouveau-y += core/subdev/gpio/nv92.o -+nouveau-y += core/subdev/gpio/nv94.o - nouveau-y += core/subdev/gpio/nvd0.o - nouveau-y += core/subdev/gpio/nve0.o - nouveau-y += core/subdev/i2c/base.o -diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nv50.c b/drivers/gpu/drm/nouveau/core/engine/device/nv50.c -index 932f84f..cbab586e 100644 ---- a/drivers/gpu/drm/nouveau/core/engine/device/nv50.c -+++ b/drivers/gpu/drm/nouveau/core/engine/device/nv50.c -@@ -141,7 +141,7 @@ nv50_identify(struct nouveau_device *device) - case 0x92: - device->cname = "G92"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv50_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv50_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = nv84_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nv84_therm_oclass; -@@ -169,7 +169,7 @@ nv50_identify(struct nouveau_device *device) - case 0x94: - device->cname = "G94"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = nv84_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nv84_therm_oclass; -@@ -197,7 +197,7 @@ nv50_identify(struct nouveau_device *device) - case 0x96: - device->cname = "G96"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = nv84_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nv84_therm_oclass; -@@ -225,7 +225,7 @@ nv50_identify(struct nouveau_device *device) - case 0x98: - device->cname = "G98"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = nv84_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nv84_therm_oclass; -@@ -253,7 +253,7 @@ nv50_identify(struct nouveau_device *device) - case 0xa0: - device->cname = "G200"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv50_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = nv84_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nv84_therm_oclass; -@@ -281,7 +281,7 @@ nv50_identify(struct nouveau_device *device) - case 0xaa: - device->cname = "MCP77/MCP78"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = nvaa_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nv84_therm_oclass; -@@ -309,7 +309,7 @@ nv50_identify(struct nouveau_device *device) - case 0xac: - device->cname = "MCP79/MCP7A"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = nvaa_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nv84_therm_oclass; -@@ -337,7 +337,7 @@ nv50_identify(struct nouveau_device *device) - case 0xa3: - device->cname = "GT215"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = &nva3_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nva3_therm_oclass; -@@ -367,7 +367,7 @@ nv50_identify(struct nouveau_device *device) - case 0xa5: - device->cname = "GT216"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = &nva3_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nva3_therm_oclass; -@@ -396,7 +396,7 @@ nv50_identify(struct nouveau_device *device) - case 0xa8: - device->cname = "GT218"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = &nva3_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nva3_therm_oclass; -@@ -425,7 +425,7 @@ nv50_identify(struct nouveau_device *device) - case 0xaf: - device->cname = "MCP89"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = &nva3_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nva3_therm_oclass; -diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c -index b4a2917..da153a2 100644 ---- a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c -+++ b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c -@@ -60,7 +60,7 @@ nvc0_identify(struct nouveau_device *device) - case 0xc0: - device->cname = "GF100"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = &nvc0_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nva3_therm_oclass; -@@ -92,7 +92,7 @@ nvc0_identify(struct nouveau_device *device) - case 0xc4: - device->cname = "GF104"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = &nvc0_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nva3_therm_oclass; -@@ -124,7 +124,7 @@ nvc0_identify(struct nouveau_device *device) - case 0xc3: - device->cname = "GF106"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = &nvc0_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nva3_therm_oclass; -@@ -155,7 +155,7 @@ nvc0_identify(struct nouveau_device *device) - case 0xce: - device->cname = "GF114"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = &nvc0_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nva3_therm_oclass; -@@ -187,7 +187,7 @@ nvc0_identify(struct nouveau_device *device) - case 0xcf: - device->cname = "GF116"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = &nvc0_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nva3_therm_oclass; -@@ -219,7 +219,7 @@ nvc0_identify(struct nouveau_device *device) - case 0xc1: - device->cname = "GF108"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = &nvc0_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nva3_therm_oclass; -@@ -250,7 +250,7 @@ nvc0_identify(struct nouveau_device *device) - case 0xc8: - device->cname = "GF110"; - device->oclass[NVDEV_SUBDEV_VBIOS ] = &nouveau_bios_oclass; -- device->oclass[NVDEV_SUBDEV_GPIO ] = nv92_gpio_oclass; -+ device->oclass[NVDEV_SUBDEV_GPIO ] = nv94_gpio_oclass; - device->oclass[NVDEV_SUBDEV_I2C ] = nv94_i2c_oclass; - device->oclass[NVDEV_SUBDEV_CLOCK ] = &nvc0_clock_oclass; - device->oclass[NVDEV_SUBDEV_THERM ] = &nva3_therm_oclass; -diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/gpio.h b/drivers/gpu/drm/nouveau/core/include/subdev/gpio.h -index b73733d..f855140 100644 ---- a/drivers/gpu/drm/nouveau/core/include/subdev/gpio.h -+++ b/drivers/gpu/drm/nouveau/core/include/subdev/gpio.h -@@ -40,7 +40,7 @@ nouveau_gpio(void *obj) - - extern struct nouveau_oclass *nv10_gpio_oclass; - extern struct nouveau_oclass *nv50_gpio_oclass; --extern struct nouveau_oclass *nv92_gpio_oclass; -+extern struct nouveau_oclass *nv94_gpio_oclass; - extern struct nouveau_oclass *nvd0_gpio_oclass; - extern struct nouveau_oclass *nve0_gpio_oclass; - -diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c -index 88606bf..bd8d348 100644 ---- a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c -+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c -@@ -124,6 +124,7 @@ dcb_outp_parse(struct nouveau_bios *bios, u8 idx, u8 *ver, u8 *len, - struct dcb_output *outp) - { - u16 dcb = dcb_outp(bios, idx, ver, len); -+ memset(outp, 0x00, sizeof(*outp)); - if (dcb) { - if (*ver >= 0x20) { - u32 conn = nv_ro32(bios, dcb + 0x00); -diff --git a/drivers/gpu/drm/nouveau/core/subdev/gpio/nv92.c b/drivers/gpu/drm/nouveau/core/subdev/gpio/nv92.c -deleted file mode 100644 -index 252083d..0000000 ---- a/drivers/gpu/drm/nouveau/core/subdev/gpio/nv92.c -+++ /dev/null -@@ -1,74 +0,0 @@ --/* -- * Copyright 2012 Red Hat Inc. -- * -- * Permission is hereby granted, free of charge, to any person obtaining a -- * copy of this software and associated documentation files (the "Software"), -- * to deal in the Software without restriction, including without limitation -- * the rights to use, copy, modify, merge, publish, distribute, sublicense, -- * and/or sell copies of the Software, and to permit persons to whom the -- * Software is furnished to do so, subject to the following conditions: -- * -- * The above copyright notice and this permission notice shall be included in -- * all copies or substantial portions of the Software. -- * -- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL -- * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR -- * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, -- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR -- * OTHER DEALINGS IN THE SOFTWARE. -- * -- * Authors: Ben Skeggs -- */ -- --#include "priv.h" -- --void --nv92_gpio_intr_stat(struct nouveau_gpio *gpio, u32 *hi, u32 *lo) --{ -- u32 intr0 = nv_rd32(gpio, 0x00e054); -- u32 intr1 = nv_rd32(gpio, 0x00e074); -- u32 stat0 = nv_rd32(gpio, 0x00e050) & intr0; -- u32 stat1 = nv_rd32(gpio, 0x00e070) & intr1; -- *lo = (stat1 & 0xffff0000) | (stat0 >> 16); -- *hi = (stat1 << 16) | (stat0 & 0x0000ffff); -- nv_wr32(gpio, 0x00e054, intr0); -- nv_wr32(gpio, 0x00e074, intr1); --} -- --void --nv92_gpio_intr_mask(struct nouveau_gpio *gpio, u32 type, u32 mask, u32 data) --{ -- u32 inte0 = nv_rd32(gpio, 0x00e050); -- u32 inte1 = nv_rd32(gpio, 0x00e070); -- if (type & NVKM_GPIO_LO) -- inte0 = (inte0 & ~(mask << 16)) | (data << 16); -- if (type & NVKM_GPIO_HI) -- inte0 = (inte0 & ~(mask & 0xffff)) | (data & 0xffff); -- mask >>= 16; -- data >>= 16; -- if (type & NVKM_GPIO_LO) -- inte1 = (inte1 & ~(mask << 16)) | (data << 16); -- if (type & NVKM_GPIO_HI) -- inte1 = (inte1 & ~mask) | data; -- nv_wr32(gpio, 0x00e050, inte0); -- nv_wr32(gpio, 0x00e070, inte1); --} -- --struct nouveau_oclass * --nv92_gpio_oclass = &(struct nouveau_gpio_impl) { -- .base.handle = NV_SUBDEV(GPIO, 0x92), -- .base.ofuncs = &(struct nouveau_ofuncs) { -- .ctor = _nouveau_gpio_ctor, -- .dtor = _nouveau_gpio_dtor, -- .init = _nouveau_gpio_init, -- .fini = _nouveau_gpio_fini, -- }, -- .lines = 32, -- .intr_stat = nv92_gpio_intr_stat, -- .intr_mask = nv92_gpio_intr_mask, -- .drive = nv50_gpio_drive, -- .sense = nv50_gpio_sense, -- .reset = nv50_gpio_reset, --}.base; -diff --git a/drivers/gpu/drm/nouveau/core/subdev/gpio/nv94.c b/drivers/gpu/drm/nouveau/core/subdev/gpio/nv94.c -new file mode 100644 -index 0000000..cae404c ---- /dev/null -+++ b/drivers/gpu/drm/nouveau/core/subdev/gpio/nv94.c -@@ -0,0 +1,74 @@ -+/* -+ * Copyright 2012 Red Hat Inc. -+ * -+ * Permission is hereby granted, free of charge, to any person obtaining a -+ * copy of this software and associated documentation files (the "Software"), -+ * to deal in the Software without restriction, including without limitation -+ * the rights to use, copy, modify, merge, publish, distribute, sublicense, -+ * and/or sell copies of the Software, and to permit persons to whom the -+ * Software is furnished to do so, subject to the following conditions: -+ * -+ * The above copyright notice and this permission notice shall be included in -+ * all copies or substantial portions of the Software. -+ * -+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL -+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR -+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, -+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR -+ * OTHER DEALINGS IN THE SOFTWARE. -+ * -+ * Authors: Ben Skeggs -+ */ -+ -+#include "priv.h" -+ -+void -+nv94_gpio_intr_stat(struct nouveau_gpio *gpio, u32 *hi, u32 *lo) -+{ -+ u32 intr0 = nv_rd32(gpio, 0x00e054); -+ u32 intr1 = nv_rd32(gpio, 0x00e074); -+ u32 stat0 = nv_rd32(gpio, 0x00e050) & intr0; -+ u32 stat1 = nv_rd32(gpio, 0x00e070) & intr1; -+ *lo = (stat1 & 0xffff0000) | (stat0 >> 16); -+ *hi = (stat1 << 16) | (stat0 & 0x0000ffff); -+ nv_wr32(gpio, 0x00e054, intr0); -+ nv_wr32(gpio, 0x00e074, intr1); -+} -+ -+void -+nv94_gpio_intr_mask(struct nouveau_gpio *gpio, u32 type, u32 mask, u32 data) -+{ -+ u32 inte0 = nv_rd32(gpio, 0x00e050); -+ u32 inte1 = nv_rd32(gpio, 0x00e070); -+ if (type & NVKM_GPIO_LO) -+ inte0 = (inte0 & ~(mask << 16)) | (data << 16); -+ if (type & NVKM_GPIO_HI) -+ inte0 = (inte0 & ~(mask & 0xffff)) | (data & 0xffff); -+ mask >>= 16; -+ data >>= 16; -+ if (type & NVKM_GPIO_LO) -+ inte1 = (inte1 & ~(mask << 16)) | (data << 16); -+ if (type & NVKM_GPIO_HI) -+ inte1 = (inte1 & ~mask) | data; -+ nv_wr32(gpio, 0x00e050, inte0); -+ nv_wr32(gpio, 0x00e070, inte1); -+} -+ -+struct nouveau_oclass * -+nv94_gpio_oclass = &(struct nouveau_gpio_impl) { -+ .base.handle = NV_SUBDEV(GPIO, 0x94), -+ .base.ofuncs = &(struct nouveau_ofuncs) { -+ .ctor = _nouveau_gpio_ctor, -+ .dtor = _nouveau_gpio_dtor, -+ .init = _nouveau_gpio_init, -+ .fini = _nouveau_gpio_fini, -+ }, -+ .lines = 32, -+ .intr_stat = nv94_gpio_intr_stat, -+ .intr_mask = nv94_gpio_intr_mask, -+ .drive = nv50_gpio_drive, -+ .sense = nv50_gpio_sense, -+ .reset = nv50_gpio_reset, -+}.base; -diff --git a/drivers/gpu/drm/nouveau/core/subdev/gpio/nvd0.c b/drivers/gpu/drm/nouveau/core/subdev/gpio/nvd0.c -index a4682b0..480d6d2 100644 ---- a/drivers/gpu/drm/nouveau/core/subdev/gpio/nvd0.c -+++ b/drivers/gpu/drm/nouveau/core/subdev/gpio/nvd0.c -@@ -77,8 +77,8 @@ nvd0_gpio_oclass = &(struct nouveau_gpio_impl) { - .fini = _nouveau_gpio_fini, - }, - .lines = 32, -- .intr_stat = nv92_gpio_intr_stat, -- .intr_mask = nv92_gpio_intr_mask, -+ .intr_stat = nv94_gpio_intr_stat, -+ .intr_mask = nv94_gpio_intr_mask, - .drive = nvd0_gpio_drive, - .sense = nvd0_gpio_sense, - .reset = nvd0_gpio_reset, -diff --git a/drivers/gpu/drm/nouveau/core/subdev/gpio/priv.h b/drivers/gpu/drm/nouveau/core/subdev/gpio/priv.h -index e1724df..bff98b8 100644 ---- a/drivers/gpu/drm/nouveau/core/subdev/gpio/priv.h -+++ b/drivers/gpu/drm/nouveau/core/subdev/gpio/priv.h -@@ -56,8 +56,8 @@ void nv50_gpio_reset(struct nouveau_gpio *, u8); - int nv50_gpio_drive(struct nouveau_gpio *, int, int, int); - int nv50_gpio_sense(struct nouveau_gpio *, int); - --void nv92_gpio_intr_stat(struct nouveau_gpio *, u32 *, u32 *); --void nv92_gpio_intr_mask(struct nouveau_gpio *, u32, u32, u32); -+void nv94_gpio_intr_stat(struct nouveau_gpio *, u32 *, u32 *); -+void nv94_gpio_intr_mask(struct nouveau_gpio *, u32, u32, u32); - - void nvd0_gpio_reset(struct nouveau_gpio *, u8); - int nvd0_gpio_drive(struct nouveau_gpio *, int, int, int); -diff --git a/drivers/gpu/drm/nouveau/nouveau_chan.c b/drivers/gpu/drm/nouveau/nouveau_chan.c -index 3440fc9..497ea01 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_chan.c -+++ b/drivers/gpu/drm/nouveau/nouveau_chan.c -@@ -400,15 +400,20 @@ nouveau_channel_new(struct nouveau_drm *drm, struct nvif_device *device, - struct nouveau_channel **pchan) - { - struct nouveau_cli *cli = (void *)nvif_client(&device->base); -+ bool super; - int ret; - -+ /* hack until fencenv50 is fixed, and agp access relaxed */ -+ super = cli->base.super; -+ cli->base.super = true; -+ - ret = nouveau_channel_ind(drm, device, handle, arg0, pchan); - if (ret) { - NV_PRINTK(debug, cli, "ib channel create, %d\n", ret); - ret = nouveau_channel_dma(drm, device, handle, pchan); - if (ret) { - NV_PRINTK(debug, cli, "dma channel create, %d\n", ret); -- return ret; -+ goto done; - } - } - -@@ -416,8 +421,9 @@ nouveau_channel_new(struct nouveau_drm *drm, struct nvif_device *device, - if (ret) { - NV_PRINTK(error, cli, "channel failed to initialise, %d\n", ret); - nouveau_channel_del(pchan); -- return ret; - } - -- return 0; -+done: -+ cli->base.super = super; -+ return ret; - } -diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c -index 03949ea..bca5d8c 100644 ---- a/drivers/gpu/drm/nouveau/nv50_display.c -+++ b/drivers/gpu/drm/nouveau/nv50_display.c -@@ -1653,15 +1653,17 @@ nv50_audio_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode) - struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder); - struct nouveau_connector *nv_connector; - struct nv50_disp *disp = nv50_disp(encoder->dev); -- struct { -- struct nv50_disp_mthd_v1 base; -- struct nv50_disp_sor_hda_eld_v0 eld; -+ struct __packed { -+ struct { -+ struct nv50_disp_mthd_v1 mthd; -+ struct nv50_disp_sor_hda_eld_v0 eld; -+ } base; - u8 data[sizeof(nv_connector->base.eld)]; - } args = { -- .base.version = 1, -- .base.method = NV50_DISP_MTHD_V1_SOR_HDA_ELD, -- .base.hasht = nv_encoder->dcb->hasht, -- .base.hashm = nv_encoder->dcb->hashm, -+ .base.mthd.version = 1, -+ .base.mthd.method = NV50_DISP_MTHD_V1_SOR_HDA_ELD, -+ .base.mthd.hasht = nv_encoder->dcb->hasht, -+ .base.mthd.hashm = nv_encoder->dcb->hashm, - }; - - nv_connector = nouveau_encoder_connector_get(nv_encoder); -@@ -1671,7 +1673,7 @@ nv50_audio_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode) - drm_edid_to_eld(&nv_connector->base, nv_connector->edid); - memcpy(args.data, nv_connector->base.eld, sizeof(args.data)); - -- nvif_mthd(disp->disp, 0, &args, sizeof(args)); -+ nvif_mthd(disp->disp, 0, &args, sizeof(args.base) + args.data[2] * 4); - } - - static void -diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c -index b8ced08..bac1fd4 100644 ---- a/drivers/gpu/drm/qxl/qxl_display.c -+++ b/drivers/gpu/drm/qxl/qxl_display.c -@@ -523,7 +523,6 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc, - struct qxl_framebuffer *qfb; - struct qxl_bo *bo, *old_bo = NULL; - struct qxl_crtc *qcrtc = to_qxl_crtc(crtc); -- uint32_t width, height, base_offset; - bool recreate_primary = false; - int ret; - int surf_id; -@@ -553,9 +552,10 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc, - if (qcrtc->index == 0) - recreate_primary = true; - -- width = mode->hdisplay; -- height = mode->vdisplay; -- base_offset = 0; -+ if (bo->surf.stride * bo->surf.height > qdev->vram_size) { -+ DRM_ERROR("Mode doesn't fit in vram size (vgamem)"); -+ return -EINVAL; -+ } - - ret = qxl_bo_reserve(bo, false); - if (ret != 0) -@@ -569,10 +569,10 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc, - if (recreate_primary) { - qxl_io_destroy_primary(qdev); - qxl_io_log(qdev, -- "recreate primary: %dx%d (was %dx%d,%d,%d)\n", -- width, height, bo->surf.width, -- bo->surf.height, bo->surf.stride, bo->surf.format); -- qxl_io_create_primary(qdev, base_offset, bo); -+ "recreate primary: %dx%d,%d,%d\n", -+ bo->surf.width, bo->surf.height, -+ bo->surf.stride, bo->surf.format); -+ qxl_io_create_primary(qdev, 0, bo); - bo->is_primary = true; - } - -diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c -index c4ffa54..e8eea36 100644 ---- a/drivers/gpu/drm/radeon/cik_sdma.c -+++ b/drivers/gpu/drm/radeon/cik_sdma.c -@@ -610,16 +610,19 @@ int cik_sdma_ring_test(struct radeon_device *rdev, - { - unsigned i; - int r; -- void __iomem *ptr = (void *)rdev->vram_scratch.ptr; -+ unsigned index; - u32 tmp; -+ u64 gpu_addr; - -- if (!ptr) { -- DRM_ERROR("invalid vram scratch pointer\n"); -- return -EINVAL; -- } -+ if (ring->idx == R600_RING_TYPE_DMA_INDEX) -+ index = R600_WB_DMA_RING_TEST_OFFSET; -+ else -+ index = CAYMAN_WB_DMA1_RING_TEST_OFFSET; -+ -+ gpu_addr = rdev->wb.gpu_addr + index; - - tmp = 0xCAFEDEAD; -- writel(tmp, ptr); -+ rdev->wb.wb[index/4] = cpu_to_le32(tmp); - - r = radeon_ring_lock(rdev, ring, 5); - if (r) { -@@ -627,14 +630,14 @@ int cik_sdma_ring_test(struct radeon_device *rdev, - return r; - } - radeon_ring_write(ring, SDMA_PACKET(SDMA_OPCODE_WRITE, SDMA_WRITE_SUB_OPCODE_LINEAR, 0)); -- radeon_ring_write(ring, rdev->vram_scratch.gpu_addr & 0xfffffffc); -- radeon_ring_write(ring, upper_32_bits(rdev->vram_scratch.gpu_addr)); -+ radeon_ring_write(ring, lower_32_bits(gpu_addr)); -+ radeon_ring_write(ring, upper_32_bits(gpu_addr)); - radeon_ring_write(ring, 1); /* number of DWs to follow */ - radeon_ring_write(ring, 0xDEADBEEF); - radeon_ring_unlock_commit(rdev, ring, false); - - for (i = 0; i < rdev->usec_timeout; i++) { -- tmp = readl(ptr); -+ tmp = le32_to_cpu(rdev->wb.wb[index/4]); - if (tmp == 0xDEADBEEF) - break; - DRM_UDELAY(1); -diff --git a/drivers/gpu/drm/radeon/dce3_1_afmt.c b/drivers/gpu/drm/radeon/dce3_1_afmt.c -index 51800e3..71f4d26 100644 ---- a/drivers/gpu/drm/radeon/dce3_1_afmt.c -+++ b/drivers/gpu/drm/radeon/dce3_1_afmt.c -@@ -49,8 +49,8 @@ static void dce3_2_afmt_write_speaker_allocation(struct drm_encoder *encoder) - - sad_count = drm_edid_to_speaker_allocation(radeon_connector->edid, &sadb); - if (sad_count < 0) { -- DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count); -- return; -+ DRM_DEBUG("Couldn't read Speaker Allocation Data Block: %d\n", sad_count); -+ sad_count = 0; - } - - /* program the speaker allocation */ -diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c -index ab29f95..790d8ca 100644 ---- a/drivers/gpu/drm/radeon/dce6_afmt.c -+++ b/drivers/gpu/drm/radeon/dce6_afmt.c -@@ -176,9 +176,9 @@ void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder) - } - - sad_count = drm_edid_to_speaker_allocation(radeon_connector_edid(connector), &sadb); -- if (sad_count <= 0) { -- DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count); -- return; -+ if (sad_count < 0) { -+ DRM_DEBUG("Couldn't read Speaker Allocation Data Block: %d\n", sad_count); -+ sad_count = 0; - } - - /* program the speaker allocation */ -diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c -index 278c7a1..71ebdf8 100644 ---- a/drivers/gpu/drm/radeon/evergreen_hdmi.c -+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c -@@ -118,9 +118,9 @@ static void dce4_afmt_write_speaker_allocation(struct drm_encoder *encoder) - } - - sad_count = drm_edid_to_speaker_allocation(radeon_connector_edid(connector), &sadb); -- if (sad_count <= 0) { -- DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count); -- return; -+ if (sad_count < 0) { -+ DRM_DEBUG("Couldn't read Speaker Allocation Data Block: %d\n", sad_count); -+ sad_count = 0; - } - - /* program the speaker allocation */ -diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c -index 67cb472..e79b7eb 100644 ---- a/drivers/gpu/drm/radeon/kv_dpm.c -+++ b/drivers/gpu/drm/radeon/kv_dpm.c -@@ -2725,7 +2725,11 @@ int kv_dpm_init(struct radeon_device *rdev) - - pi->sram_end = SMC_RAM_END; - -- pi->enable_nb_dpm = true; -+ /* Enabling nb dpm on an asrock system prevents dpm from working */ -+ if (rdev->pdev->subsystem_vendor == 0x1849) -+ pi->enable_nb_dpm = false; -+ else -+ pi->enable_nb_dpm = true; - - pi->caps_power_containment = true; - pi->caps_cac = true; -@@ -2740,10 +2744,19 @@ int kv_dpm_init(struct radeon_device *rdev) - pi->caps_sclk_ds = true; - pi->enable_auto_thermal_throttling = true; - pi->disable_nb_ps3_in_battery = false; -- if (radeon_bapm == 0) -+ if (radeon_bapm == -1) { -+ /* There are stability issues reported on with -+ * bapm enabled on an asrock system. -+ */ -+ if (rdev->pdev->subsystem_vendor == 0x1849) -+ pi->bapm_enable = false; -+ else -+ pi->bapm_enable = true; -+ } else if (radeon_bapm == 0) { - pi->bapm_enable = false; -- else -+ } else { - pi->bapm_enable = true; -+ } - pi->voltage_drop_t = 0; - pi->caps_sclk_throttle_low_notification = false; - pi->caps_fps = false; /* true? */ -diff --git a/drivers/gpu/drm/radeon/r600_dma.c b/drivers/gpu/drm/radeon/r600_dma.c -index a908daa..44379bf 100644 ---- a/drivers/gpu/drm/radeon/r600_dma.c -+++ b/drivers/gpu/drm/radeon/r600_dma.c -@@ -232,16 +232,19 @@ int r600_dma_ring_test(struct radeon_device *rdev, - { - unsigned i; - int r; -- void __iomem *ptr = (void *)rdev->vram_scratch.ptr; -+ unsigned index; - u32 tmp; -+ u64 gpu_addr; - -- if (!ptr) { -- DRM_ERROR("invalid vram scratch pointer\n"); -- return -EINVAL; -- } -+ if (ring->idx == R600_RING_TYPE_DMA_INDEX) -+ index = R600_WB_DMA_RING_TEST_OFFSET; -+ else -+ index = CAYMAN_WB_DMA1_RING_TEST_OFFSET; -+ -+ gpu_addr = rdev->wb.gpu_addr + index; - - tmp = 0xCAFEDEAD; -- writel(tmp, ptr); -+ rdev->wb.wb[index/4] = cpu_to_le32(tmp); - - r = radeon_ring_lock(rdev, ring, 4); - if (r) { -@@ -249,13 +252,13 @@ int r600_dma_ring_test(struct radeon_device *rdev, - return r; - } - radeon_ring_write(ring, DMA_PACKET(DMA_PACKET_WRITE, 0, 0, 1)); -- radeon_ring_write(ring, rdev->vram_scratch.gpu_addr & 0xfffffffc); -- radeon_ring_write(ring, upper_32_bits(rdev->vram_scratch.gpu_addr) & 0xff); -+ radeon_ring_write(ring, lower_32_bits(gpu_addr)); -+ radeon_ring_write(ring, upper_32_bits(gpu_addr) & 0xff); - radeon_ring_write(ring, 0xDEADBEEF); - radeon_ring_unlock_commit(rdev, ring, false); - - for (i = 0; i < rdev->usec_timeout; i++) { -- tmp = readl(ptr); -+ tmp = le32_to_cpu(rdev->wb.wb[index/4]); - if (tmp == 0xDEADBEEF) - break; - DRM_UDELAY(1); -diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h -index 3247bfd..e841058 100644 ---- a/drivers/gpu/drm/radeon/radeon.h -+++ b/drivers/gpu/drm/radeon/radeon.h -@@ -1120,6 +1120,8 @@ struct radeon_wb { - #define R600_WB_EVENT_OFFSET 3072 - #define CIK_WB_CP1_WPTR_OFFSET 3328 - #define CIK_WB_CP2_WPTR_OFFSET 3584 -+#define R600_WB_DMA_RING_TEST_OFFSET 3588 -+#define CAYMAN_WB_DMA1_RING_TEST_OFFSET 3592 - - /** - * struct radeon_pm - power management datas -diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c -index 83f382e..e244c2d 100644 ---- a/drivers/gpu/drm/radeon/radeon_cs.c -+++ b/drivers/gpu/drm/radeon/radeon_cs.c -@@ -418,7 +418,7 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error, bo - kfree(parser->track); - kfree(parser->relocs); - kfree(parser->relocs_ptr); -- kfree(parser->vm_bos); -+ drm_free_large(parser->vm_bos); - for (i = 0; i < parser->nchunks; i++) - drm_free_large(parser->chunks[i].kdata); - kfree(parser->chunks); -diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c -index 12c8329..6684fbf 100644 ---- a/drivers/gpu/drm/radeon/radeon_device.c -+++ b/drivers/gpu/drm/radeon/radeon_device.c -@@ -1130,7 +1130,7 @@ static void radeon_check_arguments(struct radeon_device *rdev) - if (radeon_vm_block_size == -1) { - - /* Total bits covered by PD + PTs */ -- unsigned bits = ilog2(radeon_vm_size) + 17; -+ unsigned bits = ilog2(radeon_vm_size) + 18; - - /* Make sure the PD is 4K in size up to 8GB address space. - Above that split equal between PD and PTs */ -diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c -index d656079..9323435 100644 ---- a/drivers/gpu/drm/radeon/radeon_ring.c -+++ b/drivers/gpu/drm/radeon/radeon_ring.c -@@ -335,7 +335,7 @@ unsigned radeon_ring_backup(struct radeon_device *rdev, struct radeon_ring *ring - } - - /* and then save the content of the ring */ -- *data = kmalloc_array(size, sizeof(uint32_t), GFP_KERNEL); -+ *data = drm_malloc_ab(size, sizeof(uint32_t)); - if (!*data) { - mutex_unlock(&rdev->ring_lock); - return 0; -@@ -377,7 +377,7 @@ int radeon_ring_restore(struct radeon_device *rdev, struct radeon_ring *ring, - } - - radeon_ring_unlock_commit(rdev, ring, false); -- kfree(data); -+ drm_free_large(data); - return 0; - } - -diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c -index 088ffdc..a3b3e09 100644 ---- a/drivers/gpu/drm/radeon/radeon_vm.c -+++ b/drivers/gpu/drm/radeon/radeon_vm.c -@@ -132,8 +132,8 @@ struct radeon_cs_reloc *radeon_vm_get_bos(struct radeon_device *rdev, - struct radeon_cs_reloc *list; - unsigned i, idx; - -- list = kmalloc_array(vm->max_pde_used + 2, -- sizeof(struct radeon_cs_reloc), GFP_KERNEL); -+ list = drm_malloc_ab(vm->max_pde_used + 2, -+ sizeof(struct radeon_cs_reloc)); - if (!list) - return NULL; - -diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c -index 70e61ff..1202e0f 100644 ---- a/drivers/gpu/drm/radeon/si_dpm.c -+++ b/drivers/gpu/drm/radeon/si_dpm.c -@@ -6255,7 +6255,7 @@ static void si_parse_pplib_clock_info(struct radeon_device *rdev, - if ((rps->class2 & ATOM_PPLIB_CLASSIFICATION2_ULV) && - index == 0) { - /* XXX disable for A0 tahiti */ -- si_pi->ulv.supported = true; -+ si_pi->ulv.supported = false; - si_pi->ulv.pl = *pl; - si_pi->ulv.one_pcie_lane_in_ulv = false; - si_pi->ulv.volt_change_delay = SISLANDS_ULVVOLTAGECHANGEDELAY_DFLT; -diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c -index 6be623b..000428e 100644 ---- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c -+++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c -@@ -84,6 +84,7 @@ static int modeset_init(struct drm_device *dev) - if ((priv->num_encoders == 0) || (priv->num_connectors == 0)) { - /* oh nos! */ - dev_err(dev->dev, "no encoders/connectors found\n"); -+ drm_mode_config_cleanup(dev); - return -ENXIO; - } - -@@ -172,33 +173,37 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) - dev->dev_private = priv; - - priv->wq = alloc_ordered_workqueue("tilcdc", 0); -+ if (!priv->wq) { -+ ret = -ENOMEM; -+ goto fail_free_priv; -+ } - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!res) { - dev_err(dev->dev, "failed to get memory resource\n"); - ret = -EINVAL; -- goto fail; -+ goto fail_free_wq; - } - - priv->mmio = ioremap_nocache(res->start, resource_size(res)); - if (!priv->mmio) { - dev_err(dev->dev, "failed to ioremap\n"); - ret = -ENOMEM; -- goto fail; -+ goto fail_free_wq; - } - - priv->clk = clk_get(dev->dev, "fck"); - if (IS_ERR(priv->clk)) { - dev_err(dev->dev, "failed to get functional clock\n"); - ret = -ENODEV; -- goto fail; -+ goto fail_iounmap; - } - - priv->disp_clk = clk_get(dev->dev, "dpll_disp_ck"); - if (IS_ERR(priv->clk)) { - dev_err(dev->dev, "failed to get display clock\n"); - ret = -ENODEV; -- goto fail; -+ goto fail_put_clk; - } - - #ifdef CONFIG_CPU_FREQ -@@ -208,7 +213,7 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) - CPUFREQ_TRANSITION_NOTIFIER); - if (ret) { - dev_err(dev->dev, "failed to register cpufreq notifier\n"); -- goto fail; -+ goto fail_put_disp_clk; - } - #endif - -@@ -253,13 +258,13 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) - ret = modeset_init(dev); - if (ret < 0) { - dev_err(dev->dev, "failed to initialize mode setting\n"); -- goto fail; -+ goto fail_cpufreq_unregister; - } - - ret = drm_vblank_init(dev, 1); - if (ret < 0) { - dev_err(dev->dev, "failed to initialize vblank\n"); -- goto fail; -+ goto fail_mode_config_cleanup; - } - - pm_runtime_get_sync(dev->dev); -@@ -267,7 +272,7 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) - pm_runtime_put_sync(dev->dev); - if (ret < 0) { - dev_err(dev->dev, "failed to install IRQ handler\n"); -- goto fail; -+ goto fail_vblank_cleanup; - } - - platform_set_drvdata(pdev, dev); -@@ -283,13 +288,48 @@ static int tilcdc_load(struct drm_device *dev, unsigned long flags) - priv->fbdev = drm_fbdev_cma_init(dev, bpp, - dev->mode_config.num_crtc, - dev->mode_config.num_connector); -+ if (IS_ERR(priv->fbdev)) { -+ ret = PTR_ERR(priv->fbdev); -+ goto fail_irq_uninstall; -+ } - - drm_kms_helper_poll_init(dev); - - return 0; - --fail: -- tilcdc_unload(dev); -+fail_irq_uninstall: -+ pm_runtime_get_sync(dev->dev); -+ drm_irq_uninstall(dev); -+ pm_runtime_put_sync(dev->dev); -+ -+fail_vblank_cleanup: -+ drm_vblank_cleanup(dev); -+ -+fail_mode_config_cleanup: -+ drm_mode_config_cleanup(dev); -+ -+fail_cpufreq_unregister: -+ pm_runtime_disable(dev->dev); -+#ifdef CONFIG_CPU_FREQ -+ cpufreq_unregister_notifier(&priv->freq_transition, -+ CPUFREQ_TRANSITION_NOTIFIER); -+fail_put_disp_clk: -+ clk_put(priv->disp_clk); -+#endif -+ -+fail_put_clk: -+ clk_put(priv->clk); -+ -+fail_iounmap: -+ iounmap(priv->mmio); -+ -+fail_free_wq: -+ flush_workqueue(priv->wq); -+ destroy_workqueue(priv->wq); -+ -+fail_free_priv: -+ dev->dev_private = NULL; -+ kfree(priv); - return ret; - } - -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -index 18b54ac..14b2f50 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -@@ -688,7 +688,11 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset) - goto out_err0; - } - -- if (unlikely(dev_priv->prim_bb_mem < dev_priv->vram_size)) -+ /* -+ * Limit back buffer size to VRAM size. Remove this once -+ * screen targets are implemented. -+ */ -+ if (dev_priv->prim_bb_mem > dev_priv->vram_size) - dev_priv->prim_bb_mem = dev_priv->vram_size; - - mutex_unlock(&dev_priv->hw_mutex); -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -index d2bc2b0..10fc4c3 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -@@ -1950,6 +1950,14 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector, - DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) - }; - int i; -+ u32 assumed_bpp = 2; -+ -+ /* -+ * If using screen objects, then assume 32-bpp because that's what the -+ * SVGA device is assuming -+ */ -+ if (dev_priv->sou_priv) -+ assumed_bpp = 4; - - /* Add preferred mode */ - { -@@ -1960,8 +1968,9 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector, - mode->vdisplay = du->pref_height; - vmw_guess_mode_timing(mode); - -- if (vmw_kms_validate_mode_vram(dev_priv, mode->hdisplay * 2, -- mode->vdisplay)) { -+ if (vmw_kms_validate_mode_vram(dev_priv, -+ mode->hdisplay * assumed_bpp, -+ mode->vdisplay)) { - drm_mode_probed_add(connector, mode); - } else { - drm_mode_destroy(dev, mode); -@@ -1983,7 +1992,8 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector, - bmode->vdisplay > max_height) - continue; - -- if (!vmw_kms_validate_mode_vram(dev_priv, bmode->hdisplay * 2, -+ if (!vmw_kms_validate_mode_vram(dev_priv, -+ bmode->hdisplay * assumed_bpp, - bmode->vdisplay)) - continue; - -diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c -index 84c3cb1..8bf61d2 100644 ---- a/drivers/hid/hid-debug.c -+++ b/drivers/hid/hid-debug.c -@@ -946,6 +946,12 @@ static const char *keys[KEY_MAX + 1] = { - [KEY_BRIGHTNESS_MIN] = "BrightnessMin", - [KEY_BRIGHTNESS_MAX] = "BrightnessMax", - [KEY_BRIGHTNESS_AUTO] = "BrightnessAuto", -+ [KEY_KBDINPUTASSIST_PREV] = "KbdInputAssistPrev", -+ [KEY_KBDINPUTASSIST_NEXT] = "KbdInputAssistNext", -+ [KEY_KBDINPUTASSIST_PREVGROUP] = "KbdInputAssistPrevGroup", -+ [KEY_KBDINPUTASSIST_NEXTGROUP] = "KbdInputAssistNextGroup", -+ [KEY_KBDINPUTASSIST_ACCEPT] = "KbdInputAssistAccept", -+ [KEY_KBDINPUTASSIST_CANCEL] = "KbdInputAssistCancel", - }; - - static const char *relatives[REL_MAX + 1] = { -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 25cd674..c3a712c 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -296,6 +296,11 @@ - #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7 - #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001 - -+#define USB_VENDOR_ID_ELAN 0x04f3 -+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN 0x0089 -+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B 0x009b -+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F 0x016f -+ - #define USB_VENDOR_ID_ELECOM 0x056e - #define USB_DEVICE_ID_ELECOM_BM084 0x0061 - -@@ -733,6 +738,8 @@ - #define USB_DEVICE_ID_PI_ENGINEERING_VEC_USB_FOOTPEDAL 0xff - - #define USB_VENDOR_ID_PIXART 0x093a -+#define USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE_ID2 0x0137 -+#define USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE 0x2510 - #define USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN 0x8001 - #define USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1 0x8002 - #define USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2 0x8003 -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index 2619f7f..62e8286 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -689,7 +689,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel - break; - - case 0x5b: /* TransducerSerialNumber */ -- set_bit(MSC_SERIAL, input->mscbit); -+ usage->type = EV_MSC; -+ usage->code = MSC_SERIAL; -+ bit = input->mscbit; -+ max = MSC_MAX; - break; - - default: goto unknown; -@@ -856,6 +859,13 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel - case 0x28b: map_key_clear(KEY_FORWARDMAIL); break; - case 0x28c: map_key_clear(KEY_SEND); break; - -+ case 0x2c7: map_key_clear(KEY_KBDINPUTASSIST_PREV); break; -+ case 0x2c8: map_key_clear(KEY_KBDINPUTASSIST_NEXT); break; -+ case 0x2c9: map_key_clear(KEY_KBDINPUTASSIST_PREVGROUP); break; -+ case 0x2ca: map_key_clear(KEY_KBDINPUTASSIST_NEXTGROUP); break; -+ case 0x2cb: map_key_clear(KEY_KBDINPUTASSIST_ACCEPT); break; -+ case 0x2cc: map_key_clear(KEY_KBDINPUTASSIST_CANCEL); break; -+ - default: goto ignore; - } - break; -diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c -index 79cf503..ddd547a 100644 ---- a/drivers/hid/usbhid/hid-core.c -+++ b/drivers/hid/usbhid/hid-core.c -@@ -82,7 +82,7 @@ static int hid_start_in(struct hid_device *hid) - struct usbhid_device *usbhid = hid->driver_data; - - spin_lock_irqsave(&usbhid->lock, flags); -- if (hid->open > 0 && -+ if ((hid->open > 0 || hid->quirks & HID_QUIRK_ALWAYS_POLL) && - !test_bit(HID_DISCONNECTED, &usbhid->iofl) && - !test_bit(HID_SUSPENDED, &usbhid->iofl) && - !test_and_set_bit(HID_IN_RUNNING, &usbhid->iofl)) { -@@ -292,6 +292,8 @@ static void hid_irq_in(struct urb *urb) - case 0: /* success */ - usbhid_mark_busy(usbhid); - usbhid->retry_delay = 0; -+ if ((hid->quirks & HID_QUIRK_ALWAYS_POLL) && !hid->open) -+ break; - hid_input_report(urb->context, HID_INPUT_REPORT, - urb->transfer_buffer, - urb->actual_length, 1); -@@ -735,8 +737,10 @@ void usbhid_close(struct hid_device *hid) - if (!--hid->open) { - spin_unlock_irq(&usbhid->lock); - hid_cancel_delayed_stuff(usbhid); -- usb_kill_urb(usbhid->urbin); -- usbhid->intf->needs_remote_wakeup = 0; -+ if (!(hid->quirks & HID_QUIRK_ALWAYS_POLL)) { -+ usb_kill_urb(usbhid->urbin); -+ usbhid->intf->needs_remote_wakeup = 0; -+ } - } else { - spin_unlock_irq(&usbhid->lock); - } -@@ -1134,6 +1138,19 @@ static int usbhid_start(struct hid_device *hid) - - set_bit(HID_STARTED, &usbhid->iofl); - -+ if (hid->quirks & HID_QUIRK_ALWAYS_POLL) { -+ ret = usb_autopm_get_interface(usbhid->intf); -+ if (ret) -+ goto fail; -+ usbhid->intf->needs_remote_wakeup = 1; -+ ret = hid_start_in(hid); -+ if (ret) { -+ dev_err(&hid->dev, -+ "failed to start in urb: %d\n", ret); -+ } -+ usb_autopm_put_interface(usbhid->intf); -+ } -+ - /* Some keyboards don't work until their LEDs have been set. - * Since BIOSes do set the LEDs, it must be safe for any device - * that supports the keyboard boot protocol. -@@ -1166,6 +1183,9 @@ static void usbhid_stop(struct hid_device *hid) - if (WARN_ON(!usbhid)) - return; - -+ if (hid->quirks & HID_QUIRK_ALWAYS_POLL) -+ usbhid->intf->needs_remote_wakeup = 0; -+ - clear_bit(HID_STARTED, &usbhid->iofl); - spin_lock_irq(&usbhid->lock); /* Sync with error and led handlers */ - set_bit(HID_DISCONNECTED, &usbhid->iofl); -diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c -index 15225f3..5014bb5 100644 ---- a/drivers/hid/usbhid/hid-quirks.c -+++ b/drivers/hid/usbhid/hid-quirks.c -@@ -70,6 +70,9 @@ static const struct hid_blacklist { - { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET }, -+ { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL }, -+ { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL }, -+ { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F, HID_QUIRK_ALWAYS_POLL }, - { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS }, - { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET }, -@@ -79,6 +82,8 @@ static const struct hid_blacklist { - { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS }, - { USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_1610, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_1640, HID_QUIRK_NOGET }, -+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL }, -+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE_ID2, HID_QUIRK_ALWAYS_POLL }, - { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS }, - { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS }, - { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2, HID_QUIRK_NO_INIT_REPORTS }, -diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c -index 917d545..e05a672 100644 ---- a/drivers/i2c/busses/i2c-at91.c -+++ b/drivers/i2c/busses/i2c-at91.c -@@ -434,7 +434,7 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) - } - } - -- ret = wait_for_completion_io_timeout(&dev->cmd_complete, -+ ret = wait_for_completion_timeout(&dev->cmd_complete, - dev->adapter.timeout); - if (ret == 0) { - dev_err(dev->dev, "controller timed out\n"); -diff --git a/drivers/iio/common/st_sensors/st_sensors_buffer.c b/drivers/iio/common/st_sensors/st_sensors_buffer.c -index 1665c8e..e18bc67 100644 ---- a/drivers/iio/common/st_sensors/st_sensors_buffer.c -+++ b/drivers/iio/common/st_sensors/st_sensors_buffer.c -@@ -71,7 +71,7 @@ int st_sensors_get_buffer_element(struct iio_dev *indio_dev, u8 *buf) - goto st_sensors_free_memory; - } - -- for (i = 0; i < n * num_data_channels; i++) { -+ for (i = 0; i < n * byte_for_channel; i++) { - if (i < n) - buf[i] = rx_array[i]; - else -diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c -index 5e780ef..8349cc0 100644 ---- a/drivers/iio/proximity/as3935.c -+++ b/drivers/iio/proximity/as3935.c -@@ -330,7 +330,7 @@ static int as3935_probe(struct spi_device *spi) - return -EINVAL; - } - -- indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(st)); -+ indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*st)); - if (!indio_dev) - return -ENOMEM; - -diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c -index bda5994..8b72cf3 100644 ---- a/drivers/infiniband/hw/mlx4/main.c -+++ b/drivers/infiniband/hw/mlx4/main.c -@@ -1173,18 +1173,24 @@ static struct ib_flow *mlx4_ib_create_flow(struct ib_qp *qp, - err = __mlx4_ib_create_flow(qp, flow_attr, domain, type[i], - &mflow->reg_id[i]); - if (err) -- goto err_free; -+ goto err_create_flow; - i++; - } - - if (i < ARRAY_SIZE(type) && flow_attr->type == IB_FLOW_ATTR_NORMAL) { - err = mlx4_ib_tunnel_steer_add(qp, flow_attr, &mflow->reg_id[i]); - if (err) -- goto err_free; -+ goto err_create_flow; -+ i++; - } - - return &mflow->ibflow; - -+err_create_flow: -+ while (i) { -+ (void)__mlx4_ib_destroy_flow(to_mdev(qp->device)->dev, mflow->reg_id[i]); -+ i--; -+ } - err_free: - kfree(mflow); - return ERR_PTR(err); -diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c -index da8ff12..4d35bc7 100644 ---- a/drivers/infiniband/ulp/isert/ib_isert.c -+++ b/drivers/infiniband/ulp/isert/ib_isert.c -@@ -2185,7 +2185,7 @@ isert_put_response(struct iscsi_conn *conn, struct iscsi_cmd *cmd) - isert_cmd->tx_desc.num_sge = 2; - } - -- isert_init_send_wr(isert_conn, isert_cmd, send_wr, true); -+ isert_init_send_wr(isert_conn, isert_cmd, send_wr, false); - - pr_debug("Posting SCSI Response IB_WR_SEND >>>>>>>>>>>>>>>>>>>>>>\n"); - -@@ -2884,7 +2884,7 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd) - &isert_cmd->tx_desc.iscsi_header); - isert_init_tx_hdrs(isert_conn, &isert_cmd->tx_desc); - isert_init_send_wr(isert_conn, isert_cmd, -- &isert_cmd->tx_desc.send_wr, true); -+ &isert_cmd->tx_desc.send_wr, false); - isert_cmd->rdma_wr.s_send_wr.next = &isert_cmd->tx_desc.send_wr; - wr->send_wr_num += 1; - } -diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c -index 35a49bf..2b0ae8c 100644 ---- a/drivers/input/mouse/alps.c -+++ b/drivers/input/mouse/alps.c -@@ -835,8 +835,8 @@ static void alps_process_packet_v4(struct psmouse *psmouse) - f->fingers = alps_process_bitmap(priv, f); - } - -- f->left = packet[4] & 0x01; -- f->right = packet[4] & 0x02; -+ f->left = !!(packet[4] & 0x01); -+ f->right = !!(packet[4] & 0x02); - - f->st.x = ((packet[1] & 0x7f) << 4) | ((packet[3] & 0x30) >> 2) | - ((packet[0] & 0x30) >> 4); -diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c -index fd23181..b5b630c 100644 ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -618,6 +618,8 @@ static void synaptics_parse_agm(const unsigned char buf[], - priv->agm_pending = true; - } - -+static bool is_forcepad; -+ - static int synaptics_parse_hw_state(const unsigned char buf[], - struct synaptics_data *priv, - struct synaptics_hw_state *hw) -@@ -647,7 +649,7 @@ static int synaptics_parse_hw_state(const unsigned char buf[], - hw->left = (buf[0] & 0x01) ? 1 : 0; - hw->right = (buf[0] & 0x02) ? 1 : 0; - -- if (SYN_CAP_FORCEPAD(priv->ext_cap_0c)) { -+ if (is_forcepad) { - /* - * ForcePads, like Clickpads, use middle button - * bits to report primary button clicks. -@@ -1678,11 +1680,29 @@ static const struct dmi_system_id __initconst cr48_dmi_table[] = { - { } - }; - -+static const struct dmi_system_id forcepad_dmi_table[] __initconst = { -+#if defined(CONFIG_DMI) && defined(CONFIG_X86) -+ { -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook Folio 1040 G1"), -+ }, -+ }, -+#endif -+ { } -+}; -+ - void __init synaptics_module_init(void) - { - impaired_toshiba_kbc = dmi_check_system(toshiba_dmi_table); - broken_olpc_ec = dmi_check_system(olpc_dmi_table); - cr48_profile_sensor = dmi_check_system(cr48_dmi_table); -+ -+ /* -+ * Unfortunately ForcePad capability is not exported over PS/2, -+ * so we have to resort to checking DMI. -+ */ -+ is_forcepad = dmi_check_system(forcepad_dmi_table); - } - - static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode) -diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h -index fb2e076..1bd01f2 100644 ---- a/drivers/input/mouse/synaptics.h -+++ b/drivers/input/mouse/synaptics.h -@@ -77,12 +77,9 @@ - * for noise. - * 2 0x08 image sensor image sensor tracks 5 fingers, but only - * reports 2. -+ * 2 0x01 uniform clickpad whole clickpad moves instead of being -+ * hinged at the top. - * 2 0x20 report min query 0x0f gives min coord reported -- * 2 0x80 forcepad forcepad is a variant of clickpad that -- * does not have physical buttons but rather -- * uses pressure above certain threshold to -- * report primary clicks. Forcepads also have -- * clickpad bit set. - */ - #define SYN_CAP_CLICKPAD(ex0c) ((ex0c) & 0x100000) /* 1-button ClickPad */ - #define SYN_CAP_CLICKPAD2BTN(ex0c) ((ex0c) & 0x000100) /* 2-button ClickPad */ -@@ -91,7 +88,6 @@ - #define SYN_CAP_ADV_GESTURE(ex0c) ((ex0c) & 0x080000) - #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400) - #define SYN_CAP_IMAGE_SENSOR(ex0c) ((ex0c) & 0x000800) --#define SYN_CAP_FORCEPAD(ex0c) ((ex0c) & 0x008000) - - /* synaptics modes query bits */ - #define SYN_MODE_ABSOLUTE(m) ((m) & (1 << 7)) -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index 40b7d6c..faeeb13 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -101,6 +101,12 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = { - }, - { - .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "X750LN"), -+ }, -+ }, -+ { -+ .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Compaq"), - DMI_MATCH(DMI_PRODUCT_NAME , "ProLiant"), - DMI_MATCH(DMI_PRODUCT_VERSION, "8500"), -@@ -623,6 +629,22 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { - }, - }, - { -+ /* Fujitsu A544 laptop */ -+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK A544"), -+ }, -+ }, -+ { -+ /* Fujitsu AH544 laptop */ -+ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"), -+ }, -+ }, -+ { - /* Fujitsu U574 laptop */ - /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ - .matches = { -diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c -index ecb0109..5aff937 100644 ---- a/drivers/iommu/amd_iommu.c -+++ b/drivers/iommu/amd_iommu.c -@@ -260,17 +260,13 @@ static bool check_device(struct device *dev) - return true; - } - --static int init_iommu_group(struct device *dev) -+static void init_iommu_group(struct device *dev) - { - struct iommu_group *group; - - group = iommu_group_get_for_dev(dev); -- -- if (IS_ERR(group)) -- return PTR_ERR(group); -- -- iommu_group_put(group); -- return 0; -+ if (!IS_ERR(group)) -+ iommu_group_put(group); - } - - static int __last_alias(struct pci_dev *pdev, u16 alias, void *data) -@@ -340,7 +336,6 @@ static int iommu_init_device(struct device *dev) - struct pci_dev *pdev = to_pci_dev(dev); - struct iommu_dev_data *dev_data; - u16 alias; -- int ret; - - if (dev->archdata.iommu) - return 0; -@@ -364,12 +359,6 @@ static int iommu_init_device(struct device *dev) - dev_data->alias_data = alias_data; - } - -- ret = init_iommu_group(dev); -- if (ret) { -- free_dev_data(dev_data); -- return ret; -- } -- - if (pci_iommuv2_capable(pdev)) { - struct amd_iommu *iommu; - -@@ -455,6 +444,15 @@ int __init amd_iommu_init_devices(void) - goto out_free; - } - -+ /* -+ * Initialize IOMMU groups only after iommu_init_device() has -+ * had a chance to populate any IVRS defined aliases. -+ */ -+ for_each_pci_dev(pdev) { -+ if (check_device(&pdev->dev)) -+ init_iommu_group(&pdev->dev); -+ } -+ - return 0; - - out_free: -@@ -2415,6 +2413,7 @@ static int device_change_notifier(struct notifier_block *nb, - case BUS_NOTIFY_ADD_DEVICE: - - iommu_init_device(dev); -+ init_iommu_group(dev); - - /* - * dev_data is still NULL and -diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c -index 0639b92..690818d 100644 ---- a/drivers/iommu/iommu.c -+++ b/drivers/iommu/iommu.c -@@ -30,6 +30,7 @@ - #include <linux/notifier.h> - #include <linux/err.h> - #include <linux/pci.h> -+#include <linux/bitops.h> - #include <trace/events/iommu.h> - - static struct kset *iommu_group_kset; -@@ -519,6 +520,9 @@ int iommu_group_id(struct iommu_group *group) - } - EXPORT_SYMBOL_GPL(iommu_group_id); - -+static struct iommu_group *get_pci_alias_group(struct pci_dev *pdev, -+ unsigned long *devfns); -+ - /* - * To consider a PCI device isolated, we require ACS to support Source - * Validation, Request Redirection, Completer Redirection, and Upstream -@@ -529,6 +533,86 @@ EXPORT_SYMBOL_GPL(iommu_group_id); - */ - #define REQ_ACS_FLAGS (PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF) - -+/* -+ * For multifunction devices which are not isolated from each other, find -+ * all the other non-isolated functions and look for existing groups. For -+ * each function, we also need to look for aliases to or from other devices -+ * that may already have a group. -+ */ -+static struct iommu_group *get_pci_function_alias_group(struct pci_dev *pdev, -+ unsigned long *devfns) -+{ -+ struct pci_dev *tmp = NULL; -+ struct iommu_group *group; -+ -+ if (!pdev->multifunction || pci_acs_enabled(pdev, REQ_ACS_FLAGS)) -+ return NULL; -+ -+ for_each_pci_dev(tmp) { -+ if (tmp == pdev || tmp->bus != pdev->bus || -+ PCI_SLOT(tmp->devfn) != PCI_SLOT(pdev->devfn) || -+ pci_acs_enabled(tmp, REQ_ACS_FLAGS)) -+ continue; -+ -+ group = get_pci_alias_group(tmp, devfns); -+ if (group) { -+ pci_dev_put(tmp); -+ return group; -+ } -+ } -+ -+ return NULL; -+} -+ -+/* -+ * Look for aliases to or from the given device for exisiting groups. The -+ * dma_alias_devfn only supports aliases on the same bus, therefore the search -+ * space is quite small (especially since we're really only looking at pcie -+ * device, and therefore only expect multiple slots on the root complex or -+ * downstream switch ports). It's conceivable though that a pair of -+ * multifunction devices could have aliases between them that would cause a -+ * loop. To prevent this, we use a bitmap to track where we've been. -+ */ -+static struct iommu_group *get_pci_alias_group(struct pci_dev *pdev, -+ unsigned long *devfns) -+{ -+ struct pci_dev *tmp = NULL; -+ struct iommu_group *group; -+ -+ if (test_and_set_bit(pdev->devfn & 0xff, devfns)) -+ return NULL; -+ -+ group = iommu_group_get(&pdev->dev); -+ if (group) -+ return group; -+ -+ for_each_pci_dev(tmp) { -+ if (tmp == pdev || tmp->bus != pdev->bus) -+ continue; -+ -+ /* We alias them or they alias us */ -+ if (((pdev->dev_flags & PCI_DEV_FLAGS_DMA_ALIAS_DEVFN) && -+ pdev->dma_alias_devfn == tmp->devfn) || -+ ((tmp->dev_flags & PCI_DEV_FLAGS_DMA_ALIAS_DEVFN) && -+ tmp->dma_alias_devfn == pdev->devfn)) { -+ -+ group = get_pci_alias_group(tmp, devfns); -+ if (group) { -+ pci_dev_put(tmp); -+ return group; -+ } -+ -+ group = get_pci_function_alias_group(tmp, devfns); -+ if (group) { -+ pci_dev_put(tmp); -+ return group; -+ } -+ } -+ } -+ -+ return NULL; -+} -+ - struct group_for_pci_data { - struct pci_dev *pdev; - struct iommu_group *group; -@@ -557,7 +641,7 @@ static struct iommu_group *iommu_group_get_for_pci_dev(struct pci_dev *pdev) - struct group_for_pci_data data; - struct pci_bus *bus; - struct iommu_group *group = NULL; -- struct pci_dev *tmp; -+ u64 devfns[4] = { 0 }; - - /* - * Find the upstream DMA alias for the device. A device must not -@@ -591,76 +675,21 @@ static struct iommu_group *iommu_group_get_for_pci_dev(struct pci_dev *pdev) - } - - /* -- * Next we need to consider DMA alias quirks. If one device aliases -- * to another, they should be grouped together. It's theoretically -- * possible that aliases could create chains of devices where each -- * device aliases another device. If we then factor in multifunction -- * ACS grouping requirements, each alias could incorporate a new slot -- * with multiple functions, each with aliases. This is all extremely -- * unlikely as DMA alias quirks are typically only used for PCIe -- * devices where we usually have a single slot per bus. Furthermore, -- * the alias quirk is usually to another function within the slot -- * (and ACS multifunction is not supported) or to a different slot -- * that doesn't physically exist. The likely scenario is therefore -- * that everything on the bus gets grouped together. To reduce the -- * problem space, share the IOMMU group for all devices on the bus -- * if a DMA alias quirk is present on the bus. -- */ -- tmp = NULL; -- for_each_pci_dev(tmp) { -- if (tmp->bus != pdev->bus || -- !(tmp->dev_flags & PCI_DEV_FLAGS_DMA_ALIAS_DEVFN)) -- continue; -- -- pci_dev_put(tmp); -- tmp = NULL; -- -- /* We have an alias quirk, search for an existing group */ -- for_each_pci_dev(tmp) { -- struct iommu_group *group_tmp; -- -- if (tmp->bus != pdev->bus) -- continue; -- -- group_tmp = iommu_group_get(&tmp->dev); -- if (!group) { -- group = group_tmp; -- continue; -- } -- -- if (group_tmp) { -- WARN_ON(group != group_tmp); -- iommu_group_put(group_tmp); -- } -- } -- -- return group ? group : iommu_group_alloc(); -- } -- -- /* -- * Non-multifunction devices or multifunction devices supporting -- * ACS get their own group. -+ * Look for existing groups on device aliases. If we alias another -+ * device or another device aliases us, use the same group. - */ -- if (!pdev->multifunction || pci_acs_enabled(pdev, REQ_ACS_FLAGS)) -- return iommu_group_alloc(); -+ group = get_pci_alias_group(pdev, (unsigned long *)devfns); -+ if (group) -+ return group; - - /* -- * Multifunction devices not supporting ACS share a group with other -- * similar devices in the same slot. -+ * Look for existing groups on non-isolated functions on the same -+ * slot and aliases of those funcions, if any. No need to clear -+ * the search bitmap, the tested devfns are still valid. - */ -- tmp = NULL; -- for_each_pci_dev(tmp) { -- if (tmp == pdev || tmp->bus != pdev->bus || -- PCI_SLOT(tmp->devfn) != PCI_SLOT(pdev->devfn) || -- pci_acs_enabled(tmp, REQ_ACS_FLAGS)) -- continue; -- -- group = iommu_group_get(&tmp->dev); -- if (group) { -- pci_dev_put(tmp); -- return group; -- } -- } -+ group = get_pci_function_alias_group(pdev, (unsigned long *)devfns); -+ if (group) -+ return group; - - /* No shared group found, allocate new */ - return iommu_group_alloc(); -diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c -index 574aba0..1cb538f 100644 ---- a/drivers/irqchip/irq-armada-370-xp.c -+++ b/drivers/irqchip/irq-armada-370-xp.c -@@ -43,6 +43,7 @@ - #define ARMADA_370_XP_INT_CLEAR_ENABLE_OFFS (0x34) - #define ARMADA_370_XP_INT_SOURCE_CTL(irq) (0x100 + irq*4) - #define ARMADA_370_XP_INT_SOURCE_CPU_MASK 0xF -+#define ARMADA_370_XP_INT_IRQ_FIQ_MASK(cpuid) ((BIT(0) | BIT(8)) << cpuid) - - #define ARMADA_370_XP_CPU_INTACK_OFFS (0x44) - #define ARMADA_375_PPI_CAUSE (0x10) -@@ -410,19 +411,29 @@ static void armada_370_xp_mpic_handle_cascade_irq(unsigned int irq, - struct irq_desc *desc) - { - struct irq_chip *chip = irq_get_chip(irq); -- unsigned long irqmap, irqn; -+ unsigned long irqmap, irqn, irqsrc, cpuid; - unsigned int cascade_irq; - - chained_irq_enter(chip, desc); - - irqmap = readl_relaxed(per_cpu_int_base + ARMADA_375_PPI_CAUSE); -- -- if (irqmap & BIT(0)) { -- armada_370_xp_handle_msi_irq(NULL, true); -- irqmap &= ~BIT(0); -- } -+ cpuid = cpu_logical_map(smp_processor_id()); - - for_each_set_bit(irqn, &irqmap, BITS_PER_LONG) { -+ irqsrc = readl_relaxed(main_int_base + -+ ARMADA_370_XP_INT_SOURCE_CTL(irqn)); -+ -+ /* Check if the interrupt is not masked on current CPU. -+ * Test IRQ (0-1) and FIQ (8-9) mask bits. -+ */ -+ if (!(irqsrc & ARMADA_370_XP_INT_IRQ_FIQ_MASK(cpuid))) -+ continue; -+ -+ if (irqn == 1) { -+ armada_370_xp_handle_msi_irq(NULL, true); -+ continue; -+ } -+ - cascade_irq = irq_find_mapping(armada_370_xp_mpic_domain, irqn); - generic_handle_irq(cascade_irq); - } -diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c -index ab472c5..9ea5b60 100644 ---- a/drivers/md/dm-bufio.c -+++ b/drivers/md/dm-bufio.c -@@ -465,6 +465,7 @@ static void __relink_lru(struct dm_buffer *b, int dirty) - c->n_buffers[dirty]++; - b->list_mode = dirty; - list_move(&b->lru_list, &c->lru[dirty]); -+ b->last_accessed = jiffies; - } - - /*---------------------------------------------------------------- -@@ -1472,9 +1473,9 @@ static long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan, - list_for_each_entry_safe_reverse(b, tmp, &c->lru[l], lru_list) { - freed += __cleanup_old_buffer(b, gfp_mask, 0); - if (!--nr_to_scan) -- break; -+ return freed; -+ dm_bufio_cond_resched(); - } -- dm_bufio_cond_resched(); - } - return freed; - } -diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c -index b428c0a..39ad966 100644 ---- a/drivers/md/dm-log-userspace-transfer.c -+++ b/drivers/md/dm-log-userspace-transfer.c -@@ -272,7 +272,7 @@ int dm_ulog_tfr_init(void) - - r = cn_add_callback(&ulog_cn_id, "dmlogusr", cn_ulog_callback); - if (r) { -- cn_del_callback(&ulog_cn_id); -+ kfree(prealloced_cn_msg); - return r; - } - -diff --git a/drivers/media/common/siano/sms-cards.c b/drivers/media/common/siano/sms-cards.c -index 8276999..82c7a12 100644 ---- a/drivers/media/common/siano/sms-cards.c -+++ b/drivers/media/common/siano/sms-cards.c -@@ -157,6 +157,12 @@ static struct sms_board sms_boards[] = { - .type = SMS_DENVER_2160, - .default_mode = DEVICE_MODE_DAB_TDMB, - }, -+ [SMS1XXX_BOARD_PCTV_77E] = { -+ .name = "Hauppauge microStick 77e", -+ .type = SMS_NOVA_B0, -+ .fw[DEVICE_MODE_DVBT_BDA] = SMS_FW_DVB_NOVA_12MHZ_B0, -+ .default_mode = DEVICE_MODE_DVBT_BDA, -+ }, - }; - - struct sms_board *sms_get_board(unsigned id) -diff --git a/drivers/media/common/siano/sms-cards.h b/drivers/media/common/siano/sms-cards.h -index c63b544..4c4cadd 100644 ---- a/drivers/media/common/siano/sms-cards.h -+++ b/drivers/media/common/siano/sms-cards.h -@@ -45,6 +45,7 @@ - #define SMS1XXX_BOARD_SIANO_RIO 18 - #define SMS1XXX_BOARD_SIANO_DENVER_1530 19 - #define SMS1XXX_BOARD_SIANO_DENVER_2160 20 -+#define SMS1XXX_BOARD_PCTV_77E 21 - - struct sms_board_gpio_cfg { - int lna_vhf_exist; -diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c -index 335daef..9d0d034 100644 ---- a/drivers/media/dvb-frontends/ds3000.c -+++ b/drivers/media/dvb-frontends/ds3000.c -@@ -864,6 +864,13 @@ struct dvb_frontend *ds3000_attach(const struct ds3000_config *config, - memcpy(&state->frontend.ops, &ds3000_ops, - sizeof(struct dvb_frontend_ops)); - state->frontend.demodulator_priv = state; -+ -+ /* -+ * Some devices like T480 starts with voltage on. Be sure -+ * to turn voltage off during init, as this can otherwise -+ * interfere with Unicable SCR systems. -+ */ -+ ds3000_set_voltage(&state->frontend, SEC_VOLTAGE_OFF); - return &state->frontend; - - error3: -diff --git a/drivers/media/i2c/tda7432.c b/drivers/media/i2c/tda7432.c -index 72af644..cf93021 100644 ---- a/drivers/media/i2c/tda7432.c -+++ b/drivers/media/i2c/tda7432.c -@@ -293,7 +293,7 @@ static int tda7432_s_ctrl(struct v4l2_ctrl *ctrl) - if (t->mute->val) { - lf |= TDA7432_MUTE; - lr |= TDA7432_MUTE; -- lf |= TDA7432_MUTE; -+ rf |= TDA7432_MUTE; - rr |= TDA7432_MUTE; - } - /* Mute & update balance*/ -diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig -index 6d86646..5d666af2 100644 ---- a/drivers/media/platform/Kconfig -+++ b/drivers/media/platform/Kconfig -@@ -158,7 +158,7 @@ config VIDEO_MEM2MEM_DEINTERLACE - - config VIDEO_SAMSUNG_S5P_G2D - tristate "Samsung S5P and EXYNOS4 G2D 2d graphics accelerator driver" -- depends on VIDEO_DEV && VIDEO_V4L2 && (PLAT_S5P || ARCH_EXYNOS) -+ depends on VIDEO_DEV && VIDEO_V4L2 && (ARCH_S5PV210 || ARCH_EXYNOS) - select VIDEOBUF2_DMA_CONTIG - select V4L2_MEM2MEM_DEV - default n -@@ -168,7 +168,7 @@ config VIDEO_SAMSUNG_S5P_G2D - - config VIDEO_SAMSUNG_S5P_JPEG - tristate "Samsung S5P/Exynos3250/Exynos4 JPEG codec driver" -- depends on VIDEO_DEV && VIDEO_V4L2 && (PLAT_S5P || ARCH_EXYNOS) -+ depends on VIDEO_DEV && VIDEO_V4L2 && (ARCH_S5PV210 || ARCH_EXYNOS) - select VIDEOBUF2_DMA_CONTIG - select V4L2_MEM2MEM_DEV - ---help--- -@@ -177,7 +177,7 @@ config VIDEO_SAMSUNG_S5P_JPEG - - config VIDEO_SAMSUNG_S5P_MFC - tristate "Samsung S5P MFC Video Codec" -- depends on VIDEO_DEV && VIDEO_V4L2 && (PLAT_S5P || ARCH_EXYNOS) -+ depends on VIDEO_DEV && VIDEO_V4L2 && (ARCH_S5PV210 || ARCH_EXYNOS) - select VIDEOBUF2_DMA_CONTIG - default n - help -diff --git a/drivers/media/platform/exynos4-is/Kconfig b/drivers/media/platform/exynos4-is/Kconfig -index 5dcaa0a..ec5d7c4 100644 ---- a/drivers/media/platform/exynos4-is/Kconfig -+++ b/drivers/media/platform/exynos4-is/Kconfig -@@ -2,7 +2,7 @@ - config VIDEO_SAMSUNG_EXYNOS4_IS - bool "Samsung S5P/EXYNOS4 SoC series Camera Subsystem driver" - depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API -- depends on (PLAT_S5P || ARCH_EXYNOS) -+ depends on ARCH_S5PV210 || ARCH_EXYNOS - depends on OF && COMMON_CLK - help - Say Y here to enable camera host interface devices for -diff --git a/drivers/media/platform/s5p-tv/Kconfig b/drivers/media/platform/s5p-tv/Kconfig -index 369a4c1..dc28ad2 100644 ---- a/drivers/media/platform/s5p-tv/Kconfig -+++ b/drivers/media/platform/s5p-tv/Kconfig -@@ -8,7 +8,7 @@ - - config VIDEO_SAMSUNG_S5P_TV - bool "Samsung TV driver for S5P platform" -- depends on (PLAT_S5P || ARCH_EXYNOS) && PM_RUNTIME -+ depends on (ARCH_S5PV210 || ARCH_EXYNOS) && PM_RUNTIME - default n - ---help--- - Say Y here to enable selecting the TV output devices for -diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c -index 7115e68..71c9039 100644 ---- a/drivers/media/rc/imon.c -+++ b/drivers/media/rc/imon.c -@@ -1579,7 +1579,8 @@ static void imon_incoming_packet(struct imon_context *ictx, - if (press_type == 0) - rc_keyup(ictx->rdev); - else { -- if (ictx->rc_type == RC_BIT_RC6_MCE) -+ if (ictx->rc_type == RC_BIT_RC6_MCE || -+ ictx->rc_type == RC_BIT_OTHER) - rc_keydown(ictx->rdev, - ictx->rc_type == RC_BIT_RC6_MCE ? RC_TYPE_RC6_MCE : RC_TYPE_OTHER, - ictx->rc_scancode, ictx->rc_toggle); -diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c -index e8fff2a..b732ac6 100644 ---- a/drivers/media/rc/rc-ir-raw.c -+++ b/drivers/media/rc/rc-ir-raw.c -@@ -262,7 +262,6 @@ int ir_raw_event_register(struct rc_dev *dev) - return -ENOMEM; - - dev->raw->dev = dev; -- dev->enabled_protocols = ~0; - dev->change_protocol = change_protocol; - rc = kfifo_alloc(&dev->raw->kfifo, - sizeof(struct ir_raw_event) * MAX_IR_EVENT_SIZE, -diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c -index a7991c7..8d3b74c 100644 ---- a/drivers/media/rc/rc-main.c -+++ b/drivers/media/rc/rc-main.c -@@ -1421,6 +1421,8 @@ int rc_register_device(struct rc_dev *dev) - - if (dev->change_protocol) { - u64 rc_type = (1 << rc_map->rc_type); -+ if (dev->driver_type == RC_DRIVER_IR_RAW) -+ rc_type |= RC_BIT_LIRC; - rc = dev->change_protocol(dev, &rc_type); - if (rc < 0) - goto out_raw; -diff --git a/drivers/media/tuners/m88ts2022.c b/drivers/media/tuners/m88ts2022.c -index 40c42de..7a62097 100644 ---- a/drivers/media/tuners/m88ts2022.c -+++ b/drivers/media/tuners/m88ts2022.c -@@ -314,7 +314,7 @@ static int m88ts2022_set_params(struct dvb_frontend *fe) - div_min = gdiv28 * 78 / 100; - div_max = clamp_val(div_max, 0U, 63U); - -- f_3db_hz = c->symbol_rate * 135UL / 200UL; -+ f_3db_hz = mult_frac(c->symbol_rate, 135, 200); - f_3db_hz += 2000000U + (frequency_offset_khz * 1000U); - f_3db_hz = clamp(f_3db_hz, 7000000U, 40000000U); - -diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c -index 9da812b..9c61c3f 100644 ---- a/drivers/media/usb/em28xx/em28xx-cards.c -+++ b/drivers/media/usb/em28xx/em28xx-cards.c -@@ -3098,16 +3098,6 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev, - } - } - -- if (dev->chip_id == CHIP_ID_EM2870 || -- dev->chip_id == CHIP_ID_EM2874 || -- dev->chip_id == CHIP_ID_EM28174 || -- dev->chip_id == CHIP_ID_EM28178) { -- /* Digital only device - don't load any alsa module */ -- dev->audio_mode.has_audio = false; -- dev->has_audio_class = false; -- dev->has_alsa_audio = false; -- } -- - if (chip_name != default_chip_name) - printk(KERN_INFO DRIVER_NAME - ": chip ID is %s\n", chip_name); -@@ -3377,7 +3367,6 @@ static int em28xx_usb_probe(struct usb_interface *interface, - dev->alt = -1; - dev->is_audio_only = has_audio && !(has_video || has_dvb); - dev->has_alsa_audio = has_audio; -- dev->audio_mode.has_audio = has_audio; - dev->has_video = has_video; - dev->ifnum = ifnum; - -diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c -index 523d7e9..0f6caa4 100644 ---- a/drivers/media/usb/em28xx/em28xx-core.c -+++ b/drivers/media/usb/em28xx/em28xx-core.c -@@ -506,8 +506,18 @@ int em28xx_audio_setup(struct em28xx *dev) - int vid1, vid2, feat, cfg; - u32 vid; - -- if (!dev->audio_mode.has_audio) -+ if (dev->chip_id == CHIP_ID_EM2870 || -+ dev->chip_id == CHIP_ID_EM2874 || -+ dev->chip_id == CHIP_ID_EM28174 || -+ dev->chip_id == CHIP_ID_EM28178) { -+ /* Digital only device - don't load any alsa module */ -+ dev->audio_mode.has_audio = false; -+ dev->has_audio_class = false; -+ dev->has_alsa_audio = false; - return 0; -+ } -+ -+ dev->audio_mode.has_audio = true; - - /* See how this device is configured */ - cfg = em28xx_read_reg(dev, EM28XX_R00_CHIPCFG); -diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c -index 29abc37..5122cbe 100644 ---- a/drivers/media/usb/em28xx/em28xx-video.c -+++ b/drivers/media/usb/em28xx/em28xx-video.c -@@ -435,7 +435,10 @@ static inline void finish_buffer(struct em28xx *dev, - em28xx_isocdbg("[%p/%d] wakeup\n", buf, buf->top_field); - - buf->vb.v4l2_buf.sequence = dev->v4l2->field_count++; -- buf->vb.v4l2_buf.field = V4L2_FIELD_INTERLACED; -+ if (dev->v4l2->progressive) -+ buf->vb.v4l2_buf.field = V4L2_FIELD_NONE; -+ else -+ buf->vb.v4l2_buf.field = V4L2_FIELD_INTERLACED; - v4l2_get_timestamp(&buf->vb.v4l2_buf.timestamp); - - vb2_buffer_done(&buf->vb, VB2_BUF_STATE_DONE); -@@ -994,13 +997,16 @@ static void em28xx_stop_streaming(struct vb2_queue *vq) - } - - spin_lock_irqsave(&dev->slock, flags); -+ if (dev->usb_ctl.vid_buf != NULL) { -+ vb2_buffer_done(&dev->usb_ctl.vid_buf->vb, VB2_BUF_STATE_ERROR); -+ dev->usb_ctl.vid_buf = NULL; -+ } - while (!list_empty(&vidq->active)) { - struct em28xx_buffer *buf; - buf = list_entry(vidq->active.next, struct em28xx_buffer, list); - list_del(&buf->list); - vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR); - } -- dev->usb_ctl.vid_buf = NULL; - spin_unlock_irqrestore(&dev->slock, flags); - } - -@@ -1021,13 +1027,16 @@ void em28xx_stop_vbi_streaming(struct vb2_queue *vq) - } - - spin_lock_irqsave(&dev->slock, flags); -+ if (dev->usb_ctl.vbi_buf != NULL) { -+ vb2_buffer_done(&dev->usb_ctl.vbi_buf->vb, VB2_BUF_STATE_ERROR); -+ dev->usb_ctl.vbi_buf = NULL; -+ } - while (!list_empty(&vbiq->active)) { - struct em28xx_buffer *buf; - buf = list_entry(vbiq->active.next, struct em28xx_buffer, list); - list_del(&buf->list); - vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR); - } -- dev->usb_ctl.vbi_buf = NULL; - spin_unlock_irqrestore(&dev->slock, flags); - } - -diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c -index 1836a41..89c86ee 100644 ---- a/drivers/media/usb/siano/smsusb.c -+++ b/drivers/media/usb/siano/smsusb.c -@@ -655,6 +655,8 @@ static const struct usb_device_id smsusb_id_table[] = { - .driver_info = SMS1XXX_BOARD_ONDA_MDTV_DATA_CARD }, - { USB_DEVICE(0x3275, 0x0080), - .driver_info = SMS1XXX_BOARD_SIANO_RIO }, -+ { USB_DEVICE(0x2013, 0x0257), -+ .driver_info = SMS1XXX_BOARD_PCTV_77E }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index f8135f4..f3c1269 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -2229,6 +2229,15 @@ static struct usb_device_id uvc_ids[] = { - .bInterfaceSubClass = 1, - .bInterfaceProtocol = 0, - .driver_info = UVC_QUIRK_PROBE_DEF }, -+ /* Dell XPS M1330 (OmniVision OV7670 webcam) */ -+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE -+ | USB_DEVICE_ID_MATCH_INT_INFO, -+ .idVendor = 0x05a9, -+ .idProduct = 0x7670, -+ .bInterfaceClass = USB_CLASS_VIDEO, -+ .bInterfaceSubClass = 1, -+ .bInterfaceProtocol = 0, -+ .driver_info = UVC_QUIRK_PROBE_DEF }, - /* Apple Built-In iSight */ - { .match_flags = USB_DEVICE_ID_MATCH_DEVICE - | USB_DEVICE_ID_MATCH_INT_INFO, -diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c -index ccaa38f..2e9d81f 100644 ---- a/drivers/media/v4l2-core/v4l2-common.c -+++ b/drivers/media/v4l2-core/v4l2-common.c -@@ -435,16 +435,13 @@ static unsigned int clamp_align(unsigned int x, unsigned int min, - /* Bits that must be zero to be aligned */ - unsigned int mask = ~((1 << align) - 1); - -+ /* Clamp to aligned min and max */ -+ x = clamp(x, (min + ~mask) & mask, max & mask); -+ - /* Round to nearest aligned value */ - if (align) - x = (x + (1 << (align - 1))) & mask; - -- /* Clamp to aligned value of min and max */ -- if (x < min) -- x = (min + ~mask) & mask; -- else if (x > max) -- x = max & mask; -- - return x; - } - -diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c -index 3c8cc02..3ff15f1 100644 ---- a/drivers/media/v4l2-core/videobuf-dma-sg.c -+++ b/drivers/media/v4l2-core/videobuf-dma-sg.c -@@ -253,9 +253,11 @@ int videobuf_dma_init_kernel(struct videobuf_dmabuf *dma, int direction, - return 0; - out_free_pages: - while (i > 0) { -- void *addr = page_address(dma->vaddr_pages[i]); -- dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]); -+ void *addr; -+ - i--; -+ addr = page_address(dma->vaddr_pages[i]); -+ dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]); - } - kfree(dma->dma_addr); - dma->dma_addr = NULL; -diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c -index d01b8c2..f2643c2 100644 ---- a/drivers/mfd/rtsx_pcr.c -+++ b/drivers/mfd/rtsx_pcr.c -@@ -1197,7 +1197,7 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, - pcr->msi_en = msi_en; - if (pcr->msi_en) { - ret = pci_enable_msi(pcidev); -- if (ret < 0) -+ if (ret) - pcr->msi_en = false; - } - -diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c -index dd4bf58..121add8 100644 ---- a/drivers/mfd/ti_am335x_tscadc.c -+++ b/drivers/mfd/ti_am335x_tscadc.c -@@ -53,11 +53,11 @@ void am335x_tsc_se_set_cache(struct ti_tscadc_dev *tsadc, u32 val) - unsigned long flags; - - spin_lock_irqsave(&tsadc->reg_lock, flags); -- tsadc->reg_se_cache = val; -+ tsadc->reg_se_cache |= val; - if (tsadc->adc_waiting) - wake_up(&tsadc->reg_se_wait); - else if (!tsadc->adc_in_use) -- tscadc_writel(tsadc, REG_SE, val); -+ tscadc_writel(tsadc, REG_SE, tsadc->reg_se_cache); - - spin_unlock_irqrestore(&tsadc->reg_lock, flags); - } -@@ -96,6 +96,7 @@ static void am335x_tscadc_need_adc(struct ti_tscadc_dev *tsadc) - void am335x_tsc_se_set_once(struct ti_tscadc_dev *tsadc, u32 val) - { - spin_lock_irq(&tsadc->reg_lock); -+ tsadc->reg_se_cache |= val; - am335x_tscadc_need_adc(tsadc); - - tscadc_writel(tsadc, REG_SE, val); -diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c -index e636d9e..3fc40a7 100644 ---- a/drivers/mmc/core/sdio.c -+++ b/drivers/mmc/core/sdio.c -@@ -992,8 +992,16 @@ static int mmc_sdio_resume(struct mmc_host *host) - } - } - -- if (!err && host->sdio_irqs) -- wake_up_process(host->sdio_irq_thread); -+ if (!err && host->sdio_irqs) { -+ if (!(host->caps2 & MMC_CAP2_SDIO_IRQ_NOTHREAD)) { -+ wake_up_process(host->sdio_irq_thread); -+ } else if (host->caps & MMC_CAP_SDIO_IRQ) { -+ mmc_host_clk_hold(host); -+ host->ops->enable_sdio_irq(host, 1); -+ mmc_host_clk_release(host); -+ } -+ } -+ - mmc_release_host(host); - - host->pm_flags &= ~MMC_PM_KEEP_POWER; -diff --git a/drivers/mmc/core/sdio_irq.c b/drivers/mmc/core/sdio_irq.c -index 5cc13c8..696eca4 100644 ---- a/drivers/mmc/core/sdio_irq.c -+++ b/drivers/mmc/core/sdio_irq.c -@@ -208,7 +208,7 @@ static int sdio_card_irq_get(struct mmc_card *card) - host->sdio_irqs--; - return err; - } -- } else { -+ } else if (host->caps & MMC_CAP_SDIO_IRQ) { - mmc_host_clk_hold(host); - host->ops->enable_sdio_irq(host, 1); - mmc_host_clk_release(host); -@@ -229,7 +229,7 @@ static int sdio_card_irq_put(struct mmc_card *card) - if (!(host->caps2 & MMC_CAP2_SDIO_IRQ_NOTHREAD)) { - atomic_set(&host->sdio_irq_thread_abort, 1); - kthread_stop(host->sdio_irq_thread); -- } else { -+ } else if (host->caps & MMC_CAP_SDIO_IRQ) { - mmc_host_clk_hold(host); - host->ops->enable_sdio_irq(host, 0); - mmc_host_clk_release(host); -diff --git a/drivers/mmc/core/slot-gpio.c b/drivers/mmc/core/slot-gpio.c -index 5f89cb8..187f48a 100644 ---- a/drivers/mmc/core/slot-gpio.c -+++ b/drivers/mmc/core/slot-gpio.c -@@ -221,8 +221,6 @@ int mmc_gpio_request_cd(struct mmc_host *host, unsigned int gpio, - ctx->override_cd_active_level = true; - ctx->cd_gpio = gpio_to_desc(gpio); - -- mmc_gpiod_request_cd_irq(host); -- - return 0; - } - EXPORT_SYMBOL(mmc_gpio_request_cd); -diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c -index cc8d4a6..e4a0754 100644 ---- a/drivers/mmc/host/mmc_spi.c -+++ b/drivers/mmc/host/mmc_spi.c -@@ -1436,6 +1436,7 @@ static int mmc_spi_probe(struct spi_device *spi) - host->pdata->cd_debounce); - if (status != 0) - goto fail_add_host; -+ mmc_gpiod_request_cd_irq(mmc); - } - - if (host->pdata && host->pdata->flags & MMC_SPI_USE_RO_GPIO) { -diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c -index dfde4a2..b2537e2 100644 ---- a/drivers/mmc/host/rtsx_pci_sdmmc.c -+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c -@@ -412,6 +412,13 @@ static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host, - } - - if (rsp_type == SD_RSP_TYPE_R2) { -+ /* -+ * The controller offloads the last byte {CRC-7, end bit 1'b1} -+ * of response type R2. Assign dummy CRC, 0, and end bit to the -+ * byte(ptr[16], goes into the LSB of resp[3] later). -+ */ -+ ptr[16] = 1; -+ - for (i = 0; i < 4; i++) { - cmd->resp[i] = get_unaligned_be32(ptr + 1 + i * 4); - dev_dbg(sdmmc_dev(host), "cmd->resp[%d] = 0x%08x\n", -diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c -index 5d3766e..d9153a7 100644 ---- a/drivers/mmc/host/rtsx_usb_sdmmc.c -+++ b/drivers/mmc/host/rtsx_usb_sdmmc.c -@@ -435,6 +435,13 @@ static void sd_send_cmd_get_rsp(struct rtsx_usb_sdmmc *host, - } - - if (rsp_type == SD_RSP_TYPE_R2) { -+ /* -+ * The controller offloads the last byte {CRC-7, end bit 1'b1} -+ * of response type R2. Assign dummy CRC, 0, and end bit to the -+ * byte(ptr[16], goes into the LSB of resp[3] later). -+ */ -+ ptr[16] = 1; -+ - for (i = 0; i < 4; i++) { - cmd->resp[i] = get_unaligned_be32(ptr + 1 + i * 4); - dev_dbg(sdmmc_dev(host), "cmd->resp[%d] = 0x%08x\n", -diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c -index 6f842fb..3434c79 100644 ---- a/drivers/mmc/host/sdhci-pxav3.c -+++ b/drivers/mmc/host/sdhci-pxav3.c -@@ -224,12 +224,11 @@ static void pxav3_set_uhs_signaling(struct sdhci_host *host, unsigned int uhs) - - static const struct sdhci_ops pxav3_sdhci_ops = { - .set_clock = sdhci_set_clock, -- .set_uhs_signaling = pxav3_set_uhs_signaling, - .platform_send_init_74_clocks = pxav3_gen_init_74_clocks, - .get_max_clock = sdhci_pltfm_clk_get_max_clock, - .set_bus_width = sdhci_set_bus_width, - .reset = pxav3_reset, -- .set_uhs_signaling = sdhci_set_uhs_signaling, -+ .set_uhs_signaling = pxav3_set_uhs_signaling, - }; - - static struct sdhci_pltfm_data sdhci_pxav3_pdata = { -diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c -index fa5954a..1e47903 100644 ---- a/drivers/mmc/host/sdhci-s3c.c -+++ b/drivers/mmc/host/sdhci-s3c.c -@@ -606,8 +606,6 @@ static int sdhci_s3c_probe(struct platform_device *pdev) - ret = sdhci_add_host(host); - if (ret) { - dev_err(dev, "sdhci_add_host() failed\n"); -- pm_runtime_forbid(&pdev->dev); -- pm_runtime_get_noresume(&pdev->dev); - goto err_req_regs; - } - -@@ -618,6 +616,8 @@ static int sdhci_s3c_probe(struct platform_device *pdev) - return 0; - - err_req_regs: -+ pm_runtime_disable(&pdev->dev); -+ - err_no_busclks: - clk_disable_unprepare(sc->clk_io); - -diff --git a/drivers/mmc/host/sdhci-sirf.c b/drivers/mmc/host/sdhci-sirf.c -index 1700453..b6db259 100644 ---- a/drivers/mmc/host/sdhci-sirf.c -+++ b/drivers/mmc/host/sdhci-sirf.c -@@ -94,6 +94,7 @@ static int sdhci_sirf_probe(struct platform_device *pdev) - ret); - goto err_request_cd; - } -+ mmc_gpiod_request_cd_irq(host->mmc); - } - - return 0; -diff --git a/drivers/mmc/host/tmio_mmc_pio.c b/drivers/mmc/host/tmio_mmc_pio.c -index faf0924..59d9a72 100644 ---- a/drivers/mmc/host/tmio_mmc_pio.c -+++ b/drivers/mmc/host/tmio_mmc_pio.c -@@ -1103,6 +1103,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host **host, - tmio_mmc_host_remove(_host); - return ret; - } -+ mmc_gpiod_request_cd_irq(mmc); - } - - *host = _host; -diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c -index a7543ba..3096f3d 100644 ---- a/drivers/mtd/chips/cfi_cmdset_0001.c -+++ b/drivers/mtd/chips/cfi_cmdset_0001.c -@@ -2590,6 +2590,8 @@ static void cfi_intelext_resume(struct mtd_info *mtd) - - /* Go to known state. Chip may have been power cycled */ - if (chip->state == FL_PM_SUSPENDED) { -+ /* Refresh LH28F640BF Partition Config. Register */ -+ fixup_LH28F640BF(mtd); - map_write(map, CMD(0xFF), cfi->chips[i].start); - chip->oldstate = chip->state = FL_READY; - wake_up(&chip->wq); -diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c -index ed7e0a1b..5935f0a 100644 ---- a/drivers/mtd/devices/m25p80.c -+++ b/drivers/mtd/devices/m25p80.c -@@ -245,6 +245,56 @@ static int m25p_remove(struct spi_device *spi) - } - - -+/* -+ * XXX This needs to be kept in sync with spi_nor_ids. We can't share -+ * it with spi-nor, because if this is built as a module then modpost -+ * won't be able to read it and add appropriate aliases. -+ */ -+static const struct spi_device_id m25p_ids[] = { -+ {"at25fs010"}, {"at25fs040"}, {"at25df041a"}, {"at25df321a"}, -+ {"at25df641"}, {"at26f004"}, {"at26df081a"}, {"at26df161a"}, -+ {"at26df321"}, {"at45db081d"}, -+ {"en25f32"}, {"en25p32"}, {"en25q32b"}, {"en25p64"}, -+ {"en25q64"}, {"en25qh128"}, {"en25qh256"}, -+ {"f25l32pa"}, -+ {"mr25h256"}, {"mr25h10"}, -+ {"gd25q32"}, {"gd25q64"}, -+ {"160s33b"}, {"320s33b"}, {"640s33b"}, -+ {"mx25l2005a"}, {"mx25l4005a"}, {"mx25l8005"}, {"mx25l1606e"}, -+ {"mx25l3205d"}, {"mx25l3255e"}, {"mx25l6405d"}, {"mx25l12805d"}, -+ {"mx25l12855e"},{"mx25l25635e"},{"mx25l25655e"},{"mx66l51235l"}, -+ {"mx66l1g55g"}, -+ {"n25q064"}, {"n25q128a11"}, {"n25q128a13"}, {"n25q256a"}, -+ {"n25q512a"}, {"n25q512ax3"}, {"n25q00"}, -+ {"pm25lv512"}, {"pm25lv010"}, {"pm25lq032"}, -+ {"s25sl032p"}, {"s25sl064p"}, {"s25fl256s0"}, {"s25fl256s1"}, -+ {"s25fl512s"}, {"s70fl01gs"}, {"s25sl12800"}, {"s25sl12801"}, -+ {"s25fl129p0"}, {"s25fl129p1"}, {"s25sl004a"}, {"s25sl008a"}, -+ {"s25sl016a"}, {"s25sl032a"}, {"s25sl064a"}, {"s25fl008k"}, -+ {"s25fl016k"}, {"s25fl064k"}, -+ {"sst25vf040b"},{"sst25vf080b"},{"sst25vf016b"},{"sst25vf032b"}, -+ {"sst25vf064c"},{"sst25wf512"}, {"sst25wf010"}, {"sst25wf020"}, -+ {"sst25wf040"}, -+ {"m25p05"}, {"m25p10"}, {"m25p20"}, {"m25p40"}, -+ {"m25p80"}, {"m25p16"}, {"m25p32"}, {"m25p64"}, -+ {"m25p128"}, {"n25q032"}, -+ {"m25p05-nonjedec"}, {"m25p10-nonjedec"}, {"m25p20-nonjedec"}, -+ {"m25p40-nonjedec"}, {"m25p80-nonjedec"}, {"m25p16-nonjedec"}, -+ {"m25p32-nonjedec"}, {"m25p64-nonjedec"}, {"m25p128-nonjedec"}, -+ {"m45pe10"}, {"m45pe80"}, {"m45pe16"}, -+ {"m25pe20"}, {"m25pe80"}, {"m25pe16"}, -+ {"m25px16"}, {"m25px32"}, {"m25px32-s0"}, {"m25px32-s1"}, -+ {"m25px64"}, -+ {"w25x10"}, {"w25x20"}, {"w25x40"}, {"w25x80"}, -+ {"w25x16"}, {"w25x32"}, {"w25q32"}, {"w25q32dw"}, -+ {"w25x64"}, {"w25q64"}, {"w25q128"}, {"w25q80"}, -+ {"w25q80bl"}, {"w25q128"}, {"w25q256"}, {"cat25c11"}, -+ {"cat25c03"}, {"cat25c09"}, {"cat25c17"}, {"cat25128"}, -+ { }, -+}; -+MODULE_DEVICE_TABLE(spi, m25p_ids); -+ -+ - static struct spi_driver m25p80_driver = { - .driver = { - .name = "m25p80", -diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c -index 33c6495..5f9a1e2 100644 ---- a/drivers/mtd/ubi/block.c -+++ b/drivers/mtd/ubi/block.c -@@ -188,8 +188,9 @@ static int ubiblock_read_to_buf(struct ubiblock *dev, char *buffer, - - ret = ubi_read(dev->desc, leb, buffer, offset, len); - if (ret) { -- ubi_err("%s ubi_read error %d", -- dev->gd->disk_name, ret); -+ ubi_err("%s: error %d while reading from LEB %d (offset %d, " -+ "length %d)", dev->gd->disk_name, ret, leb, offset, -+ len); - return ret; - } - return 0; -@@ -378,7 +379,7 @@ int ubiblock_create(struct ubi_volume_info *vi) - { - struct ubiblock *dev; - struct gendisk *gd; -- u64 disk_capacity = ((u64)vi->size * vi->usable_leb_size) >> 9; -+ u64 disk_capacity = vi->used_bytes >> 9; - int ret; - - if ((sector_t)disk_capacity != disk_capacity) -@@ -502,7 +503,7 @@ int ubiblock_remove(struct ubi_volume_info *vi) - static int ubiblock_resize(struct ubi_volume_info *vi) - { - struct ubiblock *dev; -- u64 disk_capacity = ((u64)vi->size * vi->usable_leb_size) >> 9; -+ u64 disk_capacity = vi->used_bytes >> 9; - - if ((sector_t)disk_capacity != disk_capacity) { - ubi_warn("%s: the volume is too big, cannot resize (%d LEBs)", -@@ -522,8 +523,12 @@ static int ubiblock_resize(struct ubi_volume_info *vi) - } - - mutex_lock(&dev->dev_mutex); -- set_capacity(dev->gd, disk_capacity); -- ubi_msg("%s resized to %d LEBs", dev->gd->disk_name, vi->size); -+ -+ if (get_capacity(dev->gd) != disk_capacity) { -+ set_capacity(dev->gd, disk_capacity); -+ ubi_msg("%s resized to %lld bytes", dev->gd->disk_name, -+ vi->used_bytes); -+ } - mutex_unlock(&dev->dev_mutex); - mutex_unlock(&devices_mutex); - return 0; -@@ -547,6 +552,14 @@ static int ubiblock_notify(struct notifier_block *nb, - case UBI_VOLUME_RESIZED: - ubiblock_resize(&nt->vi); - break; -+ case UBI_VOLUME_UPDATED: -+ /* -+ * If the volume is static, a content update might mean the -+ * size (i.e. used_bytes) was also changed. -+ */ -+ if (nt->vi.vol_type == UBI_STATIC_VOLUME) -+ ubiblock_resize(&nt->vi); -+ break; - default: - break; - } -diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c -index 7646220..20aeb27 100644 ---- a/drivers/mtd/ubi/cdev.c -+++ b/drivers/mtd/ubi/cdev.c -@@ -425,8 +425,10 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd, - break; - - err = ubi_start_update(ubi, vol, bytes); -- if (bytes == 0) -+ if (bytes == 0) { -+ ubi_volume_notify(ubi, vol, UBI_VOLUME_UPDATED); - revoke_exclusive(desc, UBI_READWRITE); -+ } - break; - } - -diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c -index 0431b46..c701369 100644 ---- a/drivers/mtd/ubi/fastmap.c -+++ b/drivers/mtd/ubi/fastmap.c -@@ -330,6 +330,7 @@ static int process_pool_aeb(struct ubi_device *ubi, struct ubi_attach_info *ai, - av = tmp_av; - else { - ubi_err("orphaned volume in fastmap pool!"); -+ kmem_cache_free(ai->aeb_slab_cache, new_aeb); - return UBI_BAD_FASTMAP; - } - -diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig -index c6f6f69..2f8f251 100644 ---- a/drivers/net/Kconfig -+++ b/drivers/net/Kconfig -@@ -135,6 +135,7 @@ config MACVLAN - config MACVTAP - tristate "MAC-VLAN based tap driver" - depends on MACVLAN -+ depends on INET - help - This adds a specialized tap character device driver that is based - on the MAC-VLAN network interface, called macvtap. A macvtap device -@@ -201,6 +202,7 @@ config RIONET_RX_SIZE - - config TUN - tristate "Universal TUN/TAP device driver support" -+ depends on INET - select CRC32 - ---help--- - TUN/TAP provides packet reception and transmission for user space -diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -index e5be511..fac3821 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -@@ -6557,6 +6557,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) - - spin_lock_init(&adapter->stats_lock); - spin_lock_init(&adapter->tid_release_lock); -+ spin_lock_init(&adapter->win0_lock); - - INIT_WORK(&adapter->tid_release_task, process_tid_release_list); - INIT_WORK(&adapter->db_full_task, process_db_full); -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c -index dae3da6..c2c7743 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c -@@ -808,8 +808,11 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev) - tx_desc->ctrl.fence_size = (real_size / 16) & 0x3f; - tx_desc->ctrl.srcrb_flags = priv->ctrl_flags; - if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) { -- tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM | -- MLX4_WQE_CTRL_TCP_UDP_CSUM); -+ if (!skb->encapsulation) -+ tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM | -+ MLX4_WQE_CTRL_TCP_UDP_CSUM); -+ else -+ tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM); - ring->tx_csum++; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c -index ca0f98c..8728431 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/mcg.c -+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c -@@ -955,6 +955,10 @@ static void mlx4_err_rule(struct mlx4_dev *dev, char *str, - cur->ib.dst_gid_msk); - break; - -+ case MLX4_NET_TRANS_RULE_ID_VXLAN: -+ len += snprintf(buf + len, BUF_SIZE - len, -+ "VNID = %d ", be32_to_cpu(cur->vxlan.vni)); -+ break; - case MLX4_NET_TRANS_RULE_ID_IPV6: - break; - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c -index 655a23b..e17a970 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c -@@ -33,6 +33,7 @@ static struct stmmac_dma_cfg dma_cfg; - static void stmmac_default_data(void) - { - memset(&plat_dat, 0, sizeof(struct plat_stmmacenet_data)); -+ - plat_dat.bus_id = 1; - plat_dat.phy_addr = 0; - plat_dat.interface = PHY_INTERFACE_MODE_GMII; -@@ -47,6 +48,12 @@ static void stmmac_default_data(void) - dma_cfg.pbl = 32; - dma_cfg.burst_len = DMA_AXI_BLEN_256; - plat_dat.dma_cfg = &dma_cfg; -+ -+ /* Set default value for multicast hash bins */ -+ plat_dat.multicast_filter_bins = HASH_TABLE_SIZE; -+ -+ /* Set default value for unicast filter entries */ -+ plat_dat.unicast_filter_entries = 1; - } - - /** -diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c -index 0fcb5e7..148fda3 100644 ---- a/drivers/net/hyperv/netvsc_drv.c -+++ b/drivers/net/hyperv/netvsc_drv.c -@@ -556,6 +556,7 @@ do_lso: - do_send: - /* Start filling in the page buffers with the rndis hdr */ - rndis_msg->msg_len += rndis_msg_size; -+ packet->total_data_buflen = rndis_msg->msg_len; - packet->page_buf_cnt = init_page_array(rndis_msg, rndis_msg_size, - skb, &packet->page_buf[0]); - -diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c -index 726edab..5f17ad0 100644 ---- a/drivers/net/macvlan.c -+++ b/drivers/net/macvlan.c -@@ -201,7 +201,7 @@ static void macvlan_process_broadcast(struct work_struct *w) - struct sk_buff *skb; - struct sk_buff_head list; - -- skb_queue_head_init(&list); -+ __skb_queue_head_init(&list); - - spin_lock_bh(&port->bc_queue.lock); - skb_queue_splice_tail_init(&port->bc_queue, &list); -@@ -941,9 +941,15 @@ static void macvlan_port_destroy(struct net_device *dev) - { - struct macvlan_port *port = macvlan_port_get_rtnl(dev); - -- cancel_work_sync(&port->bc_work); - dev->priv_flags &= ~IFF_MACVLAN_PORT; - netdev_rx_handler_unregister(dev); -+ -+ /* After this point, no packet can schedule bc_work anymore, -+ * but we need to cancel it and purge left skbs if any. -+ */ -+ cancel_work_sync(&port->bc_work); -+ __skb_queue_purge(&port->bc_queue); -+ - kfree_rcu(port, rcu); - } - -diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c -index 0c6adaa..9b5481c 100644 ---- a/drivers/net/macvtap.c -+++ b/drivers/net/macvtap.c -@@ -16,6 +16,7 @@ - #include <linux/idr.h> - #include <linux/fs.h> - -+#include <net/ipv6.h> - #include <net/net_namespace.h> - #include <net/rtnetlink.h> - #include <net/sock.h> -@@ -570,6 +571,8 @@ static int macvtap_skb_from_vnet_hdr(struct sk_buff *skb, - break; - case VIRTIO_NET_HDR_GSO_UDP: - gso_type = SKB_GSO_UDP; -+ if (skb->protocol == htons(ETH_P_IPV6)) -+ ipv6_proxy_select_ident(skb); - break; - default: - return -EINVAL; -diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index fa0d717..90c639b 100644 ---- a/drivers/net/ppp/ppp_generic.c -+++ b/drivers/net/ppp/ppp_generic.c -@@ -594,7 +594,7 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - if (file == ppp->owner) - ppp_shutdown_interface(ppp); - } -- if (atomic_long_read(&file->f_count) <= 2) { -+ if (atomic_long_read(&file->f_count) < 2) { - ppp_release(NULL, file); - err = 0; - } else -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index acaaf67..610d166 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -65,6 +65,7 @@ - #include <linux/nsproxy.h> - #include <linux/virtio_net.h> - #include <linux/rcupdate.h> -+#include <net/ipv6.h> - #include <net/net_namespace.h> - #include <net/netns/generic.h> - #include <net/rtnetlink.h> -@@ -1139,6 +1140,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, - break; - } - -+ skb_reset_network_header(skb); -+ - if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) { - pr_debug("GSO!\n"); - switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { -@@ -1150,6 +1153,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, - break; - case VIRTIO_NET_HDR_GSO_UDP: - skb_shinfo(skb)->gso_type = SKB_GSO_UDP; -+ if (skb->protocol == htons(ETH_P_IPV6)) -+ ipv6_proxy_select_ident(skb); - break; - default: - tun->dev->stats.rx_frame_errors++; -@@ -1179,7 +1184,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, - skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG; - } - -- skb_reset_network_header(skb); - skb_probe_transport_header(skb, 0); - - rxhash = skb_get_hash(skb); -diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c -index be42757..e6338c1 100644 ---- a/drivers/net/usb/ax88179_178a.c -+++ b/drivers/net/usb/ax88179_178a.c -@@ -937,6 +937,7 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p) - { - struct usbnet *dev = netdev_priv(net); - struct sockaddr *addr = p; -+ int ret; - - if (netif_running(net)) - return -EBUSY; -@@ -946,8 +947,12 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p) - memcpy(net->dev_addr, addr->sa_data, ETH_ALEN); - - /* Set the MAC address */ -- return ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, -+ ret = ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, - ETH_ALEN, net->dev_addr); -+ if (ret < 0) -+ return ret; -+ -+ return 0; - } - - static const struct net_device_ops ax88179_netdev_ops = { -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index beb377b..b483127 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -1440,9 +1440,6 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb) - if (!in6_dev) - goto out; - -- if (!pskb_may_pull(skb, skb->len)) -- goto out; -- - iphdr = ipv6_hdr(skb); - saddr = &iphdr->saddr; - daddr = &iphdr->daddr; -@@ -1717,6 +1714,8 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan, - struct pcpu_sw_netstats *tx_stats, *rx_stats; - union vxlan_addr loopback; - union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip; -+ struct net_device *dev = skb->dev; -+ int len = skb->len; - - tx_stats = this_cpu_ptr(src_vxlan->dev->tstats); - rx_stats = this_cpu_ptr(dst_vxlan->dev->tstats); -@@ -1740,16 +1739,16 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan, - - u64_stats_update_begin(&tx_stats->syncp); - tx_stats->tx_packets++; -- tx_stats->tx_bytes += skb->len; -+ tx_stats->tx_bytes += len; - u64_stats_update_end(&tx_stats->syncp); - - if (netif_rx(skb) == NET_RX_SUCCESS) { - u64_stats_update_begin(&rx_stats->syncp); - rx_stats->rx_packets++; -- rx_stats->rx_bytes += skb->len; -+ rx_stats->rx_bytes += len; - u64_stats_update_end(&rx_stats->syncp); - } else { -- skb->dev->stats.rx_dropped++; -+ dev->stats.rx_dropped++; - } - } - -@@ -1927,7 +1926,8 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) - return arp_reduce(dev, skb); - #if IS_ENABLED(CONFIG_IPV6) - else if (ntohs(eth->h_proto) == ETH_P_IPV6 && -- skb->len >= sizeof(struct ipv6hdr) + sizeof(struct nd_msg) && -+ pskb_may_pull(skb, sizeof(struct ipv6hdr) -+ + sizeof(struct nd_msg)) && - ipv6_hdr(skb)->nexthdr == IPPROTO_ICMPV6) { - struct nd_msg *msg; - -@@ -1936,6 +1936,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) - msg->icmph.icmp6_type == NDISC_NEIGHBOUR_SOLICITATION) - return neigh_reduce(dev, skb); - } -+ eth = eth_hdr(skb); - #endif - } - -diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c -index afb98f4..9133985 100644 ---- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c -+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c -@@ -1095,6 +1095,7 @@ static void iwlagn_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif, - u32 queues, bool drop) - { - struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw); -+ u32 scd_queues; - - mutex_lock(&priv->mutex); - IWL_DEBUG_MAC80211(priv, "enter\n"); -@@ -1108,18 +1109,19 @@ static void iwlagn_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif, - goto done; - } - -- /* -- * mac80211 will not push any more frames for transmit -- * until the flush is completed -- */ -- if (drop) { -- IWL_DEBUG_MAC80211(priv, "send flush command\n"); -- if (iwlagn_txfifo_flush(priv, 0)) { -- IWL_ERR(priv, "flush request fail\n"); -- goto done; -- } -+ scd_queues = BIT(priv->cfg->base_params->num_of_queues) - 1; -+ scd_queues &= ~(BIT(IWL_IPAN_CMD_QUEUE_NUM) | -+ BIT(IWL_DEFAULT_CMD_QUEUE_NUM)); -+ -+ if (vif) -+ scd_queues &= ~BIT(vif->hw_queue[IEEE80211_AC_VO]); -+ -+ IWL_DEBUG_TX_QUEUES(priv, "Flushing SCD queues: 0x%x\n", scd_queues); -+ if (iwlagn_txfifo_flush(priv, scd_queues)) { -+ IWL_ERR(priv, "flush request fail\n"); -+ goto done; - } -- IWL_DEBUG_MAC80211(priv, "wait transmit/flush all frames\n"); -+ IWL_DEBUG_TX_QUEUES(priv, "wait transmit/flush all frames\n"); - iwl_trans_wait_tx_queue_empty(priv->trans, 0xffffffff); - done: - mutex_unlock(&priv->mutex); -diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h -index 656371a..86fb121 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-trans.h -+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h -@@ -548,6 +548,7 @@ enum iwl_trans_state { - * Set during transport allocation. - * @hw_id_str: a string with info about HW ID. Set during transport allocation. - * @pm_support: set to true in start_hw if link pm is supported -+ * @ltr_enabled: set to true if the LTR is enabled - * @dev_cmd_pool: pool for Tx cmd allocation - for internal use only. - * The user should use iwl_trans_{alloc,free}_tx_cmd. - * @dev_cmd_headroom: room needed for the transport's private use before the -@@ -574,6 +575,7 @@ struct iwl_trans { - u8 rx_mpdu_cmd, rx_mpdu_cmd_hdr_size; - - bool pm_support; -+ bool ltr_enabled; - - /* The following fields are internal only */ - struct kmem_cache *dev_cmd_pool; -diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c -index ce71625..103fc93 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/coex.c -+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c -@@ -301,8 +301,8 @@ static const __le64 iwl_ci_mask[][3] = { - }; - - static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = { -- cpu_to_le32(0x28412201), -- cpu_to_le32(0x11118451), -+ cpu_to_le32(0x2e402280), -+ cpu_to_le32(0x7711a751), - }; - - struct corunning_block_luts { -diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c -index a3be333..d55c2a8 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c -+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c -@@ -289,8 +289,8 @@ static const __le64 iwl_ci_mask[][3] = { - }; - - static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = { -- cpu_to_le32(0x28412201), -- cpu_to_le32(0x11118451), -+ cpu_to_le32(0x2e402280), -+ cpu_to_le32(0x7711a751), - }; - - struct corunning_block_luts { -diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h -index c3a8c86..4d8932c 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h -+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h -@@ -66,13 +66,46 @@ - - /* Power Management Commands, Responses, Notifications */ - -+/** -+ * enum iwl_ltr_config_flags - masks for LTR config command flags -+ * @LTR_CFG_FLAG_FEATURE_ENABLE: Feature operational status -+ * @LTR_CFG_FLAG_HW_DIS_ON_SHADOW_REG_ACCESS: allow LTR change on shadow -+ * memory access -+ * @LTR_CFG_FLAG_HW_EN_SHRT_WR_THROUGH: allow LTR msg send on ANY LTR -+ * reg change -+ * @LTR_CFG_FLAG_HW_DIS_ON_D0_2_D3: allow LTR msg send on transition from -+ * D0 to D3 -+ * @LTR_CFG_FLAG_SW_SET_SHORT: fixed static short LTR register -+ * @LTR_CFG_FLAG_SW_SET_LONG: fixed static short LONG register -+ * @LTR_CFG_FLAG_DENIE_C10_ON_PD: allow going into C10 on PD -+ */ -+enum iwl_ltr_config_flags { -+ LTR_CFG_FLAG_FEATURE_ENABLE = BIT(0), -+ LTR_CFG_FLAG_HW_DIS_ON_SHADOW_REG_ACCESS = BIT(1), -+ LTR_CFG_FLAG_HW_EN_SHRT_WR_THROUGH = BIT(2), -+ LTR_CFG_FLAG_HW_DIS_ON_D0_2_D3 = BIT(3), -+ LTR_CFG_FLAG_SW_SET_SHORT = BIT(4), -+ LTR_CFG_FLAG_SW_SET_LONG = BIT(5), -+ LTR_CFG_FLAG_DENIE_C10_ON_PD = BIT(6), -+}; -+ -+/** -+ * struct iwl_ltr_config_cmd - configures the LTR -+ * @flags: See %enum iwl_ltr_config_flags -+ */ -+struct iwl_ltr_config_cmd { -+ __le32 flags; -+ __le32 static_long; -+ __le32 static_short; -+} __packed; -+ - /* Radio LP RX Energy Threshold measured in dBm */ - #define POWER_LPRX_RSSI_THRESHOLD 75 - #define POWER_LPRX_RSSI_THRESHOLD_MAX 94 - #define POWER_LPRX_RSSI_THRESHOLD_MIN 30 - - /** -- * enum iwl_scan_flags - masks for power table command flags -+ * enum iwl_power_flags - masks for power table command flags - * @POWER_FLAGS_POWER_SAVE_ENA_MSK: '1' Allow to save power by turning off - * receiver and transmitter. '0' - does not allow. - * @POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK: '0' Driver disables power management, -diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h -index 9a922f3..7b73ed4 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h -+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h -@@ -148,6 +148,7 @@ enum { - /* Power - legacy power table command */ - POWER_TABLE_CMD = 0x77, - PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION = 0x78, -+ LTR_CONFIG = 0xee, - - /* Thermal Throttling*/ - REPLY_THERMAL_MNG_BACKOFF = 0x7e, -diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c -index 883e702..bf720a8 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/fw.c -+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c -@@ -475,6 +475,15 @@ int iwl_mvm_up(struct iwl_mvm *mvm) - /* Initialize tx backoffs to the minimal possible */ - iwl_mvm_tt_tx_backoff(mvm, 0); - -+ if (mvm->trans->ltr_enabled) { -+ struct iwl_ltr_config_cmd cmd = { -+ .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE), -+ }; -+ -+ WARN_ON(iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0, -+ sizeof(cmd), &cmd)); -+ } -+ - ret = iwl_mvm_power_update_device(mvm); - if (ret) - goto error; -diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c -index 610dbcb..d31a117 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/ops.c -+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c -@@ -332,6 +332,7 @@ static const char *const iwl_mvm_cmd_strings[REPLY_MAX] = { - CMD(REPLY_BEACON_FILTERING_CMD), - CMD(REPLY_THERMAL_MNG_BACKOFF), - CMD(MAC_PM_POWER_TABLE), -+ CMD(LTR_CONFIG), - CMD(BT_COEX_CI), - CMD(BT_COEX_UPDATE_SW_BOOST), - CMD(BT_COEX_UPDATE_CORUN_LUT), -diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c -index 9ee410b..dbc8707 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/tx.c -+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c -@@ -168,14 +168,10 @@ static void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm, - - /* - * for data packets, rate info comes from the table inside the fw. This -- * table is controlled by LINK_QUALITY commands. Exclude ctrl port -- * frames like EAPOLs which should be treated as mgmt frames. This -- * avoids them being sent initially in high rates which increases the -- * chances for completion of the 4-Way handshake. -+ * table is controlled by LINK_QUALITY commands - */ - -- if (ieee80211_is_data(fc) && sta && -- !(info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO)) { -+ if (ieee80211_is_data(fc) && sta) { - tx_cmd->initial_rate_index = 0; - tx_cmd->tx_flags |= cpu_to_le32(TX_CMD_FLG_STA_RATE); - return; -diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c -index 06e04aa..d7231a8 100644 ---- a/drivers/net/wireless/iwlwifi/pcie/trans.c -+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c -@@ -172,6 +172,7 @@ static void iwl_pcie_apm_config(struct iwl_trans *trans) - { - struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); - u16 lctl; -+ u16 cap; - - /* - * HW bug W/A for instability in PCIe bus L0S->L1 transition. -@@ -182,16 +183,17 @@ static void iwl_pcie_apm_config(struct iwl_trans *trans) - * power savings, even without L1. - */ - pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_LNKCTL, &lctl); -- if (lctl & PCI_EXP_LNKCTL_ASPM_L1) { -- /* L1-ASPM enabled; disable(!) L0S */ -+ if (lctl & PCI_EXP_LNKCTL_ASPM_L1) - iwl_set_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED); -- dev_info(trans->dev, "L1 Enabled; Disabling L0S\n"); -- } else { -- /* L1-ASPM disabled; enable(!) L0S */ -+ else - iwl_clear_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED); -- dev_info(trans->dev, "L1 Disabled; Enabling L0S\n"); -- } - trans->pm_support = !(lctl & PCI_EXP_LNKCTL_ASPM_L0S); -+ -+ pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_DEVCTL2, &cap); -+ trans->ltr_enabled = cap & PCI_EXP_DEVCTL2_LTR_EN; -+ dev_info(trans->dev, "L1 %sabled - LTR %sabled\n", -+ (lctl & PCI_EXP_LNKCTL_ASPM_L1) ? "En" : "Dis", -+ trans->ltr_enabled ? "En" : "Dis"); - } - - /* -diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h -index 7cf6081..ebd5625 100644 ---- a/drivers/net/wireless/rt2x00/rt2800.h -+++ b/drivers/net/wireless/rt2x00/rt2800.h -@@ -52,6 +52,7 @@ - * RF5592 2.4G/5G 2T2R - * RF3070 2.4G 1T1R - * RF5360 2.4G 1T1R -+ * RF5362 2.4G 1T1R - * RF5370 2.4G 1T1R - * RF5390 2.4G 1T1R - */ -@@ -72,6 +73,7 @@ - #define RF3070 0x3070 - #define RF3290 0x3290 - #define RF5360 0x5360 -+#define RF5362 0x5362 - #define RF5370 0x5370 - #define RF5372 0x5372 - #define RF5390 0x5390 -@@ -2145,7 +2147,7 @@ struct mac_iveiv_entry { - /* Bits [7-4] for RF3320 (RT3370/RT3390), on other chipsets reserved */ - #define RFCSR3_PA1_BIAS_CCK FIELD8(0x70) - #define RFCSR3_PA2_CASCODE_BIAS_CCKK FIELD8(0x80) --/* Bits for RF3290/RF5360/RF5370/RF5372/RF5390/RF5392 */ -+/* Bits for RF3290/RF5360/RF5362/RF5370/RF5372/RF5390/RF5392 */ - #define RFCSR3_VCOCAL_EN FIELD8(0x80) - /* Bits for RF3050 */ - #define RFCSR3_BIT1 FIELD8(0x02) -diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c -index 893c9d5..9f57a2d 100644 ---- a/drivers/net/wireless/rt2x00/rt2800lib.c -+++ b/drivers/net/wireless/rt2x00/rt2800lib.c -@@ -3186,6 +3186,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev, - break; - case RF3070: - case RF5360: -+ case RF5362: - case RF5370: - case RF5372: - case RF5390: -@@ -3203,6 +3204,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev, - rt2x00_rf(rt2x00dev, RF3290) || - rt2x00_rf(rt2x00dev, RF3322) || - rt2x00_rf(rt2x00dev, RF5360) || -+ rt2x00_rf(rt2x00dev, RF5362) || - rt2x00_rf(rt2x00dev, RF5370) || - rt2x00_rf(rt2x00dev, RF5372) || - rt2x00_rf(rt2x00dev, RF5390) || -@@ -4317,6 +4319,7 @@ void rt2800_vco_calibration(struct rt2x00_dev *rt2x00dev) - case RF3070: - case RF3290: - case RF5360: -+ case RF5362: - case RF5370: - case RF5372: - case RF5390: -@@ -7095,6 +7098,7 @@ static int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev) - case RF3320: - case RF3322: - case RF5360: -+ case RF5362: - case RF5370: - case RF5372: - case RF5390: -@@ -7551,6 +7555,7 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev) - case RF3320: - case RF3322: - case RF5360: -+ case RF5362: - case RF5370: - case RF5372: - case RF5390: -@@ -7680,6 +7685,7 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev) - case RF3070: - case RF3290: - case RF5360: -+ case RF5362: - case RF5370: - case RF5372: - case RF5390: -diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c -index 573897b..8444313 100644 ---- a/drivers/net/wireless/rt2x00/rt2800usb.c -+++ b/drivers/net/wireless/rt2x00/rt2800usb.c -@@ -1111,6 +1111,7 @@ static struct usb_device_id rt2800usb_device_table[] = { - /* Ovislink */ - { USB_DEVICE(0x1b75, 0x3071) }, - { USB_DEVICE(0x1b75, 0x3072) }, -+ { USB_DEVICE(0x1b75, 0xa200) }, - /* Para */ - { USB_DEVICE(0x20b8, 0x8888) }, - /* Pegatron */ -diff --git a/drivers/of/base.c b/drivers/of/base.c -index 293ed4b..902b1b0 100644 ---- a/drivers/of/base.c -+++ b/drivers/of/base.c -@@ -1277,52 +1277,6 @@ int of_property_read_string(struct device_node *np, const char *propname, - EXPORT_SYMBOL_GPL(of_property_read_string); - - /** -- * of_property_read_string_index - Find and read a string from a multiple -- * strings property. -- * @np: device node from which the property value is to be read. -- * @propname: name of the property to be searched. -- * @index: index of the string in the list of strings -- * @out_string: pointer to null terminated return string, modified only if -- * return value is 0. -- * -- * Search for a property in a device tree node and retrieve a null -- * terminated string value (pointer to data, not a copy) in the list of strings -- * contained in that property. -- * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if -- * property does not have a value, and -EILSEQ if the string is not -- * null-terminated within the length of the property data. -- * -- * The out_string pointer is modified only if a valid string can be decoded. -- */ --int of_property_read_string_index(struct device_node *np, const char *propname, -- int index, const char **output) --{ -- struct property *prop = of_find_property(np, propname, NULL); -- int i = 0; -- size_t l = 0, total = 0; -- const char *p; -- -- if (!prop) -- return -EINVAL; -- if (!prop->value) -- return -ENODATA; -- if (strnlen(prop->value, prop->length) >= prop->length) -- return -EILSEQ; -- -- p = prop->value; -- -- for (i = 0; total < prop->length; total += l, p += l) { -- l = strlen(p) + 1; -- if (i++ == index) { -- *output = p; -- return 0; -- } -- } -- return -ENODATA; --} --EXPORT_SYMBOL_GPL(of_property_read_string_index); -- --/** - * of_property_match_string() - Find string in a list and return index - * @np: pointer to node containing string list property - * @propname: string list property name -@@ -1348,7 +1302,7 @@ int of_property_match_string(struct device_node *np, const char *propname, - end = p + prop->length; - - for (i = 0; p < end; i++, p += l) { -- l = strlen(p) + 1; -+ l = strnlen(p, end - p) + 1; - if (p + l > end) - return -EILSEQ; - pr_debug("comparing %s with %s\n", string, p); -@@ -1360,39 +1314,41 @@ int of_property_match_string(struct device_node *np, const char *propname, - EXPORT_SYMBOL_GPL(of_property_match_string); - - /** -- * of_property_count_strings - Find and return the number of strings from a -- * multiple strings property. -+ * of_property_read_string_util() - Utility helper for parsing string properties - * @np: device node from which the property value is to be read. - * @propname: name of the property to be searched. -+ * @out_strs: output array of string pointers. -+ * @sz: number of array elements to read. -+ * @skip: Number of strings to skip over at beginning of list. - * -- * Search for a property in a device tree node and retrieve the number of null -- * terminated string contain in it. Returns the number of strings on -- * success, -EINVAL if the property does not exist, -ENODATA if property -- * does not have a value, and -EILSEQ if the string is not null-terminated -- * within the length of the property data. -+ * Don't call this function directly. It is a utility helper for the -+ * of_property_read_string*() family of functions. - */ --int of_property_count_strings(struct device_node *np, const char *propname) -+int of_property_read_string_helper(struct device_node *np, const char *propname, -+ const char **out_strs, size_t sz, int skip) - { - struct property *prop = of_find_property(np, propname, NULL); -- int i = 0; -- size_t l = 0, total = 0; -- const char *p; -+ int l = 0, i = 0; -+ const char *p, *end; - - if (!prop) - return -EINVAL; - if (!prop->value) - return -ENODATA; -- if (strnlen(prop->value, prop->length) >= prop->length) -- return -EILSEQ; -- - p = prop->value; -+ end = p + prop->length; - -- for (i = 0; total < prop->length; total += l, p += l, i++) -- l = strlen(p) + 1; -- -- return i; -+ for (i = 0; p < end && (!out_strs || i < skip + sz); i++, p += l) { -+ l = strnlen(p, end - p) + 1; -+ if (p + l > end) -+ return -EILSEQ; -+ if (out_strs && i >= skip) -+ *out_strs++ = p; -+ } -+ i -= skip; -+ return i <= 0 ? -ENODATA : i; - } --EXPORT_SYMBOL_GPL(of_property_count_strings); -+EXPORT_SYMBOL_GPL(of_property_read_string_helper); - - void of_print_phandle_args(const char *msg, const struct of_phandle_args *args) - { -diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c -index a737cb5..c92de69 100644 ---- a/drivers/of/selftest.c -+++ b/drivers/of/selftest.c -@@ -247,8 +247,9 @@ static void __init of_selftest_parse_phandle_with_args(void) - selftest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc); - } - --static void __init of_selftest_property_match_string(void) -+static void __init of_selftest_property_string(void) - { -+ const char *strings[4]; - struct device_node *np; - int rc; - -@@ -265,13 +266,66 @@ static void __init of_selftest_property_match_string(void) - rc = of_property_match_string(np, "phandle-list-names", "third"); - selftest(rc == 2, "third expected:0 got:%i\n", rc); - rc = of_property_match_string(np, "phandle-list-names", "fourth"); -- selftest(rc == -ENODATA, "unmatched string; rc=%i", rc); -+ selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc); - rc = of_property_match_string(np, "missing-property", "blah"); -- selftest(rc == -EINVAL, "missing property; rc=%i", rc); -+ selftest(rc == -EINVAL, "missing property; rc=%i\n", rc); - rc = of_property_match_string(np, "empty-property", "blah"); -- selftest(rc == -ENODATA, "empty property; rc=%i", rc); -+ selftest(rc == -ENODATA, "empty property; rc=%i\n", rc); - rc = of_property_match_string(np, "unterminated-string", "blah"); -- selftest(rc == -EILSEQ, "unterminated string; rc=%i", rc); -+ selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); -+ -+ /* of_property_count_strings() tests */ -+ rc = of_property_count_strings(np, "string-property"); -+ selftest(rc == 1, "Incorrect string count; rc=%i\n", rc); -+ rc = of_property_count_strings(np, "phandle-list-names"); -+ selftest(rc == 3, "Incorrect string count; rc=%i\n", rc); -+ rc = of_property_count_strings(np, "unterminated-string"); -+ selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); -+ rc = of_property_count_strings(np, "unterminated-string-list"); -+ selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc); -+ -+ /* of_property_read_string_index() tests */ -+ rc = of_property_read_string_index(np, "string-property", 0, strings); -+ selftest(rc == 0 && !strcmp(strings[0], "foobar"), "of_property_read_string_index() failure; rc=%i\n", rc); -+ strings[0] = NULL; -+ rc = of_property_read_string_index(np, "string-property", 1, strings); -+ selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); -+ rc = of_property_read_string_index(np, "phandle-list-names", 0, strings); -+ selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc); -+ rc = of_property_read_string_index(np, "phandle-list-names", 1, strings); -+ selftest(rc == 0 && !strcmp(strings[0], "second"), "of_property_read_string_index() failure; rc=%i\n", rc); -+ rc = of_property_read_string_index(np, "phandle-list-names", 2, strings); -+ selftest(rc == 0 && !strcmp(strings[0], "third"), "of_property_read_string_index() failure; rc=%i\n", rc); -+ strings[0] = NULL; -+ rc = of_property_read_string_index(np, "phandle-list-names", 3, strings); -+ selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); -+ strings[0] = NULL; -+ rc = of_property_read_string_index(np, "unterminated-string", 0, strings); -+ selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); -+ rc = of_property_read_string_index(np, "unterminated-string-list", 0, strings); -+ selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc); -+ strings[0] = NULL; -+ rc = of_property_read_string_index(np, "unterminated-string-list", 2, strings); /* should fail */ -+ selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); -+ strings[1] = NULL; -+ -+ /* of_property_read_string_array() tests */ -+ rc = of_property_read_string_array(np, "string-property", strings, 4); -+ selftest(rc == 1, "Incorrect string count; rc=%i\n", rc); -+ rc = of_property_read_string_array(np, "phandle-list-names", strings, 4); -+ selftest(rc == 3, "Incorrect string count; rc=%i\n", rc); -+ rc = of_property_read_string_array(np, "unterminated-string", strings, 4); -+ selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); -+ /* -- An incorrectly formed string should cause a failure */ -+ rc = of_property_read_string_array(np, "unterminated-string-list", strings, 4); -+ selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc); -+ /* -- parsing the correctly formed strings should still work: */ -+ strings[2] = NULL; -+ rc = of_property_read_string_array(np, "unterminated-string-list", strings, 2); -+ selftest(rc == 2 && strings[2] == NULL, "of_property_read_string_array() failure; rc=%i\n", rc); -+ strings[1] = NULL; -+ rc = of_property_read_string_array(np, "phandle-list-names", strings, 1); -+ selftest(rc == 1 && strings[1] == NULL, "Overwrote end of string array; rc=%i, str='%s'\n", rc, strings[1]); - } - - #define propcmp(p1, p2) (((p1)->length == (p2)->length) && \ -@@ -783,7 +837,7 @@ static int __init of_selftest(void) - of_selftest_find_node_by_name(); - of_selftest_dynamic(); - of_selftest_parse_phandle_with_args(); -- of_selftest_property_match_string(); -+ of_selftest_property_string(); - of_selftest_property_copy(); - of_selftest_changeset(); - of_selftest_parse_interrupts(); -diff --git a/drivers/of/testcase-data/tests-phandle.dtsi b/drivers/of/testcase-data/tests-phandle.dtsi -index ce0fe08..5b1527e 100644 ---- a/drivers/of/testcase-data/tests-phandle.dtsi -+++ b/drivers/of/testcase-data/tests-phandle.dtsi -@@ -39,7 +39,9 @@ - phandle-list-bad-args = <&provider2 1 0>, - <&provider3 0>; - empty-property; -+ string-property = "foobar"; - unterminated-string = [40 41 42 43]; -+ unterminated-string-list = "first", "second", [40 41 42 43]; - }; - }; - }; -diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c -index 76ef791..6d04771 100644 ---- a/drivers/pci/pci-sysfs.c -+++ b/drivers/pci/pci-sysfs.c -@@ -185,7 +185,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr, - } - static DEVICE_ATTR_RO(modalias); - --static ssize_t enabled_store(struct device *dev, struct device_attribute *attr, -+static ssize_t enable_store(struct device *dev, struct device_attribute *attr, - const char *buf, size_t count) - { - struct pci_dev *pdev = to_pci_dev(dev); -@@ -210,7 +210,7 @@ static ssize_t enabled_store(struct device *dev, struct device_attribute *attr, - return result < 0 ? result : count; - } - --static ssize_t enabled_show(struct device *dev, struct device_attribute *attr, -+static ssize_t enable_show(struct device *dev, struct device_attribute *attr, - char *buf) - { - struct pci_dev *pdev; -@@ -218,7 +218,7 @@ static ssize_t enabled_show(struct device *dev, struct device_attribute *attr, - pdev = to_pci_dev(dev); - return sprintf(buf, "%u\n", atomic_read(&pdev->enable_cnt)); - } --static DEVICE_ATTR_RW(enabled); -+static DEVICE_ATTR_RW(enable); - - #ifdef CONFIG_NUMA - static ssize_t numa_node_show(struct device *dev, struct device_attribute *attr, -@@ -564,7 +564,7 @@ static struct attribute *pci_dev_attrs[] = { - #endif - &dev_attr_dma_mask_bits.attr, - &dev_attr_consistent_dma_mask_bits.attr, -- &dev_attr_enabled.attr, -+ &dev_attr_enable.attr, - &dev_attr_broken_parity_status.attr, - &dev_attr_msi_bus.attr, - #if defined(CONFIG_PM_RUNTIME) && defined(CONFIG_ACPI) -diff --git a/drivers/phy/phy-omap-usb2.c b/drivers/phy/phy-omap-usb2.c -index 93d7835..acc13f8 100644 ---- a/drivers/phy/phy-omap-usb2.c -+++ b/drivers/phy/phy-omap-usb2.c -@@ -262,14 +262,16 @@ static int omap_usb2_probe(struct platform_device *pdev) - otg->phy = &phy->phy; - - platform_set_drvdata(pdev, phy); -+ pm_runtime_enable(phy->dev); - - generic_phy = devm_phy_create(phy->dev, NULL, &ops, NULL); -- if (IS_ERR(generic_phy)) -+ if (IS_ERR(generic_phy)) { -+ pm_runtime_disable(phy->dev); - return PTR_ERR(generic_phy); -+ } - - phy_set_drvdata(generic_phy, phy); - -- pm_runtime_enable(phy->dev); - phy_provider = devm_of_phy_provider_register(phy->dev, - of_phy_simple_xlate); - if (IS_ERR(phy_provider)) { -diff --git a/drivers/pinctrl/pinctrl-baytrail.c b/drivers/pinctrl/pinctrl-baytrail.c -index e12e5b0..c23d8ded 100644 ---- a/drivers/pinctrl/pinctrl-baytrail.c -+++ b/drivers/pinctrl/pinctrl-baytrail.c -@@ -318,7 +318,7 @@ static int byt_gpio_direction_output(struct gpio_chip *chip, - "Potential Error: Setting GPIO with direct_irq_en to output"); - - reg_val = readl(reg) | BYT_DIR_MASK; -- reg_val &= ~BYT_OUTPUT_EN; -+ reg_val &= ~(BYT_OUTPUT_EN | BYT_INPUT_EN); - - if (value) - writel(reg_val | BYT_LEVEL, reg); -diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c -index 96a0b75..26c4fd1 100644 ---- a/drivers/platform/x86/acer-wmi.c -+++ b/drivers/platform/x86/acer-wmi.c -@@ -579,6 +579,17 @@ static const struct dmi_system_id video_vendor_dmi_table[] __initconst = { - DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5741"), - }, - }, -+ { -+ /* -+ * Note no video_set_backlight_video_vendor, we must use the -+ * acer interface, as there is no native backlight interface. -+ */ -+ .ident = "Acer KAV80", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "KAV80"), -+ }, -+ }, - {} - }; - -diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c -index 5a59665..ff765d8 100644 ---- a/drivers/platform/x86/samsung-laptop.c -+++ b/drivers/platform/x86/samsung-laptop.c -@@ -1561,6 +1561,16 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = { - }, - { - .callback = samsung_dmi_matched, -+ .ident = "NC210", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "NC210/NC110"), -+ DMI_MATCH(DMI_BOARD_NAME, "NC210/NC110"), -+ }, -+ .driver_data = &samsung_broken_acpi_video, -+ }, -+ { -+ .callback = samsung_dmi_matched, - .ident = "730U3E/740U3E", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), -diff --git a/drivers/power/charger-manager.c b/drivers/power/charger-manager.c -index 9e4dab4..ef1f4c9 100644 ---- a/drivers/power/charger-manager.c -+++ b/drivers/power/charger-manager.c -@@ -1720,6 +1720,11 @@ static int charger_manager_probe(struct platform_device *pdev) - return -EINVAL; - } - -+ if (!desc->psy_fuel_gauge) { -+ dev_err(&pdev->dev, "No fuel gauge power supply defined\n"); -+ return -EINVAL; -+ } -+ - /* Counting index only */ - while (desc->psy_charger_stat[i]) - i++; -diff --git a/drivers/regulator/max77693.c b/drivers/regulator/max77693.c -index c67ff05..d158f71 100644 ---- a/drivers/regulator/max77693.c -+++ b/drivers/regulator/max77693.c -@@ -227,7 +227,7 @@ static int max77693_pmic_probe(struct platform_device *pdev) - struct max77693_dev *iodev = dev_get_drvdata(pdev->dev.parent); - struct max77693_regulator_data *rdata = NULL; - int num_rdata, i; -- struct regulator_config config; -+ struct regulator_config config = { }; - - num_rdata = max77693_pmic_init_rdata(&pdev->dev, &rdata); - if (!rdata || num_rdata <= 0) { -diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig -index a168e96..54ef393 100644 ---- a/drivers/rtc/Kconfig -+++ b/drivers/rtc/Kconfig -@@ -806,7 +806,7 @@ config RTC_DRV_DA9063 - - config RTC_DRV_EFI - tristate "EFI RTC" -- depends on EFI -+ depends on EFI && !X86 - help - If you say yes here you will get support for the EFI - Real Time Clock. -diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -index e2beab9..4747d2c 100644 ---- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c -+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -@@ -757,7 +757,16 @@ static void tcm_qla2xxx_clear_nacl_from_fcport_map(struct qla_tgt_sess *sess) - pr_debug("fc_rport domain: port_id 0x%06x\n", nacl->nport_id); - - node = btree_remove32(&lport->lport_fcport_map, nacl->nport_id); -- WARN_ON(node && (node != se_nacl)); -+ if (WARN_ON(node && (node != se_nacl))) { -+ /* -+ * The nacl no longer matches what we think it should be. -+ * Most likely a new dynamic acl has been added while -+ * someone dropped the hardware lock. It clearly is a -+ * bug elsewhere, but this bit can't make things worse. -+ */ -+ btree_insert32(&lport->lport_fcport_map, nacl->nport_id, -+ node, GFP_ATOMIC); -+ } - - pr_debug("Removed from fcport_map: %p for WWNN: 0x%016LX, port_id: 0x%06x\n", - se_nacl, nacl->nport_wwnn, nacl->nport_id); -diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c -index aaea4b9..7cb8c73 100644 ---- a/drivers/scsi/scsi_lib.c -+++ b/drivers/scsi/scsi_lib.c -@@ -1887,6 +1887,11 @@ static int scsi_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *req) - req->cmd_flags |= REQ_DONTPREP; - } - -+ if (blk_queue_tagged(q)) -+ req->cmd_flags |= REQ_QUEUED; -+ else -+ req->cmd_flags &= ~REQ_QUEUED; -+ - scsi_init_cmd_errh(cmd); - cmd->scsi_done = scsi_mq_done; - -diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c -index 5021ddf..fde7113 100644 ---- a/drivers/spi/spi-fsl-dspi.c -+++ b/drivers/spi/spi-fsl-dspi.c -@@ -46,7 +46,7 @@ - - #define SPI_TCR 0x08 - --#define SPI_CTAR(x) (0x0c + (x * 4)) -+#define SPI_CTAR(x) (0x0c + (((x) & 0x3) * 4)) - #define SPI_CTAR_FMSZ(x) (((x) & 0x0000000f) << 27) - #define SPI_CTAR_CPOL(x) ((x) << 26) - #define SPI_CTAR_CPHA(x) ((x) << 25) -@@ -70,7 +70,7 @@ - - #define SPI_PUSHR 0x34 - #define SPI_PUSHR_CONT (1 << 31) --#define SPI_PUSHR_CTAS(x) (((x) & 0x00000007) << 28) -+#define SPI_PUSHR_CTAS(x) (((x) & 0x00000003) << 28) - #define SPI_PUSHR_EOQ (1 << 27) - #define SPI_PUSHR_CTCNT (1 << 26) - #define SPI_PUSHR_PCS(x) (((1 << x) & 0x0000003f) << 16) -diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c -index f1f0a58..dbd576d 100644 ---- a/drivers/spi/spi-pl022.c -+++ b/drivers/spi/spi-pl022.c -@@ -1074,7 +1074,7 @@ err_rxdesc: - pl022->sgt_tx.nents, DMA_TO_DEVICE); - err_tx_sgmap: - dma_unmap_sg(rxchan->device->dev, pl022->sgt_rx.sgl, -- pl022->sgt_tx.nents, DMA_FROM_DEVICE); -+ pl022->sgt_rx.nents, DMA_FROM_DEVICE); - err_rx_sgmap: - sg_free_table(&pl022->sgt_tx); - err_alloc_tx_sg: -diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c -index 46f45ca..9090dad 100644 ---- a/drivers/spi/spi-pxa2xx.c -+++ b/drivers/spi/spi-pxa2xx.c -@@ -1276,7 +1276,9 @@ static int pxa2xx_spi_suspend(struct device *dev) - if (status != 0) - return status; - write_SSCR0(0, drv_data->ioaddr); -- clk_disable_unprepare(ssp->clk); -+ -+ if (!pm_runtime_suspended(dev)) -+ clk_disable_unprepare(ssp->clk); - - return 0; - } -@@ -1290,7 +1292,8 @@ static int pxa2xx_spi_resume(struct device *dev) - pxa2xx_spi_dma_resume(drv_data); - - /* Enable the SSP clock */ -- clk_prepare_enable(ssp->clk); -+ if (!pm_runtime_suspended(dev)) -+ clk_prepare_enable(ssp->clk); - - /* Restore LPSS private register bits */ - lpss_ssp_setup(drv_data); -diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c -index 2182c74..7a2e9c0 100644 ---- a/drivers/staging/comedi/comedi_fops.c -+++ b/drivers/staging/comedi/comedi_fops.c -@@ -1462,10 +1462,7 @@ static int __comedi_get_user_chanlist(struct comedi_device *dev, - unsigned int *chanlist; - int ret; - -- /* user_chanlist could be NULL for do_cmdtest ioctls */ -- if (!user_chanlist) -- return 0; -- -+ cmd->chanlist = NULL; - chanlist = memdup_user(user_chanlist, - cmd->chanlist_len * sizeof(unsigned int)); - if (IS_ERR(chanlist)) -@@ -1609,13 +1606,18 @@ static int do_cmdtest_ioctl(struct comedi_device *dev, - - s = &dev->subdevices[cmd.subdev]; - -- /* load channel/gain list */ -- ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd); -- if (ret) -- return ret; -+ /* user_chanlist can be NULL for COMEDI_CMDTEST ioctl */ -+ if (user_chanlist) { -+ /* load channel/gain list */ -+ ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd); -+ if (ret) -+ return ret; -+ } - - ret = s->do_cmdtest(dev, s, &cmd); - -+ kfree(cmd.chanlist); /* free kernel copy of user chanlist */ -+ - /* restore chanlist pointer before copying back */ - cmd.chanlist = (unsigned int __force *)user_chanlist; - -diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c -index 468327f..d343611 100644 ---- a/drivers/staging/iio/adc/mxs-lradc.c -+++ b/drivers/staging/iio/adc/mxs-lradc.c -@@ -1565,14 +1565,16 @@ static int mxs_lradc_probe(struct platform_device *pdev) - /* Grab all IRQ sources */ - for (i = 0; i < of_cfg->irq_count; i++) { - lradc->irq[i] = platform_get_irq(pdev, i); -- if (lradc->irq[i] < 0) -- return lradc->irq[i]; -+ if (lradc->irq[i] < 0) { -+ ret = lradc->irq[i]; -+ goto err_clk; -+ } - - ret = devm_request_irq(dev, lradc->irq[i], - mxs_lradc_handle_irq, 0, - of_cfg->irq_name[i], iio); - if (ret) -- return ret; -+ goto err_clk; - } - - lradc->vref_mv = of_cfg->vref_mv; -@@ -1594,7 +1596,7 @@ static int mxs_lradc_probe(struct platform_device *pdev) - &mxs_lradc_trigger_handler, - &mxs_lradc_buffer_ops); - if (ret) -- return ret; -+ goto err_clk; - - ret = mxs_lradc_trigger_init(iio); - if (ret) -@@ -1649,6 +1651,8 @@ err_dev: - mxs_lradc_trigger_remove(iio); - err_trig: - iio_triggered_buffer_cleanup(iio); -+err_clk: -+ clk_disable_unprepare(lradc->clk); - return ret; - } - -diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c -index 2b96665..97d4b3f 100644 ---- a/drivers/staging/iio/impedance-analyzer/ad5933.c -+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c -@@ -115,6 +115,7 @@ static const struct iio_chan_spec ad5933_channels[] = { - .channel = 0, - .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED), - .address = AD5933_REG_TEMP_DATA, -+ .scan_index = -1, - .scan_type = { - .sign = 's', - .realbits = 14, -@@ -124,9 +125,7 @@ static const struct iio_chan_spec ad5933_channels[] = { - .type = IIO_VOLTAGE, - .indexed = 1, - .channel = 0, -- .extend_name = "real_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | -- BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "real", - .address = AD5933_REG_REAL_DATA, - .scan_index = 0, - .scan_type = { -@@ -138,9 +137,7 @@ static const struct iio_chan_spec ad5933_channels[] = { - .type = IIO_VOLTAGE, - .indexed = 1, - .channel = 0, -- .extend_name = "imag_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | -- BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "imag", - .address = AD5933_REG_IMAG_DATA, - .scan_index = 1, - .scan_type = { -@@ -748,14 +745,14 @@ static int ad5933_probe(struct i2c_client *client, - indio_dev->name = id->name; - indio_dev->modes = INDIO_DIRECT_MODE; - indio_dev->channels = ad5933_channels; -- indio_dev->num_channels = 1; /* only register temp0_input */ -+ indio_dev->num_channels = ARRAY_SIZE(ad5933_channels); - - ret = ad5933_register_ring_funcs_and_init(indio_dev); - if (ret) - goto error_disable_reg; - -- /* skip temp0_input, register in0_(real|imag)_raw */ -- ret = iio_buffer_register(indio_dev, &ad5933_channels[1], 2); -+ ret = iio_buffer_register(indio_dev, ad5933_channels, -+ ARRAY_SIZE(ad5933_channels)); - if (ret) - goto error_unreg_ring; - -diff --git a/drivers/staging/iio/meter/ade7758.h b/drivers/staging/iio/meter/ade7758.h -index 0731820..e8c98cf 100644 ---- a/drivers/staging/iio/meter/ade7758.h -+++ b/drivers/staging/iio/meter/ade7758.h -@@ -119,7 +119,6 @@ struct ade7758_state { - u8 *tx; - u8 *rx; - struct mutex buf_lock; -- const struct iio_chan_spec *ade7758_ring_channels; - struct spi_transfer ring_xfer[4]; - struct spi_message ring_msg; - /* -diff --git a/drivers/staging/iio/meter/ade7758_core.c b/drivers/staging/iio/meter/ade7758_core.c -index cba183e..94d9914 100644 ---- a/drivers/staging/iio/meter/ade7758_core.c -+++ b/drivers/staging/iio/meter/ade7758_core.c -@@ -630,9 +630,6 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_VOLTAGE, - .indexed = 1, - .channel = 0, -- .extend_name = "raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .address = AD7758_WT(AD7758_PHASE_A, AD7758_VOLTAGE), - .scan_index = 0, - .scan_type = { -@@ -644,9 +641,6 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_CURRENT, - .indexed = 1, - .channel = 0, -- .extend_name = "raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .address = AD7758_WT(AD7758_PHASE_A, AD7758_CURRENT), - .scan_index = 1, - .scan_type = { -@@ -658,9 +652,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 0, -- .extend_name = "apparent_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "apparent", - .address = AD7758_WT(AD7758_PHASE_A, AD7758_APP_PWR), - .scan_index = 2, - .scan_type = { -@@ -672,9 +664,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 0, -- .extend_name = "active_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "active", - .address = AD7758_WT(AD7758_PHASE_A, AD7758_ACT_PWR), - .scan_index = 3, - .scan_type = { -@@ -686,9 +676,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 0, -- .extend_name = "reactive_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "reactive", - .address = AD7758_WT(AD7758_PHASE_A, AD7758_REACT_PWR), - .scan_index = 4, - .scan_type = { -@@ -700,9 +688,6 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_VOLTAGE, - .indexed = 1, - .channel = 1, -- .extend_name = "raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .address = AD7758_WT(AD7758_PHASE_B, AD7758_VOLTAGE), - .scan_index = 5, - .scan_type = { -@@ -714,9 +699,6 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_CURRENT, - .indexed = 1, - .channel = 1, -- .extend_name = "raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .address = AD7758_WT(AD7758_PHASE_B, AD7758_CURRENT), - .scan_index = 6, - .scan_type = { -@@ -728,9 +710,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 1, -- .extend_name = "apparent_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "apparent", - .address = AD7758_WT(AD7758_PHASE_B, AD7758_APP_PWR), - .scan_index = 7, - .scan_type = { -@@ -742,9 +722,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 1, -- .extend_name = "active_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "active", - .address = AD7758_WT(AD7758_PHASE_B, AD7758_ACT_PWR), - .scan_index = 8, - .scan_type = { -@@ -756,9 +734,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 1, -- .extend_name = "reactive_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "reactive", - .address = AD7758_WT(AD7758_PHASE_B, AD7758_REACT_PWR), - .scan_index = 9, - .scan_type = { -@@ -770,9 +746,6 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_VOLTAGE, - .indexed = 1, - .channel = 2, -- .extend_name = "raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .address = AD7758_WT(AD7758_PHASE_C, AD7758_VOLTAGE), - .scan_index = 10, - .scan_type = { -@@ -784,9 +757,6 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_CURRENT, - .indexed = 1, - .channel = 2, -- .extend_name = "raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .address = AD7758_WT(AD7758_PHASE_C, AD7758_CURRENT), - .scan_index = 11, - .scan_type = { -@@ -798,9 +768,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 2, -- .extend_name = "apparent_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "apparent", - .address = AD7758_WT(AD7758_PHASE_C, AD7758_APP_PWR), - .scan_index = 12, - .scan_type = { -@@ -812,9 +780,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 2, -- .extend_name = "active_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "active", - .address = AD7758_WT(AD7758_PHASE_C, AD7758_ACT_PWR), - .scan_index = 13, - .scan_type = { -@@ -826,9 +792,7 @@ static const struct iio_chan_spec ade7758_channels[] = { - .type = IIO_POWER, - .indexed = 1, - .channel = 2, -- .extend_name = "reactive_raw", -- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), -+ .extend_name = "reactive", - .address = AD7758_WT(AD7758_PHASE_C, AD7758_REACT_PWR), - .scan_index = 14, - .scan_type = { -@@ -869,13 +833,14 @@ static int ade7758_probe(struct spi_device *spi) - goto error_free_rx; - } - st->us = spi; -- st->ade7758_ring_channels = &ade7758_channels[0]; - mutex_init(&st->buf_lock); - - indio_dev->name = spi->dev.driver->name; - indio_dev->dev.parent = &spi->dev; - indio_dev->info = &ade7758_info; - indio_dev->modes = INDIO_DIRECT_MODE; -+ indio_dev->channels = ade7758_channels; -+ indio_dev->num_channels = ARRAY_SIZE(ade7758_channels); - - ret = ade7758_configure_ring(indio_dev); - if (ret) -diff --git a/drivers/staging/iio/meter/ade7758_ring.c b/drivers/staging/iio/meter/ade7758_ring.c -index c0accf8..6e90064 100644 ---- a/drivers/staging/iio/meter/ade7758_ring.c -+++ b/drivers/staging/iio/meter/ade7758_ring.c -@@ -85,17 +85,16 @@ static irqreturn_t ade7758_trigger_handler(int irq, void *p) - **/ - static int ade7758_ring_preenable(struct iio_dev *indio_dev) - { -- struct ade7758_state *st = iio_priv(indio_dev); - unsigned channel; - -- if (!bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength)) -+ if (bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength)) - return -EINVAL; - - channel = find_first_bit(indio_dev->active_scan_mask, - indio_dev->masklength); - - ade7758_write_waveform_type(&indio_dev->dev, -- st->ade7758_ring_channels[channel].address); -+ indio_dev->channels[channel].address); - - return 0; - } -diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c -index 98da901..15a1c13 100644 ---- a/drivers/target/target_core_device.c -+++ b/drivers/target/target_core_device.c -@@ -1409,7 +1409,8 @@ int core_dev_add_initiator_node_lun_acl( - * Check to see if there are any existing persistent reservation APTPL - * pre-registrations that need to be enabled for this LUN ACL.. - */ -- core_scsi3_check_aptpl_registration(lun->lun_se_dev, tpg, lun, lacl); -+ core_scsi3_check_aptpl_registration(lun->lun_se_dev, tpg, lun, nacl, -+ lacl->mapped_lun); - return 0; - } - -diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c -index df35786..1aadcfc 100644 ---- a/drivers/target/target_core_pr.c -+++ b/drivers/target/target_core_pr.c -@@ -944,10 +944,10 @@ int core_scsi3_check_aptpl_registration( - struct se_device *dev, - struct se_portal_group *tpg, - struct se_lun *lun, -- struct se_lun_acl *lun_acl) -+ struct se_node_acl *nacl, -+ u32 mapped_lun) - { -- struct se_node_acl *nacl = lun_acl->se_lun_nacl; -- struct se_dev_entry *deve = nacl->device_list[lun_acl->mapped_lun]; -+ struct se_dev_entry *deve = nacl->device_list[mapped_lun]; - - if (dev->dev_reservation_flags & DRF_SPC2_RESERVATIONS) - return 0; -diff --git a/drivers/target/target_core_pr.h b/drivers/target/target_core_pr.h -index 2ee2936..749fd7b 100644 ---- a/drivers/target/target_core_pr.h -+++ b/drivers/target/target_core_pr.h -@@ -60,7 +60,7 @@ extern int core_scsi3_alloc_aptpl_registration( - unsigned char *, u16, u32, int, int, u8); - extern int core_scsi3_check_aptpl_registration(struct se_device *, - struct se_portal_group *, struct se_lun *, -- struct se_lun_acl *); -+ struct se_node_acl *, u32); - extern void core_scsi3_free_pr_reg_from_nacl(struct se_device *, - struct se_node_acl *); - extern void core_scsi3_free_all_registrations(struct se_device *); -diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c -index fddfae6..8d8ecfb 100644 ---- a/drivers/target/target_core_tpg.c -+++ b/drivers/target/target_core_tpg.c -@@ -40,6 +40,7 @@ - #include <target/target_core_fabric.h> - - #include "target_core_internal.h" -+#include "target_core_pr.h" - - extern struct se_device *g_lun0_dev; - -@@ -166,6 +167,13 @@ void core_tpg_add_node_to_devs( - - core_enable_device_list_for_node(lun, NULL, lun->unpacked_lun, - lun_access, acl, tpg); -+ /* -+ * Check to see if there are any existing persistent reservation -+ * APTPL pre-registrations that need to be enabled for this dynamic -+ * LUN ACL now.. -+ */ -+ core_scsi3_check_aptpl_registration(dev, tpg, lun, acl, -+ lun->unpacked_lun); - spin_lock(&tpg->tpg_lun_lock); - } - spin_unlock(&tpg->tpg_lun_lock); -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 7fa62fc..ab61014 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -1877,8 +1877,7 @@ static void transport_complete_qf(struct se_cmd *cmd) - if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) { - trace_target_cmd_complete(cmd); - ret = cmd->se_tfo->queue_status(cmd); -- if (ret) -- goto out; -+ goto out; - } - - switch (cmd->data_direction) { -diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c -index 0da0b54..077570a 100644 ---- a/drivers/tty/serial/msm_serial.c -+++ b/drivers/tty/serial/msm_serial.c -@@ -683,17 +683,6 @@ static void msm_power(struct uart_port *port, unsigned int state, - } - - #ifdef CONFIG_CONSOLE_POLL --static int msm_poll_init(struct uart_port *port) --{ -- struct msm_port *msm_port = UART_TO_MSM(port); -- -- /* Enable single character mode on RX FIFO */ -- if (msm_port->is_uartdm >= UARTDM_1P4) -- msm_write(port, UARTDM_DMEN_RX_SC_ENABLE, UARTDM_DMEN); -- -- return 0; --} -- - static int msm_poll_get_char_single(struct uart_port *port) - { - struct msm_port *msm_port = UART_TO_MSM(port); -@@ -705,7 +694,7 @@ static int msm_poll_get_char_single(struct uart_port *port) - return msm_read(port, rf_reg) & 0xff; - } - --static int msm_poll_get_char_dm_1p3(struct uart_port *port) -+static int msm_poll_get_char_dm(struct uart_port *port) - { - int c; - static u32 slop; -@@ -729,6 +718,10 @@ static int msm_poll_get_char_dm_1p3(struct uart_port *port) - slop = msm_read(port, UARTDM_RF); - c = sp[0]; - count--; -+ msm_write(port, UART_CR_CMD_RESET_STALE_INT, UART_CR); -+ msm_write(port, 0xFFFFFF, UARTDM_DMRX); -+ msm_write(port, UART_CR_CMD_STALE_EVENT_ENABLE, -+ UART_CR); - } else { - c = NO_POLL_CHAR; - } -@@ -752,8 +745,8 @@ static int msm_poll_get_char(struct uart_port *port) - imr = msm_read(port, UART_IMR); - msm_write(port, 0, UART_IMR); - -- if (msm_port->is_uartdm == UARTDM_1P3) -- c = msm_poll_get_char_dm_1p3(port); -+ if (msm_port->is_uartdm) -+ c = msm_poll_get_char_dm(port); - else - c = msm_poll_get_char_single(port); - -@@ -812,7 +805,6 @@ static struct uart_ops msm_uart_pops = { - .verify_port = msm_verify_port, - .pm = msm_power, - #ifdef CONFIG_CONSOLE_POLL -- .poll_init = msm_poll_init, - .poll_get_char = msm_poll_get_char, - .poll_put_char = msm_poll_put_char, - #endif -diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index 29a7be4..0f03988 100644 ---- a/drivers/tty/serial/serial_core.c -+++ b/drivers/tty/serial/serial_core.c -@@ -362,7 +362,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios, - * The spd_hi, spd_vhi, spd_shi, spd_warp kludge... - * Die! Die! Die! - */ -- if (baud == 38400) -+ if (try == 0 && baud == 38400) - baud = altbaud; - - /* -diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index 8fbad34..848c17a 100644 ---- a/drivers/tty/tty_io.c -+++ b/drivers/tty/tty_io.c -@@ -1686,6 +1686,7 @@ int tty_release(struct inode *inode, struct file *filp) - int pty_master, tty_closing, o_tty_closing, do_sleep; - int idx; - char buf[64]; -+ long timeout = 0; - - if (tty_paranoia_check(tty, inode, __func__)) - return 0; -@@ -1770,7 +1771,11 @@ int tty_release(struct inode *inode, struct file *filp) - __func__, tty_name(tty, buf)); - tty_unlock_pair(tty, o_tty); - mutex_unlock(&tty_mutex); -- schedule(); -+ schedule_timeout_killable(timeout); -+ if (timeout < 120 * HZ) -+ timeout = 2 * timeout + 1; -+ else -+ timeout = MAX_SCHEDULE_TIMEOUT; - } - - /* -diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c -index 610b720..59b25e0 100644 ---- a/drivers/tty/vt/consolemap.c -+++ b/drivers/tty/vt/consolemap.c -@@ -539,6 +539,12 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list) - - /* Save original vc_unipagdir_loc in case we allocate a new one */ - p = *vc->vc_uni_pagedir_loc; -+ -+ if (!p) { -+ err = -EINVAL; -+ -+ goto out_unlock; -+ } - - if (p->refcount > 1) { - int j, k; -@@ -623,6 +629,7 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list) - set_inverse_transl(vc, p, i); /* Update inverse translations */ - set_inverse_trans_unicode(vc, p); - -+out_unlock: - console_unlock(); - return err; - } -diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c -index 619d13e..4ecb650 100644 ---- a/drivers/usb/chipidea/core.c -+++ b/drivers/usb/chipidea/core.c -@@ -732,7 +732,6 @@ static int ci_hdrc_remove(struct platform_device *pdev) - ci_role_destroy(ci); - ci_hdrc_enter_lpm(ci, true); - usb_phy_shutdown(ci->transceiver); -- kfree(ci->hw_bank.regmap); - - return 0; - } -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index e934e19..7daaef1 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -145,8 +145,15 @@ static int acm_ctrl_msg(struct acm *acm, int request, int value, - /* devices aren't required to support these requests. - * the cdc acm descriptor tells whether they do... - */ --#define acm_set_control(acm, control) \ -- acm_ctrl_msg(acm, USB_CDC_REQ_SET_CONTROL_LINE_STATE, control, NULL, 0) -+static inline int acm_set_control(struct acm *acm, int control) -+{ -+ if (acm->quirks & QUIRK_CONTROL_LINE_STATE) -+ return -EOPNOTSUPP; -+ -+ return acm_ctrl_msg(acm, USB_CDC_REQ_SET_CONTROL_LINE_STATE, -+ control, NULL, 0); -+} -+ - #define acm_set_line(acm, line) \ - acm_ctrl_msg(acm, USB_CDC_REQ_SET_LINE_CODING, 0, line, sizeof *(line)) - #define acm_send_break(acm, ms) \ -@@ -980,11 +987,12 @@ static void acm_tty_set_termios(struct tty_struct *tty, - /* FIXME: Needs to clear unsupported bits in the termios */ - acm->clocal = ((termios->c_cflag & CLOCAL) != 0); - -- if (!newline.dwDTERate) { -+ if (C_BAUD(tty) == B0) { - newline.dwDTERate = acm->line.dwDTERate; - newctrl &= ~ACM_CTRL_DTR; -- } else -+ } else if (termios_old && (termios_old->c_cflag & CBAUD) == B0) { - newctrl |= ACM_CTRL_DTR; -+ } - - if (newctrl != acm->ctrlout) - acm_set_control(acm, acm->ctrlout = newctrl); -@@ -1314,6 +1322,7 @@ made_compressed_probe: - tty_port_init(&acm->port); - acm->port.ops = &acm_port_ops; - init_usb_anchor(&acm->delayed); -+ acm->quirks = quirks; - - buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma); - if (!buf) { -@@ -1681,6 +1690,9 @@ static const struct usb_device_id acm_ids[] = { - { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */ - .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ - }, -+ { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */ -+ .driver_info = QUIRK_CONTROL_LINE_STATE, }, -+ { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ - { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */ - }, - /* Motorola H24 HSPA module: */ -diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h -index fc75651..d3251eb 100644 ---- a/drivers/usb/class/cdc-acm.h -+++ b/drivers/usb/class/cdc-acm.h -@@ -121,6 +121,7 @@ struct acm { - unsigned int throttle_req:1; /* throttle requested */ - u8 bInterval; - struct usb_anchor delayed; /* writes queued for a device about to be woken */ -+ unsigned long quirks; - }; - - #define CDC_DATA_INTERFACE_TYPE 0x0a -@@ -132,3 +133,4 @@ struct acm { - #define NOT_A_MODEM BIT(3) - #define NO_DATA_INTERFACE BIT(4) - #define IGNORE_DEVICE BIT(5) -+#define QUIRK_CONTROL_LINE_STATE BIT(6) -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index 487abcf..258e6fe 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -2057,6 +2057,8 @@ int usb_alloc_streams(struct usb_interface *interface, - return -EINVAL; - if (dev->speed != USB_SPEED_SUPER) - return -EINVAL; -+ if (dev->state < USB_STATE_CONFIGURED) -+ return -ENODEV; - - for (i = 0; i < num_eps; i++) { - /* Streams only apply to bulk endpoints. */ -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index dc84915..674c262 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -4540,6 +4540,9 @@ check_highspeed (struct usb_hub *hub, struct usb_device *udev, int port1) - struct usb_qualifier_descriptor *qual; - int status; - -+ if (udev->quirks & USB_QUIRK_DEVICE_QUALIFIER) -+ return; -+ - qual = kmalloc (sizeof *qual, GFP_KERNEL); - if (qual == NULL) - return; -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 814e712..39b4081 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -93,6 +93,16 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x04e8, 0x6601), .driver_info = - USB_QUIRK_CONFIG_INTF_STRINGS }, - -+ /* Elan Touchscreen */ -+ { USB_DEVICE(0x04f3, 0x0089), .driver_info = -+ USB_QUIRK_DEVICE_QUALIFIER }, -+ -+ { USB_DEVICE(0x04f3, 0x009b), .driver_info = -+ USB_QUIRK_DEVICE_QUALIFIER }, -+ -+ { USB_DEVICE(0x04f3, 0x016f), .driver_info = -+ USB_QUIRK_DEVICE_QUALIFIER }, -+ - /* Roland SC-8820 */ - { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME }, - -diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c -index fc0de375..97a5a0c 100644 ---- a/drivers/usb/dwc3/dwc3-omap.c -+++ b/drivers/usb/dwc3/dwc3-omap.c -@@ -599,7 +599,7 @@ static int dwc3_omap_prepare(struct device *dev) - { - struct dwc3_omap *omap = dev_get_drvdata(dev); - -- dwc3_omap_write_irqmisc_set(omap, 0x00); -+ dwc3_omap_disable_irqs(omap); - - return 0; - } -@@ -607,19 +607,8 @@ static int dwc3_omap_prepare(struct device *dev) - static void dwc3_omap_complete(struct device *dev) - { - struct dwc3_omap *omap = dev_get_drvdata(dev); -- u32 reg; - -- reg = (USBOTGSS_IRQMISC_OEVT | -- USBOTGSS_IRQMISC_DRVVBUS_RISE | -- USBOTGSS_IRQMISC_CHRGVBUS_RISE | -- USBOTGSS_IRQMISC_DISCHRGVBUS_RISE | -- USBOTGSS_IRQMISC_IDPULLUP_RISE | -- USBOTGSS_IRQMISC_DRVVBUS_FALL | -- USBOTGSS_IRQMISC_CHRGVBUS_FALL | -- USBOTGSS_IRQMISC_DISCHRGVBUS_FALL | -- USBOTGSS_IRQMISC_IDPULLUP_FALL); -- -- dwc3_omap_write_irqmisc_set(omap, reg); -+ dwc3_omap_enable_irqs(omap); - } - - static int dwc3_omap_suspend(struct device *dev) -diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c -index 21a3520..0985ff7 100644 ---- a/drivers/usb/dwc3/ep0.c -+++ b/drivers/usb/dwc3/ep0.c -@@ -251,7 +251,7 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc) - - /* stall is always issued on EP0 */ - dep = dwc->eps[0]; -- __dwc3_gadget_ep_set_halt(dep, 1); -+ __dwc3_gadget_ep_set_halt(dep, 1, false); - dep->flags = DWC3_EP_ENABLED; - dwc->delayed_status = false; - -@@ -461,7 +461,7 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc, - return -EINVAL; - if (set == 0 && (dep->flags & DWC3_EP_WEDGE)) - break; -- ret = __dwc3_gadget_ep_set_halt(dep, set); -+ ret = __dwc3_gadget_ep_set_halt(dep, set, true); - if (ret) - return -EINVAL; - break; -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 490a6ca..8cbbb54 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -615,12 +615,11 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep, - if (!usb_endpoint_xfer_isoc(desc)) - return 0; - -- memset(&trb_link, 0, sizeof(trb_link)); -- - /* Link TRB for ISOC. The HWO bit is never reset */ - trb_st_hw = &dep->trb_pool[0]; - - trb_link = &dep->trb_pool[DWC3_TRB_NUM - 1]; -+ memset(trb_link, 0, sizeof(*trb_link)); - - trb_link->bpl = lower_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw)); - trb_link->bph = upper_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw)); -@@ -671,7 +670,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) - - /* make sure HW endpoint isn't stalled */ - if (dep->flags & DWC3_EP_STALL) -- __dwc3_gadget_ep_set_halt(dep, 0); -+ __dwc3_gadget_ep_set_halt(dep, 0, false); - - reg = dwc3_readl(dwc->regs, DWC3_DALEPENA); - reg &= ~DWC3_DALEPENA_EP(dep->number); -@@ -1287,7 +1286,7 @@ out0: - return ret; - } - --int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value) -+int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol) - { - struct dwc3_gadget_ep_cmd_params params; - struct dwc3 *dwc = dep->dwc; -@@ -1296,6 +1295,14 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value) - memset(¶ms, 0x00, sizeof(params)); - - if (value) { -+ if (!protocol && ((dep->direction && dep->flags & DWC3_EP_BUSY) || -+ (!list_empty(&dep->req_queued) || -+ !list_empty(&dep->request_list)))) { -+ dev_dbg(dwc->dev, "%s: pending request, cannot halt\n", -+ dep->name); -+ return -EAGAIN; -+ } -+ - ret = dwc3_send_gadget_ep_cmd(dwc, dep->number, - DWC3_DEPCMD_SETSTALL, ¶ms); - if (ret) -@@ -1333,7 +1340,7 @@ static int dwc3_gadget_ep_set_halt(struct usb_ep *ep, int value) - goto out; - } - -- ret = __dwc3_gadget_ep_set_halt(dep, value); -+ ret = __dwc3_gadget_ep_set_halt(dep, value, false); - out: - spin_unlock_irqrestore(&dwc->lock, flags); - -@@ -1353,7 +1360,7 @@ static int dwc3_gadget_ep_set_wedge(struct usb_ep *ep) - if (dep->number == 0 || dep->number == 1) - return dwc3_gadget_ep0_set_halt(ep, 1); - else -- return dwc3_gadget_ep_set_halt(ep, 1); -+ return __dwc3_gadget_ep_set_halt(dep, 1, false); - } - - /* -------------------------------------------------------------------------- */ -diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h -index a0ee75b..ac625582 100644 ---- a/drivers/usb/dwc3/gadget.h -+++ b/drivers/usb/dwc3/gadget.h -@@ -85,7 +85,7 @@ void dwc3_ep0_out_start(struct dwc3 *dwc); - int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value); - int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request, - gfp_t gfp_flags); --int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value); -+int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol); - - /** - * dwc3_gadget_ep_get_transfer_index - Gets transfer index from HW -diff --git a/drivers/usb/gadget/function/f_acm.c b/drivers/usb/gadget/function/f_acm.c -index ab1065a..3384486 100644 ---- a/drivers/usb/gadget/function/f_acm.c -+++ b/drivers/usb/gadget/function/f_acm.c -@@ -430,11 +430,12 @@ static int acm_set_alt(struct usb_function *f, unsigned intf, unsigned alt) - if (acm->notify->driver_data) { - VDBG(cdev, "reset acm control interface %d\n", intf); - usb_ep_disable(acm->notify); -- } else { -- VDBG(cdev, "init acm ctrl interface %d\n", intf); -+ } -+ -+ if (!acm->notify->desc) - if (config_ep_by_speed(cdev->gadget, f, acm->notify)) - return -EINVAL; -- } -+ - usb_ep_enable(acm->notify); - acm->notify->driver_data = acm; - -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index 7ad7137..a3c277c 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -648,15 +648,26 @@ static void ffs_user_copy_worker(struct work_struct *work) - if (io_data->read && ret > 0) { - int i; - size_t pos = 0; -+ -+ /* -+ * Since req->length may be bigger than io_data->len (after -+ * being rounded up to maxpacketsize), we may end up with more -+ * data then user space has space for. -+ */ -+ ret = min_t(int, ret, io_data->len); -+ - use_mm(io_data->mm); - for (i = 0; i < io_data->nr_segs; i++) { -+ size_t len = min_t(size_t, ret - pos, -+ io_data->iovec[i].iov_len); -+ if (!len) -+ break; - if (unlikely(copy_to_user(io_data->iovec[i].iov_base, -- &io_data->buf[pos], -- io_data->iovec[i].iov_len))) { -+ &io_data->buf[pos], len))) { - ret = -EFAULT; - break; - } -- pos += io_data->iovec[i].iov_len; -+ pos += len; - } - unuse_mm(io_data->mm); - } -@@ -688,7 +699,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) - struct ffs_epfile *epfile = file->private_data; - struct ffs_ep *ep; - char *data = NULL; -- ssize_t ret, data_len; -+ ssize_t ret, data_len = -EINVAL; - int halt; - - /* Are we still active? */ -@@ -788,13 +799,30 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) - /* Fire the request */ - struct usb_request *req; - -+ /* -+ * Sanity Check: even though data_len can't be used -+ * uninitialized at the time I write this comment, some -+ * compilers complain about this situation. -+ * In order to keep the code clean from warnings, data_len is -+ * being initialized to -EINVAL during its declaration, which -+ * means we can't rely on compiler anymore to warn no future -+ * changes won't result in data_len being used uninitialized. -+ * For such reason, we're adding this redundant sanity check -+ * here. -+ */ -+ if (unlikely(data_len == -EINVAL)) { -+ WARN(1, "%s: data_len == -EINVAL\n", __func__); -+ ret = -EINVAL; -+ goto error_lock; -+ } -+ - if (io_data->aio) { - req = usb_ep_alloc_request(ep->ep, GFP_KERNEL); - if (unlikely(!req)) - goto error_lock; - - req->buf = data; -- req->length = io_data->len; -+ req->length = data_len; - - io_data->buf = data; - io_data->ep = ep->ep; -@@ -816,7 +844,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) - - req = ep->req; - req->buf = data; -- req->length = io_data->len; -+ req->length = data_len; - - req->context = &done; - req->complete = ffs_epfile_io_complete; -@@ -2626,8 +2654,6 @@ static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f, - func->conf = c; - func->gadget = c->cdev->gadget; - -- ffs_data_get(func->ffs); -- - /* - * in drivers/usb/gadget/configfs.c:configfs_composite_bind() - * configurations are bound in sequence with list_for_each_entry, -diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c -index b0d9817..38913ea 100644 ---- a/drivers/usb/gadget/udc/udc-core.c -+++ b/drivers/usb/gadget/udc/udc-core.c -@@ -458,6 +458,11 @@ static ssize_t usb_udc_softconn_store(struct device *dev, - { - struct usb_udc *udc = container_of(dev, struct usb_udc, dev); - -+ if (!udc->driver) { -+ dev_err(dev, "soft-connect without a gadget driver\n"); -+ return -EOPNOTSUPP; -+ } -+ - if (sysfs_streq(buf, "connect")) { - usb_gadget_udc_start(udc->gadget, udc->driver); - usb_gadget_connect(udc->gadget); -diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig -index 82800a7..6f1d48e 100644 ---- a/drivers/usb/host/Kconfig -+++ b/drivers/usb/host/Kconfig -@@ -220,7 +220,7 @@ config USB_EHCI_SH - - config USB_EHCI_EXYNOS - tristate "EHCI support for Samsung S5P/EXYNOS SoC Series" -- depends on PLAT_S5P || ARCH_EXYNOS -+ depends on ARCH_S5PV210 || ARCH_EXYNOS - help - Enable support for the Samsung Exynos SOC's on-chip EHCI controller. - -@@ -527,7 +527,7 @@ config USB_OHCI_SH - - config USB_OHCI_EXYNOS - tristate "OHCI support for Samsung S5P/EXYNOS SoC Series" -- depends on PLAT_S5P || ARCH_EXYNOS -+ depends on ARCH_S5PV210 || ARCH_EXYNOS - help - Enable support for the Samsung Exynos SOC's on-chip OHCI controller. - -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index c22a3e1..d125568 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -126,20 +126,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - xhci->quirks |= XHCI_AVOID_BEI; - } - if (pdev->vendor == PCI_VENDOR_ID_INTEL && -- (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI || -- pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI)) { -- /* Workaround for occasional spurious wakeups from S5 (or -- * any other sleep) on Haswell machines with LPT and LPT-LP -- * with the new Intel BIOS -- */ -- /* Limit the quirk to only known vendors, as this triggers -- * yet another BIOS bug on some other machines -- * https://bugzilla.kernel.org/show_bug.cgi?id=66171 -- */ -- if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP) -- xhci->quirks |= XHCI_SPURIOUS_WAKEUP; -- } -- if (pdev->vendor == PCI_VENDOR_ID_INTEL && - pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) { - xhci->quirks |= XHCI_SPURIOUS_REBOOT; - } -@@ -160,6 +146,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - pdev->device == 0x3432) - xhci->quirks |= XHCI_BROKEN_STREAMS; - -+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && -+ pdev->device == 0x1042) -+ xhci->quirks |= XHCI_BROKEN_STREAMS; -+ - if (xhci->quirks & XHCI_RESET_ON_RESUME) - xhci_dbg_trace(xhci, trace_xhci_dbg_quirks, - "QUIRK: Resetting on resume"); -diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c -index 3ee133f..013fd1c 100644 ---- a/drivers/usb/musb/musb_cppi41.c -+++ b/drivers/usb/musb/musb_cppi41.c -@@ -209,7 +209,8 @@ static enum hrtimer_restart cppi41_recheck_tx_req(struct hrtimer *timer) - } - } - -- if (!list_empty(&controller->early_tx_list)) { -+ if (!list_empty(&controller->early_tx_list) && -+ !hrtimer_is_queued(&controller->early_tx)) { - ret = HRTIMER_RESTART; - hrtimer_forward_now(&controller->early_tx, - ktime_set(0, 50 * NSEC_PER_USEC)); -diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c -index 154bcf1..b18f8d5 100644 ---- a/drivers/usb/musb/musb_dsps.c -+++ b/drivers/usb/musb/musb_dsps.c -@@ -896,7 +896,9 @@ static int dsps_resume(struct device *dev) - dsps_writel(mbase, wrp->mode, glue->context.mode); - dsps_writel(mbase, wrp->tx_mode, glue->context.tx_mode); - dsps_writel(mbase, wrp->rx_mode, glue->context.rx_mode); -- setup_timer(&glue->timer, otg_timer, (unsigned long) musb); -+ if (musb->xceiv->state == OTG_STATE_B_IDLE && -+ musb->port_mode == MUSB_PORT_MODE_DUAL_ROLE) -+ mod_timer(&glue->timer, jiffies + wrp->poll_seconds * HZ); - - return 0; - } -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index eca1747..cfd009d 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -155,6 +155,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ - { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ - { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ -+ { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ - { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ - { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */ - { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */ -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index dc72b92..0dad8ce 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -140,6 +140,7 @@ static struct ftdi_sio_quirk ftdi_8u2232c_quirk = { - * /sys/bus/usb-serial/drivers/ftdi_sio/new_id and send a patch or report. - */ - static const struct usb_device_id id_table_combined[] = { -+ { USB_DEVICE(FTDI_VID, FTDI_BRICK_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) }, -@@ -661,6 +662,8 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) }, - { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) }, - { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) }, -+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) }, -+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, - { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, - { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 5937b2d..6786b70 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -30,6 +30,12 @@ - - /*** third-party PIDs (using FTDI_VID) ***/ - -+/* -+ * Certain versions of the official Windows FTDI driver reprogrammed -+ * counterfeit FTDI devices to PID 0. Support these devices anyway. -+ */ -+#define FTDI_BRICK_PID 0x0000 -+ - #define FTDI_LUMEL_PD12_PID 0x6002 - - /* -@@ -143,8 +149,12 @@ - * Xsens Technologies BV products (http://www.xsens.com). - */ - #define XSENS_VID 0x2639 --#define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ -+#define XSENS_AWINDA_STATION_PID 0x0101 -+#define XSENS_AWINDA_DONGLE_PID 0x0102 - #define XSENS_MTW_PID 0x0200 /* Xsens MTw */ -+#define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ -+ -+/* Xsens devices using FTDI VID */ - #define XSENS_CONVERTER_0_PID 0xD388 /* Xsens USB converter */ - #define XSENS_CONVERTER_1_PID 0xD389 /* Xsens Wireless Receiver */ - #define XSENS_CONVERTER_2_PID 0xD38A -diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c -index 078f9ed..a31ff15 100644 ---- a/drivers/usb/serial/kobil_sct.c -+++ b/drivers/usb/serial/kobil_sct.c -@@ -335,7 +335,8 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port, - port->interrupt_out_urb->transfer_buffer_length = length; - - priv->cur_pos = priv->cur_pos + length; -- result = usb_submit_urb(port->interrupt_out_urb, GFP_NOIO); -+ result = usb_submit_urb(port->interrupt_out_urb, -+ GFP_ATOMIC); - dev_dbg(&port->dev, "%s - Send write URB returns: %i\n", __func__, result); - todo = priv->filled - priv->cur_pos; - -@@ -350,7 +351,7 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port, - if (priv->device_type == KOBIL_ADAPTER_B_PRODUCT_ID || - priv->device_type == KOBIL_ADAPTER_K_PRODUCT_ID) { - result = usb_submit_urb(port->interrupt_in_urb, -- GFP_NOIO); -+ GFP_ATOMIC); - dev_dbg(&port->dev, "%s - Send read URB returns: %i\n", __func__, result); - } - } -diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c -index 4856fb7..4b7bfb3 100644 ---- a/drivers/usb/serial/opticon.c -+++ b/drivers/usb/serial/opticon.c -@@ -215,7 +215,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port, - - /* The connected devices do not have a bulk write endpoint, - * to transmit data to de barcode device the control endpoint is used */ -- dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO); -+ dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_ATOMIC); - if (!dr) { - count = -ENOMEM; - goto error_no_dr; -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 54a8120..e87219a 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -269,6 +269,7 @@ static void option_instat_callback(struct urb *urb); - #define TELIT_PRODUCT_DE910_DUAL 0x1010 - #define TELIT_PRODUCT_UE910_V2 0x1012 - #define TELIT_PRODUCT_LE920 0x1200 -+#define TELIT_PRODUCT_LE910 0x1201 - - /* ZTE PRODUCTS */ - #define ZTE_VENDOR_ID 0x19d2 -@@ -361,6 +362,7 @@ static void option_instat_callback(struct urb *urb); - - /* Haier products */ - #define HAIER_VENDOR_ID 0x201e -+#define HAIER_PRODUCT_CE81B 0x10f8 - #define HAIER_PRODUCT_CE100 0x2009 - - /* Cinterion (formerly Siemens) products */ -@@ -588,6 +590,11 @@ static const struct option_blacklist_info zte_1255_blacklist = { - .reserved = BIT(3) | BIT(4), - }; - -+static const struct option_blacklist_info telit_le910_blacklist = { -+ .sendsetup = BIT(0), -+ .reserved = BIT(1) | BIT(2), -+}; -+ - static const struct option_blacklist_info telit_le920_blacklist = { - .sendsetup = BIT(0), - .reserved = BIT(1) | BIT(5), -@@ -1137,6 +1144,8 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, -+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), -+ .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), - .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ -@@ -1612,6 +1621,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, - { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, - { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(HAIER_VENDOR_ID, HAIER_PRODUCT_CE81B, 0xff, 0xff, 0xff) }, - /* Pirelli */ - { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) }, - { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_2, 0xff) }, -diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c -index 22c7d43..b1d815e 100644 ---- a/drivers/usb/storage/transport.c -+++ b/drivers/usb/storage/transport.c -@@ -1118,6 +1118,31 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us) - */ - if (result == USB_STOR_XFER_LONG) - fake_sense = 1; -+ -+ /* -+ * Sometimes a device will mistakenly skip the data phase -+ * and go directly to the status phase without sending a -+ * zero-length packet. If we get a 13-byte response here, -+ * check whether it really is a CSW. -+ */ -+ if (result == USB_STOR_XFER_SHORT && -+ srb->sc_data_direction == DMA_FROM_DEVICE && -+ transfer_length - scsi_get_resid(srb) == -+ US_BULK_CS_WRAP_LEN) { -+ struct scatterlist *sg = NULL; -+ unsigned int offset = 0; -+ -+ if (usb_stor_access_xfer_buf((unsigned char *) bcs, -+ US_BULK_CS_WRAP_LEN, srb, &sg, -+ &offset, FROM_XFER_BUF) == -+ US_BULK_CS_WRAP_LEN && -+ bcs->Signature == -+ cpu_to_le32(US_BULK_CS_SIGN)) { -+ usb_stor_dbg(us, "Device skipped data phase\n"); -+ scsi_set_resid(srb, transfer_length); -+ goto skipped_data_phase; -+ } -+ } - } - - /* See flow chart on pg 15 of the Bulk Only Transport spec for -@@ -1153,6 +1178,7 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us) - if (result != USB_STOR_XFER_GOOD) - return USB_STOR_TRANSPORT_ERROR; - -+ skipped_data_phase: - /* check bulk status */ - residue = le32_to_cpu(bcs->Residue); - usb_stor_dbg(us, "Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n", -diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h -index 8511b54..2fefaf9 100644 ---- a/drivers/usb/storage/unusual_uas.h -+++ b/drivers/usb/storage/unusual_uas.h -@@ -54,6 +54,20 @@ UNUSUAL_DEV(0x0bc2, 0x3312, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_NO_ATA_1X), - -+/* Reported-by: Hans de Goede <hdegoede@redhat.com> */ -+UNUSUAL_DEV(0x0bc2, 0x3320, 0x0000, 0x9999, -+ "Seagate", -+ "Expansion Desk", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_ATA_1X), -+ -+/* Reported-by: Bogdan Mihalcea <bogdan.mihalcea@infim.ro> */ -+UNUSUAL_DEV(0x0bc2, 0xa003, 0x0000, 0x9999, -+ "Seagate", -+ "Backup Plus", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_ATA_1X), -+ - /* https://bbs.archlinux.org/viewtopic.php?id=183190 */ - UNUSUAL_DEV(0x0bc2, 0xab20, 0x0000, 0x9999, - "Seagate", -@@ -61,6 +75,13 @@ UNUSUAL_DEV(0x0bc2, 0xab20, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_NO_ATA_1X), - -+/* https://bbs.archlinux.org/viewtopic.php?id=183190 */ -+UNUSUAL_DEV(0x0bc2, 0xab21, 0x0000, 0x9999, -+ "Seagate", -+ "Backup+ BK", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_ATA_1X), -+ - /* Reported-by: Claudio Bizzarri <claudio.bizzarri@gmail.com> */ - UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999, - "JMicron", -@@ -75,3 +96,10 @@ UNUSUAL_DEV(0x174c, 0x5106, 0x0000, 0x9999, - "ASM1051", - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_IGNORE_UAS), -+ -+/* Reported-by: Hans de Goede <hdegoede@redhat.com> */ -+UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999, -+ "VIA", -+ "VL711", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_ATA_1X), -diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c -index 61b182b..dbfe4ee 100644 ---- a/drivers/video/console/bitblit.c -+++ b/drivers/video/console/bitblit.c -@@ -205,7 +205,6 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, - static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, - int bottom_only) - { -- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; - unsigned int cw = vc->vc_font.width; - unsigned int ch = vc->vc_font.height; - unsigned int rw = info->var.xres - (vc->vc_cols*cw); -@@ -214,7 +213,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, - unsigned int bs = info->var.yres - bh; - struct fb_fillrect region; - -- region.color = attr_bgcol_ec(bgshift, vc, info); -+ region.color = 0; - region.rop = ROP_COPY; - - if (rw && !bottom_only) { -diff --git a/drivers/video/console/fbcon_ccw.c b/drivers/video/console/fbcon_ccw.c -index 41b32ae..5a3cbf6 100644 ---- a/drivers/video/console/fbcon_ccw.c -+++ b/drivers/video/console/fbcon_ccw.c -@@ -197,9 +197,8 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, - unsigned int bh = info->var.xres - (vc->vc_rows*ch); - unsigned int bs = vc->vc_rows*ch; - struct fb_fillrect region; -- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; - -- region.color = attr_bgcol_ec(bgshift,vc,info); -+ region.color = 0; - region.rop = ROP_COPY; - - if (rw && !bottom_only) { -diff --git a/drivers/video/console/fbcon_cw.c b/drivers/video/console/fbcon_cw.c -index a93670e..e7ee44d 100644 ---- a/drivers/video/console/fbcon_cw.c -+++ b/drivers/video/console/fbcon_cw.c -@@ -180,9 +180,8 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, - unsigned int bh = info->var.xres - (vc->vc_rows*ch); - unsigned int rs = info->var.yres - rw; - struct fb_fillrect region; -- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; - -- region.color = attr_bgcol_ec(bgshift,vc,info); -+ region.color = 0; - region.rop = ROP_COPY; - - if (rw && !bottom_only) { -diff --git a/drivers/video/console/fbcon_ud.c b/drivers/video/console/fbcon_ud.c -index ff0872c..19e3714 100644 ---- a/drivers/video/console/fbcon_ud.c -+++ b/drivers/video/console/fbcon_ud.c -@@ -227,9 +227,8 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, - unsigned int rw = info->var.xres - (vc->vc_cols*cw); - unsigned int bh = info->var.yres - (vc->vc_rows*ch); - struct fb_fillrect region; -- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; - -- region.color = attr_bgcol_ec(bgshift,vc,info); -+ region.color = 0; - region.rop = ROP_COPY; - - if (rw && !bottom_only) { -diff --git a/drivers/video/fbdev/core/cfbcopyarea.c b/drivers/video/fbdev/core/cfbcopyarea.c -index bcb5723..6d4bfee 100644 ---- a/drivers/video/fbdev/core/cfbcopyarea.c -+++ b/drivers/video/fbdev/core/cfbcopyarea.c -@@ -55,8 +55,8 @@ bitcpy(struct fb_info *p, unsigned long __iomem *dst, unsigned dst_idx, - * If you suspect bug in this function, compare it with this simple - * memmove implementation. - */ -- fb_memmove((char *)dst + ((dst_idx & (bits - 1))) / 8, -- (char *)src + ((src_idx & (bits - 1))) / 8, n / 8); -+ memmove((char *)dst + ((dst_idx & (bits - 1))) / 8, -+ (char *)src + ((src_idx & (bits - 1))) / 8, n / 8); - return; - #endif - -@@ -221,8 +221,8 @@ bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, unsigned dst_idx, - * If you suspect bug in this function, compare it with this simple - * memmove implementation. - */ -- fb_memmove((char *)dst + ((dst_idx & (bits - 1))) / 8, -- (char *)src + ((src_idx & (bits - 1))) / 8, n / 8); -+ memmove((char *)dst + ((dst_idx & (bits - 1))) / 8, -+ (char *)src + ((src_idx & (bits - 1))) / 8, n / 8); - return; - #endif - -@@ -324,7 +324,10 @@ bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, unsigned dst_idx, - d0 = d0 << left | d1 >> right; - } - d0 = fb_rev_pixels_in_long(d0, bswapmask); -- FB_WRITEL(comp(d0, FB_READL(dst), first), dst); -+ if (!first) -+ FB_WRITEL(d0, dst); -+ else -+ FB_WRITEL(comp(d0, FB_READL(dst), first), dst); - d0 = d1; - dst--; - n -= dst_idx+1; -diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c -index 3d1463c..add40d0 100644 ---- a/drivers/virtio/virtio_pci.c -+++ b/drivers/virtio/virtio_pci.c -@@ -789,6 +789,7 @@ static int virtio_pci_restore(struct device *dev) - struct pci_dev *pci_dev = to_pci_dev(dev); - struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev); - struct virtio_driver *drv; -+ unsigned status = 0; - int ret; - - drv = container_of(vp_dev->vdev.dev.driver, -@@ -799,14 +800,40 @@ static int virtio_pci_restore(struct device *dev) - return ret; - - pci_set_master(pci_dev); -+ /* We always start by resetting the device, in case a previous -+ * driver messed it up. */ -+ vp_reset(&vp_dev->vdev); -+ -+ /* Acknowledge that we've seen the device. */ -+ status |= VIRTIO_CONFIG_S_ACKNOWLEDGE; -+ vp_set_status(&vp_dev->vdev, status); -+ -+ /* Maybe driver failed before freeze. -+ * Restore the failed status, for debugging. */ -+ status |= vp_dev->saved_status & VIRTIO_CONFIG_S_FAILED; -+ vp_set_status(&vp_dev->vdev, status); -+ -+ if (!drv) -+ return 0; -+ -+ /* We have a driver! */ -+ status |= VIRTIO_CONFIG_S_DRIVER; -+ vp_set_status(&vp_dev->vdev, status); -+ - vp_finalize_features(&vp_dev->vdev); - -- if (drv && drv->restore) -+ if (drv->restore) { - ret = drv->restore(&vp_dev->vdev); -+ if (ret) { -+ status |= VIRTIO_CONFIG_S_FAILED; -+ vp_set_status(&vp_dev->vdev, status); -+ return ret; -+ } -+ } - - /* Finally, tell the device we're all set */ -- if (!ret) -- vp_set_status(&vp_dev->vdev, vp_dev->saved_status); -+ status |= VIRTIO_CONFIG_S_DRIVER_OK; -+ vp_set_status(&vp_dev->vdev, status); - - return ret; - } -diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c -index 54c84da..7409772 100644 ---- a/fs/btrfs/file-item.c -+++ b/fs/btrfs/file-item.c -@@ -423,7 +423,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end, - ret = 0; - fail: - while (ret < 0 && !list_empty(&tmplist)) { -- sums = list_entry(&tmplist, struct btrfs_ordered_sum, list); -+ sums = list_entry(tmplist.next, struct btrfs_ordered_sum, list); - list_del(&sums->list); - kfree(sums); - } -diff --git a/fs/buffer.c b/fs/buffer.c -index 3588a80..72daaa5 100644 ---- a/fs/buffer.c -+++ b/fs/buffer.c -@@ -2082,6 +2082,7 @@ int generic_write_end(struct file *file, struct address_space *mapping, - struct page *page, void *fsdata) - { - struct inode *inode = mapping->host; -+ loff_t old_size = inode->i_size; - int i_size_changed = 0; - - copied = block_write_end(file, mapping, pos, len, copied, page, fsdata); -@@ -2101,6 +2102,8 @@ int generic_write_end(struct file *file, struct address_space *mapping, - unlock_page(page); - page_cache_release(page); - -+ if (old_size < pos) -+ pagecache_isize_extended(inode, old_size, pos); - /* - * Don't mark the inode dirty under page lock. First, it unnecessarily - * makes the holding time of page lock longer. Second, it forces lock -@@ -2318,6 +2321,11 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping, - err = 0; - - balance_dirty_pages_ratelimited(mapping); -+ -+ if (unlikely(fatal_signal_pending(current))) { -+ err = -EINTR; -+ goto out; -+ } - } - - /* page covers the boundary, find the boundary offset */ -diff --git a/fs/dcache.c b/fs/dcache.c -index cb25a1a..34b40be8 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -2675,11 +2675,13 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry) - if (!IS_ROOT(new)) { - spin_unlock(&inode->i_lock); - dput(new); -+ iput(inode); - return ERR_PTR(-EIO); - } - if (d_ancestor(new, dentry)) { - spin_unlock(&inode->i_lock); - dput(new); -+ iput(inode); - return ERR_PTR(-EIO); - } - write_seqlock(&rename_lock); -@@ -2810,6 +2812,9 @@ static int prepend(char **buffer, int *buflen, const char *str, int namelen) - * the beginning of the name. The sequence number check at the caller will - * retry it again when a d_move() does happen. So any garbage in the buffer - * due to mismatched pointer and length will be discarded. -+ * -+ * Data dependency barrier is needed to make sure that we see that terminating -+ * NUL. Alpha strikes again, film at 11... - */ - static int prepend_name(char **buffer, int *buflen, struct qstr *name) - { -@@ -2817,6 +2822,8 @@ static int prepend_name(char **buffer, int *buflen, struct qstr *name) - u32 dlen = ACCESS_ONCE(name->len); - char *p; - -+ smp_read_barrier_depends(); -+ - *buflen -= dlen + 1; - if (*buflen < 0) - return -ENAMETOOLONG; -diff --git a/fs/ext3/super.c b/fs/ext3/super.c -index 622e882..2c42e73 100644 ---- a/fs/ext3/super.c -+++ b/fs/ext3/super.c -@@ -1354,13 +1354,6 @@ set_qf_format: - "not specified."); - return 0; - } -- } else { -- if (sbi->s_jquota_fmt) { -- ext3_msg(sb, KERN_ERR, "error: journaled quota format " -- "specified with no journaling " -- "enabled."); -- return 0; -- } - } - #endif - return 1; -diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c -index 581ef40..e069155 100644 ---- a/fs/ext4/balloc.c -+++ b/fs/ext4/balloc.c -@@ -176,7 +176,7 @@ static unsigned int num_clusters_in_group(struct super_block *sb, - } - - /* Initializes an uninitialized block bitmap */ --static void ext4_init_block_bitmap(struct super_block *sb, -+static int ext4_init_block_bitmap(struct super_block *sb, - struct buffer_head *bh, - ext4_group_t block_group, - struct ext4_group_desc *gdp) -@@ -192,7 +192,6 @@ static void ext4_init_block_bitmap(struct super_block *sb, - /* If checksum is bad mark all blocks used to prevent allocation - * essentially implementing a per-group read-only flag. */ - if (!ext4_group_desc_csum_verify(sb, block_group, gdp)) { -- ext4_error(sb, "Checksum bad for group %u", block_group); - grp = ext4_get_group_info(sb, block_group); - if (!EXT4_MB_GRP_BBITMAP_CORRUPT(grp)) - percpu_counter_sub(&sbi->s_freeclusters_counter, -@@ -205,7 +204,7 @@ static void ext4_init_block_bitmap(struct super_block *sb, - count); - } - set_bit(EXT4_GROUP_INFO_IBITMAP_CORRUPT_BIT, &grp->bb_state); -- return; -+ return -EIO; - } - memset(bh->b_data, 0, sb->s_blocksize); - -@@ -243,6 +242,7 @@ static void ext4_init_block_bitmap(struct super_block *sb, - sb->s_blocksize * 8, bh->b_data); - ext4_block_bitmap_csum_set(sb, block_group, gdp, bh); - ext4_group_desc_csum_set(sb, block_group, gdp); -+ return 0; - } - - /* Return the number of free blocks in a block group. It is used when -@@ -438,11 +438,15 @@ ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group) - } - ext4_lock_group(sb, block_group); - if (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) { -- ext4_init_block_bitmap(sb, bh, block_group, desc); -+ int err; -+ -+ err = ext4_init_block_bitmap(sb, bh, block_group, desc); - set_bitmap_uptodate(bh); - set_buffer_uptodate(bh); - ext4_unlock_group(sb, block_group); - unlock_buffer(bh); -+ if (err) -+ ext4_error(sb, "Checksum bad for grp %u", block_group); - return bh; - } - ext4_unlock_group(sb, block_group); -diff --git a/fs/ext4/bitmap.c b/fs/ext4/bitmap.c -index 3285aa5..b610779 100644 ---- a/fs/ext4/bitmap.c -+++ b/fs/ext4/bitmap.c -@@ -24,8 +24,7 @@ int ext4_inode_bitmap_csum_verify(struct super_block *sb, ext4_group_t group, - __u32 provided, calculated; - struct ext4_sb_info *sbi = EXT4_SB(sb); - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return 1; - - provided = le16_to_cpu(gdp->bg_inode_bitmap_csum_lo); -@@ -46,8 +45,7 @@ void ext4_inode_bitmap_csum_set(struct super_block *sb, ext4_group_t group, - __u32 csum; - struct ext4_sb_info *sbi = EXT4_SB(sb); - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return; - - csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)bh->b_data, sz); -@@ -65,8 +63,7 @@ int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group, - struct ext4_sb_info *sbi = EXT4_SB(sb); - int sz = EXT4_CLUSTERS_PER_GROUP(sb) / 8; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return 1; - - provided = le16_to_cpu(gdp->bg_block_bitmap_csum_lo); -@@ -91,8 +88,7 @@ void ext4_block_bitmap_csum_set(struct super_block *sb, ext4_group_t group, - __u32 csum; - struct ext4_sb_info *sbi = EXT4_SB(sb); - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return; - - csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)bh->b_data, sz); -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index b0c225c..96ac9d3 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -2109,6 +2109,7 @@ int do_journal_get_write_access(handle_t *handle, - #define CONVERT_INLINE_DATA 2 - - extern struct inode *ext4_iget(struct super_block *, unsigned long); -+extern struct inode *ext4_iget_normal(struct super_block *, unsigned long); - extern int ext4_write_inode(struct inode *, struct writeback_control *); - extern int ext4_setattr(struct dentry *, struct iattr *); - extern int ext4_getattr(struct vfsmount *mnt, struct dentry *dentry, -@@ -2332,10 +2333,18 @@ extern int ext4_register_li_request(struct super_block *sb, - static inline int ext4_has_group_desc_csum(struct super_block *sb) - { - return EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_GDT_CSUM | -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM); -+ EXT4_FEATURE_RO_COMPAT_GDT_CSUM) || -+ (EXT4_SB(sb)->s_chksum_driver != NULL); - } - -+static inline int ext4_has_metadata_csum(struct super_block *sb) -+{ -+ WARN_ON_ONCE(EXT4_HAS_RO_COMPAT_FEATURE(sb, -+ EXT4_FEATURE_RO_COMPAT_METADATA_CSUM) && -+ !EXT4_SB(sb)->s_chksum_driver); -+ -+ return (EXT4_SB(sb)->s_chksum_driver != NULL); -+} - static inline ext4_fsblk_t ext4_blocks_count(struct ext4_super_block *es) - { - return ((ext4_fsblk_t)le32_to_cpu(es->s_blocks_count_hi) << 32) | -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 74292a7..18d8dc8 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -73,8 +73,7 @@ static int ext4_extent_block_csum_verify(struct inode *inode, - { - struct ext4_extent_tail *et; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return 1; - - et = find_ext4_extent_tail(eh); -@@ -88,8 +87,7 @@ static void ext4_extent_block_csum_set(struct inode *inode, - { - struct ext4_extent_tail *et; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return; - - et = find_ext4_extent_tail(eh); -diff --git a/fs/ext4/file.c b/fs/ext4/file.c -index aca7b24..8131be8 100644 ---- a/fs/ext4/file.c -+++ b/fs/ext4/file.c -@@ -137,10 +137,10 @@ ext4_file_write_iter(struct kiocb *iocb, struct iov_iter *from) - iov_iter_truncate(from, sbi->s_bitmap_maxbytes - pos); - } - -+ iocb->private = &overwrite; - if (o_direct) { - blk_start_plug(&plug); - -- iocb->private = &overwrite; - - /* check whether we do a DIO overwrite or not */ - if (ext4_should_dioread_nolock(inode) && !aio_mutex && -diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c -index 5b87fc3..ac644c3 100644 ---- a/fs/ext4/ialloc.c -+++ b/fs/ext4/ialloc.c -@@ -887,6 +887,10 @@ got: - struct buffer_head *block_bitmap_bh; - - block_bitmap_bh = ext4_read_block_bitmap(sb, group); -+ if (!block_bitmap_bh) { -+ err = -EIO; -+ goto out; -+ } - BUFFER_TRACE(block_bitmap_bh, "get block bitmap access"); - err = ext4_journal_get_write_access(handle, block_bitmap_bh); - if (err) { -@@ -1011,8 +1015,7 @@ got: - spin_unlock(&sbi->s_next_gen_lock); - - /* Precompute checksum seed for inode metadata */ -- if (EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) { -+ if (ext4_has_metadata_csum(sb)) { - __u32 csum; - __le32 inum = cpu_to_le32(inode->i_ino); - __le32 gen = cpu_to_le32(inode->i_generation); -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index bea662b..aa8e695 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -1126,8 +1126,7 @@ static int ext4_finish_convert_inline_dir(handle_t *handle, - memcpy((void *)de, buf + EXT4_INLINE_DOTDOT_SIZE, - inline_size - EXT4_INLINE_DOTDOT_SIZE); - -- if (EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(inode->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - inode->i_size = inode->i_sb->s_blocksize; -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 3aa26e9..7d1057b 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -83,8 +83,7 @@ static int ext4_inode_csum_verify(struct inode *inode, struct ext4_inode *raw, - - if (EXT4_SB(inode->i_sb)->s_es->s_creator_os != - cpu_to_le32(EXT4_OS_LINUX) || -- !EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ !ext4_has_metadata_csum(inode->i_sb)) - return 1; - - provided = le16_to_cpu(raw->i_checksum_lo); -@@ -105,8 +104,7 @@ static void ext4_inode_csum_set(struct inode *inode, struct ext4_inode *raw, - - if (EXT4_SB(inode->i_sb)->s_es->s_creator_os != - cpu_to_le32(EXT4_OS_LINUX) || -- !EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ !ext4_has_metadata_csum(inode->i_sb)) - return; - - csum = ext4_inode_csum(inode, raw, ei); -@@ -224,16 +222,15 @@ void ext4_evict_inode(struct inode *inode) - goto no_delete; - } - -- if (!is_bad_inode(inode)) -- dquot_initialize(inode); -+ if (is_bad_inode(inode)) -+ goto no_delete; -+ dquot_initialize(inode); - - if (ext4_should_order_data(inode)) - ext4_begin_ordered_truncate(inode, 0); - truncate_inode_pages_final(&inode->i_data); - - WARN_ON(atomic_read(&EXT4_I(inode)->i_ioend_count)); -- if (is_bad_inode(inode)) -- goto no_delete; - - /* - * Protect us against freezing - iput() caller didn't have to have any -@@ -2515,6 +2512,20 @@ static int ext4_nonda_switch(struct super_block *sb) - return 0; - } - -+/* We always reserve for an inode update; the superblock could be there too */ -+static int ext4_da_write_credits(struct inode *inode, loff_t pos, unsigned len) -+{ -+ if (likely(EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -+ EXT4_FEATURE_RO_COMPAT_LARGE_FILE))) -+ return 1; -+ -+ if (pos + len <= 0x7fffffffULL) -+ return 1; -+ -+ /* We might need to update the superblock to set LARGE_FILE */ -+ return 2; -+} -+ - static int ext4_da_write_begin(struct file *file, struct address_space *mapping, - loff_t pos, unsigned len, unsigned flags, - struct page **pagep, void **fsdata) -@@ -2565,7 +2576,8 @@ retry_grab: - * of file which has an already mapped buffer. - */ - retry_journal: -- handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE, 1); -+ handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE, -+ ext4_da_write_credits(inode, pos, len)); - if (IS_ERR(handle)) { - page_cache_release(page); - return PTR_ERR(handle); -@@ -3936,8 +3948,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) - ei->i_extra_isize = 0; - - /* Precompute checksum seed for inode metadata */ -- if (EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) { -+ if (ext4_has_metadata_csum(sb)) { - struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); - __u32 csum; - __le32 inum = cpu_to_le32(inode->i_ino); -@@ -4127,6 +4138,13 @@ bad_inode: - return ERR_PTR(ret); - } - -+struct inode *ext4_iget_normal(struct super_block *sb, unsigned long ino) -+{ -+ if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO) -+ return ERR_PTR(-EIO); -+ return ext4_iget(sb, ino); -+} -+ - static int ext4_inode_blocks_set(handle_t *handle, - struct ext4_inode *raw_inode, - struct ext4_inode_info *ei) -@@ -4536,8 +4554,12 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr) - ext4_orphan_del(NULL, inode); - goto err_out; - } -- } else -+ } else { -+ loff_t oldsize = inode->i_size; -+ - i_size_write(inode, attr->ia_size); -+ pagecache_isize_extended(inode, oldsize, inode->i_size); -+ } - - /* - * Blocks are going to be removed from the inode. Wait -diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c -index 0f2252e..bfda18a 100644 ---- a/fs/ext4/ioctl.c -+++ b/fs/ext4/ioctl.c -@@ -331,8 +331,7 @@ flags_out: - if (!inode_owner_or_capable(inode)) - return -EPERM; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) { -+ if (ext4_has_metadata_csum(inode->i_sb)) { - ext4_warning(sb, "Setting inode version is not " - "supported with metadata_csum enabled."); - return -ENOTTY; -@@ -532,9 +531,17 @@ group_add_out: - } - - case EXT4_IOC_SWAP_BOOT: -+ { -+ int err; - if (!(filp->f_mode & FMODE_WRITE)) - return -EBADF; -- return swap_inode_boot_loader(sb, inode); -+ err = mnt_want_write_file(filp); -+ if (err) -+ return err; -+ err = swap_inode_boot_loader(sb, inode); -+ mnt_drop_write_file(filp); -+ return err; -+ } - - case EXT4_IOC_RESIZE_FS: { - ext4_fsblk_t n_blocks_count; -diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c -index 32bce84..8313ca3 100644 ---- a/fs/ext4/mmp.c -+++ b/fs/ext4/mmp.c -@@ -20,8 +20,7 @@ static __le32 ext4_mmp_csum(struct super_block *sb, struct mmp_struct *mmp) - - static int ext4_mmp_csum_verify(struct super_block *sb, struct mmp_struct *mmp) - { -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return 1; - - return mmp->mmp_checksum == ext4_mmp_csum(sb, mmp); -@@ -29,8 +28,7 @@ static int ext4_mmp_csum_verify(struct super_block *sb, struct mmp_struct *mmp) - - static void ext4_mmp_csum_set(struct super_block *sb, struct mmp_struct *mmp) - { -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return; - - mmp->mmp_checksum = ext4_mmp_csum(sb, mmp); -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index 603e4eb..5b7dad6 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -124,8 +124,7 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode, - "directory leaf block found instead of index block"); - return ERR_PTR(-EIO); - } -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM) || -+ if (!ext4_has_metadata_csum(inode->i_sb) || - buffer_verified(bh)) - return bh; - -@@ -340,8 +339,7 @@ int ext4_dirent_csum_verify(struct inode *inode, struct ext4_dir_entry *dirent) - { - struct ext4_dir_entry_tail *t; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return 1; - - t = get_dirent_tail(inode, dirent); -@@ -362,8 +360,7 @@ static void ext4_dirent_csum_set(struct inode *inode, - { - struct ext4_dir_entry_tail *t; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return; - - t = get_dirent_tail(inode, dirent); -@@ -438,8 +435,7 @@ static int ext4_dx_csum_verify(struct inode *inode, - struct dx_tail *t; - int count_offset, limit, count; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return 1; - - c = get_dx_countlimit(inode, dirent, &count_offset); -@@ -468,8 +464,7 @@ static void ext4_dx_csum_set(struct inode *inode, struct ext4_dir_entry *dirent) - struct dx_tail *t; - int count_offset, limit, count; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return; - - c = get_dx_countlimit(inode, dirent, &count_offset); -@@ -557,8 +552,7 @@ static inline unsigned dx_root_limit(struct inode *dir, unsigned infosize) - unsigned entry_space = dir->i_sb->s_blocksize - EXT4_DIR_REC_LEN(1) - - EXT4_DIR_REC_LEN(2) - infosize; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(dir->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(dir->i_sb)) - entry_space -= sizeof(struct dx_tail); - return entry_space / sizeof(struct dx_entry); - } -@@ -567,8 +561,7 @@ static inline unsigned dx_node_limit(struct inode *dir) - { - unsigned entry_space = dir->i_sb->s_blocksize - EXT4_DIR_REC_LEN(0); - -- if (EXT4_HAS_RO_COMPAT_FEATURE(dir->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(dir->i_sb)) - entry_space -= sizeof(struct dx_tail); - return entry_space / sizeof(struct dx_entry); - } -@@ -1441,7 +1434,7 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi - dentry); - return ERR_PTR(-EIO); - } -- inode = ext4_iget(dir->i_sb, ino); -+ inode = ext4_iget_normal(dir->i_sb, ino); - if (inode == ERR_PTR(-ESTALE)) { - EXT4_ERROR_INODE(dir, - "deleted inode referenced: %u", -@@ -1474,7 +1467,7 @@ struct dentry *ext4_get_parent(struct dentry *child) - return ERR_PTR(-EIO); - } - -- return d_obtain_alias(ext4_iget(child->d_inode->i_sb, ino)); -+ return d_obtain_alias(ext4_iget_normal(child->d_inode->i_sb, ino)); - } - - /* -@@ -1548,8 +1541,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, - int csum_size = 0; - int err = 0, i; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(dir->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(dir->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - bh2 = ext4_append(handle, dir, &newblock); -@@ -1718,8 +1710,7 @@ static int add_dirent_to_buf(handle_t *handle, struct dentry *dentry, - int csum_size = 0; - int err; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(inode->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - if (!de) { -@@ -1786,8 +1777,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry, - struct fake_dirent *fde; - int csum_size = 0; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(inode->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - blocksize = dir->i_sb->s_blocksize; -@@ -1904,8 +1894,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, - ext4_lblk_t block, blocks; - int csum_size = 0; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(inode->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - sb = dir->i_sb; -@@ -2167,8 +2156,7 @@ static int ext4_delete_entry(handle_t *handle, - return err; - } - -- if (EXT4_HAS_RO_COMPAT_FEATURE(dir->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(dir->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - BUFFER_TRACE(bh, "get_write_access"); -@@ -2387,8 +2375,7 @@ static int ext4_init_new_dir(handle_t *handle, struct inode *dir, - int csum_size = 0; - int err; - -- if (EXT4_HAS_RO_COMPAT_FEATURE(dir->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(dir->i_sb)) - csum_size = sizeof(struct ext4_dir_entry_tail); - - if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) { -@@ -2573,7 +2560,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode) - int err = 0, rc; - bool dirty = false; - -- if (!sbi->s_journal) -+ if (!sbi->s_journal || is_bad_inode(inode)) - return 0; - - WARN_ON_ONCE(!(inode->i_state & (I_NEW | I_FREEING)) && -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index 1e43b90..ca45883 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -1081,7 +1081,7 @@ static void update_backups(struct super_block *sb, int blk_off, char *data, - break; - - if (meta_bg == 0) -- backup_block = group * bpg + blk_off; -+ backup_block = ((ext4_fsblk_t)group) * bpg + blk_off; - else - backup_block = (ext4_group_first_block_no(sb, group) + - ext4_bg_has_super(sb, group)); -@@ -1212,8 +1212,7 @@ static int ext4_set_bitmap_checksums(struct super_block *sb, - { - struct buffer_head *bh; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return 0; - - bh = ext4_get_bitmap(sb, group_data->inode_bitmap); -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 0b28b36..b1f0ac7 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -141,8 +141,7 @@ static __le32 ext4_superblock_csum(struct super_block *sb, - static int ext4_superblock_csum_verify(struct super_block *sb, - struct ext4_super_block *es) - { -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return 1; - - return es->s_checksum == ext4_superblock_csum(sb, es); -@@ -152,8 +151,7 @@ void ext4_superblock_csum_set(struct super_block *sb) - { - struct ext4_super_block *es = EXT4_SB(sb)->s_es; - -- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(sb)) - return; - - es->s_checksum = ext4_superblock_csum(sb, es); -@@ -1002,7 +1000,7 @@ static struct inode *ext4_nfs_get_inode(struct super_block *sb, - * Currently we don't know the generation for parent directory, so - * a generation of 0 means "accept any" - */ -- inode = ext4_iget(sb, ino); -+ inode = ext4_iget_normal(sb, ino); - if (IS_ERR(inode)) - return ERR_CAST(inode); - if (generation && inode->i_generation != generation) { -@@ -1712,13 +1710,6 @@ static int parse_options(char *options, struct super_block *sb, - "not specified"); - return 0; - } -- } else { -- if (sbi->s_jquota_fmt) { -- ext4_msg(sb, KERN_ERR, "journaled quota format " -- "specified with no journaling " -- "enabled"); -- return 0; -- } - } - #endif - if (test_opt(sb, DIOREAD_NOLOCK)) { -@@ -2016,8 +2007,7 @@ static __le16 ext4_group_desc_csum(struct ext4_sb_info *sbi, __u32 block_group, - __u16 crc = 0; - __le32 le_group = cpu_to_le32(block_group); - -- if ((sbi->s_es->s_feature_ro_compat & -- cpu_to_le32(EXT4_FEATURE_RO_COMPAT_METADATA_CSUM))) { -+ if (ext4_has_metadata_csum(sbi->s_sb)) { - /* Use new metadata_csum algorithm */ - __le16 save_csum; - __u32 csum32; -@@ -2035,6 +2025,10 @@ static __le16 ext4_group_desc_csum(struct ext4_sb_info *sbi, __u32 block_group, - } - - /* old crc16 code */ -+ if (!(sbi->s_es->s_feature_ro_compat & -+ cpu_to_le32(EXT4_FEATURE_RO_COMPAT_GDT_CSUM))) -+ return 0; -+ - offset = offsetof(struct ext4_group_desc, bg_checksum); - - crc = crc16(~0, sbi->s_es->s_uuid, sizeof(sbi->s_es->s_uuid)); -@@ -3179,8 +3173,7 @@ static int set_journal_csum_feature_set(struct super_block *sb) - int compat, incompat; - struct ext4_sb_info *sbi = EXT4_SB(sb); - -- if (EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) { -+ if (ext4_has_metadata_csum(sb)) { - /* journal checksum v3 */ - compat = 0; - incompat = JBD2_FEATURE_INCOMPAT_CSUM_V3; -@@ -3487,8 +3480,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - } - - /* Precompute checksum seed for all metadata */ -- if (EXT4_HAS_RO_COMPAT_FEATURE(sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (ext4_has_metadata_csum(sb)) - sbi->s_csum_seed = ext4_chksum(sbi, ~0, es->s_uuid, - sizeof(es->s_uuid)); - -@@ -3506,6 +3498,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - #ifdef CONFIG_EXT4_FS_POSIX_ACL - set_opt(sb, POSIX_ACL); - #endif -+ /* don't forget to enable journal_csum when metadata_csum is enabled. */ -+ if (ext4_has_metadata_csum(sb)) -+ set_opt(sb, JOURNAL_CHECKSUM); -+ - if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_DATA) - set_opt(sb, JOURNAL_DATA); - else if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_ORDERED) -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index e738733..2d1e5803 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -142,8 +142,7 @@ static int ext4_xattr_block_csum_verify(struct inode *inode, - sector_t block_nr, - struct ext4_xattr_header *hdr) - { -- if (EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM) && -+ if (ext4_has_metadata_csum(inode->i_sb) && - (hdr->h_checksum != ext4_xattr_block_csum(inode, block_nr, hdr))) - return 0; - return 1; -@@ -153,8 +152,7 @@ static void ext4_xattr_block_csum_set(struct inode *inode, - sector_t block_nr, - struct ext4_xattr_header *hdr) - { -- if (!EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, -- EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) -+ if (!ext4_has_metadata_csum(inode->i_sb)) - return; - - hdr->h_checksum = ext4_xattr_block_csum(inode, block_nr, hdr); -@@ -190,14 +188,28 @@ ext4_listxattr(struct dentry *dentry, char *buffer, size_t size) - } - - static int --ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end) -+ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end, -+ void *value_start) - { -- while (!IS_LAST_ENTRY(entry)) { -- struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(entry); -+ struct ext4_xattr_entry *e = entry; -+ -+ while (!IS_LAST_ENTRY(e)) { -+ struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(e); - if ((void *)next >= end) - return -EIO; -- entry = next; -+ e = next; - } -+ -+ while (!IS_LAST_ENTRY(entry)) { -+ if (entry->e_value_size != 0 && -+ (value_start + le16_to_cpu(entry->e_value_offs) < -+ (void *)e + sizeof(__u32) || -+ value_start + le16_to_cpu(entry->e_value_offs) + -+ le32_to_cpu(entry->e_value_size) > end)) -+ return -EIO; -+ entry = EXT4_XATTR_NEXT(entry); -+ } -+ - return 0; - } - -@@ -214,7 +226,8 @@ ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh) - return -EIO; - if (!ext4_xattr_block_csum_verify(inode, bh->b_blocknr, BHDR(bh))) - return -EIO; -- error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size); -+ error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size, -+ bh->b_data); - if (!error) - set_buffer_verified(bh); - return error; -@@ -331,7 +344,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name, - header = IHDR(inode, raw_inode); - entry = IFIRST(header); - end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; -- error = ext4_xattr_check_names(entry, end); -+ error = ext4_xattr_check_names(entry, end, entry); - if (error) - goto cleanup; - error = ext4_xattr_find_entry(&entry, name_index, name, -@@ -463,7 +476,7 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size) - raw_inode = ext4_raw_inode(&iloc); - header = IHDR(inode, raw_inode); - end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; -- error = ext4_xattr_check_names(IFIRST(header), end); -+ error = ext4_xattr_check_names(IFIRST(header), end, IFIRST(header)); - if (error) - goto cleanup; - error = ext4_xattr_list_entries(dentry, IFIRST(header), -@@ -986,7 +999,8 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i, - is->s.here = is->s.first; - is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; - if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) { -- error = ext4_xattr_check_names(IFIRST(header), is->s.end); -+ error = ext4_xattr_check_names(IFIRST(header), is->s.end, -+ IFIRST(header)); - if (error) - return error; - /* Find the named attribute. */ -diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c -index 9b329b5..bcbef08 100644 ---- a/fs/jbd2/recovery.c -+++ b/fs/jbd2/recovery.c -@@ -525,6 +525,7 @@ static int do_one_pass(journal_t *journal, - !jbd2_descr_block_csum_verify(journal, - bh->b_data)) { - err = -EIO; -+ brelse(bh); - goto failed; - } - -diff --git a/fs/jffs2/jffs2_fs_sb.h b/fs/jffs2/jffs2_fs_sb.h -index 413ef89..046fee8 100644 ---- a/fs/jffs2/jffs2_fs_sb.h -+++ b/fs/jffs2/jffs2_fs_sb.h -@@ -134,8 +134,6 @@ struct jffs2_sb_info { - struct rw_semaphore wbuf_sem; /* Protects the write buffer */ - - struct delayed_work wbuf_dwork; /* write-buffer write-out work */ -- int wbuf_queued; /* non-zero delayed work is queued */ -- spinlock_t wbuf_dwork_lock; /* protects wbuf_dwork and and wbuf_queued */ - - unsigned char *oobbuf; - int oobavail; /* How many bytes are available for JFFS2 in OOB */ -diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c -index a6597d6..09ed551 100644 ---- a/fs/jffs2/wbuf.c -+++ b/fs/jffs2/wbuf.c -@@ -1162,10 +1162,6 @@ static void delayed_wbuf_sync(struct work_struct *work) - struct jffs2_sb_info *c = work_to_sb(work); - struct super_block *sb = OFNI_BS_2SFFJ(c); - -- spin_lock(&c->wbuf_dwork_lock); -- c->wbuf_queued = 0; -- spin_unlock(&c->wbuf_dwork_lock); -- - if (!(sb->s_flags & MS_RDONLY)) { - jffs2_dbg(1, "%s()\n", __func__); - jffs2_flush_wbuf_gc(c, 0); -@@ -1180,14 +1176,9 @@ void jffs2_dirty_trigger(struct jffs2_sb_info *c) - if (sb->s_flags & MS_RDONLY) - return; - -- spin_lock(&c->wbuf_dwork_lock); -- if (!c->wbuf_queued) { -+ delay = msecs_to_jiffies(dirty_writeback_interval * 10); -+ if (queue_delayed_work(system_long_wq, &c->wbuf_dwork, delay)) - jffs2_dbg(1, "%s()\n", __func__); -- delay = msecs_to_jiffies(dirty_writeback_interval * 10); -- queue_delayed_work(system_long_wq, &c->wbuf_dwork, delay); -- c->wbuf_queued = 1; -- } -- spin_unlock(&c->wbuf_dwork_lock); - } - - int jffs2_nand_flash_setup(struct jffs2_sb_info *c) -@@ -1211,7 +1202,6 @@ int jffs2_nand_flash_setup(struct jffs2_sb_info *c) - - /* Initialise write buffer */ - init_rwsem(&c->wbuf_sem); -- spin_lock_init(&c->wbuf_dwork_lock); - INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); - c->wbuf_pagesize = c->mtd->writesize; - c->wbuf_ofs = 0xFFFFFFFF; -@@ -1251,7 +1241,6 @@ int jffs2_dataflash_setup(struct jffs2_sb_info *c) { - - /* Initialize write buffer */ - init_rwsem(&c->wbuf_sem); -- spin_lock_init(&c->wbuf_dwork_lock); - INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); - c->wbuf_pagesize = c->mtd->erasesize; - -@@ -1311,7 +1300,6 @@ int jffs2_nor_wbuf_flash_setup(struct jffs2_sb_info *c) { - - /* Initialize write buffer */ - init_rwsem(&c->wbuf_sem); -- spin_lock_init(&c->wbuf_dwork_lock); - INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); - - c->wbuf_pagesize = c->mtd->writesize; -@@ -1346,7 +1334,6 @@ int jffs2_ubivol_setup(struct jffs2_sb_info *c) { - return 0; - - init_rwsem(&c->wbuf_sem); -- spin_lock_init(&c->wbuf_dwork_lock); - INIT_DELAYED_WORK(&c->wbuf_dwork, delayed_wbuf_sync); - - c->wbuf_pagesize = c->mtd->writesize; -diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c -index daa8e75..9106f42 100644 ---- a/fs/lockd/mon.c -+++ b/fs/lockd/mon.c -@@ -159,6 +159,12 @@ static int nsm_mon_unmon(struct nsm_handle *nsm, u32 proc, struct nsm_res *res, - - msg.rpc_proc = &clnt->cl_procinfo[proc]; - status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN); -+ if (status == -ECONNREFUSED) { -+ dprintk("lockd: NSM upcall RPC failed, status=%d, forcing rebind\n", -+ status); -+ rpc_force_rebind(clnt); -+ status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN); -+ } - if (status < 0) - dprintk("lockd: NSM upcall RPC failed, status=%d\n", - status); -diff --git a/fs/namei.c b/fs/namei.c -index 3ddb044..bb02687 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -3154,7 +3154,8 @@ static int do_tmpfile(int dfd, struct filename *pathname, - if (error) - goto out2; - audit_inode(pathname, nd->path.dentry, 0); -- error = may_open(&nd->path, op->acc_mode, op->open_flag); -+ /* Don't check for other permissions, the inode was just created */ -+ error = may_open(&nd->path, MAY_OPEN, op->open_flag); - if (error) - goto out2; - file->f_path.mnt = nd->path.mnt; -diff --git a/fs/namespace.c b/fs/namespace.c -index 7f67b46..550dbff 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -2822,6 +2822,9 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, - /* make sure we can reach put_old from new_root */ - if (!is_path_reachable(old_mnt, old.dentry, &new)) - goto out4; -+ /* make certain new is below the root */ -+ if (!is_path_reachable(new_mnt, new.dentry, &root)) -+ goto out4; - root_mp->m_count++; /* pin it so it won't go away */ - lock_mount_hash(); - detach_mnt(new_mnt, &parent_path); -diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index 5e0dc52..1d3cb47 100644 ---- a/fs/nfsd/nfs4proc.c -+++ b/fs/nfsd/nfs4proc.c -@@ -1229,7 +1229,8 @@ static bool need_wrongsec_check(struct svc_rqst *rqstp) - */ - if (argp->opcnt == resp->opcnt) - return false; -- -+ if (next->opnum == OP_ILLEGAL) -+ return false; - nextd = OPDESC(next); - /* - * Rest of 2.6.3.1.1: certain operations will return WRONGSEC -@@ -1546,7 +1547,8 @@ static inline u32 nfsd4_rename_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op - static inline u32 nfsd4_sequence_rsize(struct svc_rqst *rqstp, - struct nfsd4_op *op) - { -- return NFS4_MAX_SESSIONID_LEN + 20; -+ return (op_encode_hdr_size -+ + XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + 5) * sizeof(__be32); - } - - static inline u32 nfsd4_setattr_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op) -@@ -1850,6 +1852,7 @@ static struct nfsd4_operation nfsd4_ops[] = { - .op_func = (nfsd4op_func)nfsd4_sequence, - .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_AS_FIRST_OP, - .op_name = "OP_SEQUENCE", -+ .op_rsize_bop = (nfsd4op_rsize)nfsd4_sequence_rsize, - }, - [OP_DESTROY_CLIENTID] = { - .op_func = (nfsd4op_func)nfsd4_destroy_clientid, -diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c -index ea34952..485d22d 100644 ---- a/fs/ocfs2/cluster/tcp.c -+++ b/fs/ocfs2/cluster/tcp.c -@@ -925,7 +925,7 @@ static int o2net_send_tcp_msg(struct socket *sock, struct kvec *vec, - size_t veclen, size_t total) - { - int ret; -- struct msghdr msg; -+ struct msghdr msg = {.msg_flags = 0,}; - - if (sock == NULL) { - ret = -EINVAL; -diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c -index 192297b..fafb7a0 100644 ---- a/fs/pstore/inode.c -+++ b/fs/pstore/inode.c -@@ -320,10 +320,10 @@ int pstore_mkfile(enum pstore_type_id type, char *psname, u64 id, int count, - compressed ? ".enc.z" : ""); - break; - case PSTORE_TYPE_CONSOLE: -- sprintf(name, "console-%s", psname); -+ sprintf(name, "console-%s-%lld", psname, id); - break; - case PSTORE_TYPE_FTRACE: -- sprintf(name, "ftrace-%s", psname); -+ sprintf(name, "ftrace-%s-%lld", psname, id); - break; - case PSTORE_TYPE_MCE: - sprintf(name, "mce-%s-%lld", psname, id); -diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c -index f2d0eee..23c548d 100644 ---- a/fs/quota/dquot.c -+++ b/fs/quota/dquot.c -@@ -634,7 +634,7 @@ int dquot_writeback_dquots(struct super_block *sb, int type) - dqstats_inc(DQST_LOOKUPS); - err = sb->dq_op->write_dquot(dquot); - if (!ret && err) -- err = ret; -+ ret = err; - dqput(dquot); - spin_lock(&dq_list_lock); - } -diff --git a/fs/super.c b/fs/super.c -index b9a214d..6f8c954 100644 ---- a/fs/super.c -+++ b/fs/super.c -@@ -80,6 +80,8 @@ static unsigned long super_cache_scan(struct shrinker *shrink, - inodes = list_lru_count_node(&sb->s_inode_lru, sc->nid); - dentries = list_lru_count_node(&sb->s_dentry_lru, sc->nid); - total_objects = dentries + inodes + fs_objects + 1; -+ if (!total_objects) -+ total_objects = 1; - - /* proportion the scan between the caches */ - dentries = mult_frac(sc->nr_to_scan, dentries, total_objects); -diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c -index aa13ad0..26b69b2 100644 ---- a/fs/ubifs/commit.c -+++ b/fs/ubifs/commit.c -@@ -166,10 +166,6 @@ static int do_commit(struct ubifs_info *c) - err = ubifs_orphan_end_commit(c); - if (err) - goto out; -- old_ltail_lnum = c->ltail_lnum; -- err = ubifs_log_end_commit(c, new_ltail_lnum); -- if (err) -- goto out; - err = dbg_check_old_index(c, &zroot); - if (err) - goto out; -@@ -202,7 +198,9 @@ static int do_commit(struct ubifs_info *c) - c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS); - else - c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_NO_ORPHS); -- err = ubifs_write_master(c); -+ -+ old_ltail_lnum = c->ltail_lnum; -+ err = ubifs_log_end_commit(c, new_ltail_lnum); - if (err) - goto out; - -diff --git a/fs/ubifs/log.c b/fs/ubifs/log.c -index a47ddfc..c14628f 100644 ---- a/fs/ubifs/log.c -+++ b/fs/ubifs/log.c -@@ -106,10 +106,14 @@ static inline long long empty_log_bytes(const struct ubifs_info *c) - h = (long long)c->lhead_lnum * c->leb_size + c->lhead_offs; - t = (long long)c->ltail_lnum * c->leb_size; - -- if (h >= t) -+ if (h > t) - return c->log_bytes - h + t; -- else -+ else if (h != t) - return t - h; -+ else if (c->lhead_lnum != c->ltail_lnum) -+ return 0; -+ else -+ return c->log_bytes; - } - - /** -@@ -447,9 +451,9 @@ out: - * @ltail_lnum: new log tail LEB number - * - * This function is called on when the commit operation was finished. It -- * moves log tail to new position and unmaps LEBs which contain obsolete data. -- * Returns zero in case of success and a negative error code in case of -- * failure. -+ * moves log tail to new position and updates the master node so that it stores -+ * the new log tail LEB number. Returns zero in case of success and a negative -+ * error code in case of failure. - */ - int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum) - { -@@ -477,7 +481,12 @@ int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum) - spin_unlock(&c->buds_lock); - - err = dbg_check_bud_bytes(c); -+ if (err) -+ goto out; - -+ err = ubifs_write_master(c); -+ -+out: - mutex_unlock(&c->log_mutex); - return err; - } -diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c -index f1deb96..894924a 100644 ---- a/fs/xfs/xfs_itable.c -+++ b/fs/xfs/xfs_itable.c -@@ -236,8 +236,10 @@ xfs_bulkstat_grab_ichunk( - XFS_WANT_CORRUPTED_RETURN(stat == 1); - - /* Check if the record contains the inode in request */ -- if (irec->ir_startino + XFS_INODES_PER_CHUNK <= agino) -- return -EINVAL; -+ if (irec->ir_startino + XFS_INODES_PER_CHUNK <= agino) { -+ *icount = 0; -+ return 0; -+ } - - idx = agino - irec->ir_startino + 1; - if (idx < XFS_INODES_PER_CHUNK && -@@ -262,75 +264,76 @@ xfs_bulkstat_grab_ichunk( - - #define XFS_BULKSTAT_UBLEFT(ubleft) ((ubleft) >= statstruct_size) - -+struct xfs_bulkstat_agichunk { -+ char __user **ac_ubuffer;/* pointer into user's buffer */ -+ int ac_ubleft; /* bytes left in user's buffer */ -+ int ac_ubelem; /* spaces used in user's buffer */ -+}; -+ - /* - * Process inodes in chunk with a pointer to a formatter function - * that will iget the inode and fill in the appropriate structure. - */ --int -+static int - xfs_bulkstat_ag_ichunk( - struct xfs_mount *mp, - xfs_agnumber_t agno, - struct xfs_inobt_rec_incore *irbp, - bulkstat_one_pf formatter, - size_t statstruct_size, -- struct xfs_bulkstat_agichunk *acp) -+ struct xfs_bulkstat_agichunk *acp, -+ xfs_agino_t *last_agino) - { -- xfs_ino_t lastino = acp->ac_lastino; - char __user **ubufp = acp->ac_ubuffer; -- int ubleft = acp->ac_ubleft; -- int ubelem = acp->ac_ubelem; -- int chunkidx, clustidx; -+ int chunkidx; - int error = 0; -- xfs_agino_t agino; -+ xfs_agino_t agino = irbp->ir_startino; - -- for (agino = irbp->ir_startino, chunkidx = clustidx = 0; -- XFS_BULKSTAT_UBLEFT(ubleft) && -- irbp->ir_freecount < XFS_INODES_PER_CHUNK; -- chunkidx++, clustidx++, agino++) { -- int fmterror; /* bulkstat formatter result */ -+ for (chunkidx = 0; chunkidx < XFS_INODES_PER_CHUNK; -+ chunkidx++, agino++) { -+ int fmterror; - int ubused; -- xfs_ino_t ino = XFS_AGINO_TO_INO(mp, agno, agino); - -- ASSERT(chunkidx < XFS_INODES_PER_CHUNK); -+ /* inode won't fit in buffer, we are done */ -+ if (acp->ac_ubleft < statstruct_size) -+ break; - - /* Skip if this inode is free */ -- if (XFS_INOBT_MASK(chunkidx) & irbp->ir_free) { -- lastino = ino; -+ if (XFS_INOBT_MASK(chunkidx) & irbp->ir_free) - continue; -- } -- -- /* -- * Count used inodes as free so we can tell when the -- * chunk is used up. -- */ -- irbp->ir_freecount++; - - /* Get the inode and fill in a single buffer */ - ubused = statstruct_size; -- error = formatter(mp, ino, *ubufp, ubleft, &ubused, &fmterror); -- if (fmterror == BULKSTAT_RV_NOTHING) { -- if (error && error != -ENOENT && error != -EINVAL) { -- ubleft = 0; -- break; -- } -- lastino = ino; -- continue; -- } -- if (fmterror == BULKSTAT_RV_GIVEUP) { -- ubleft = 0; -+ error = formatter(mp, XFS_AGINO_TO_INO(mp, agno, agino), -+ *ubufp, acp->ac_ubleft, &ubused, &fmterror); -+ -+ if (fmterror == BULKSTAT_RV_GIVEUP || -+ (error && error != -ENOENT && error != -EINVAL)) { -+ acp->ac_ubleft = 0; - ASSERT(error); - break; - } -- if (*ubufp) -- *ubufp += ubused; -- ubleft -= ubused; -- ubelem++; -- lastino = ino; -+ -+ /* be careful not to leak error if at end of chunk */ -+ if (fmterror == BULKSTAT_RV_NOTHING || error) { -+ error = 0; -+ continue; -+ } -+ -+ *ubufp += ubused; -+ acp->ac_ubleft -= ubused; -+ acp->ac_ubelem++; - } - -- acp->ac_lastino = lastino; -- acp->ac_ubleft = ubleft; -- acp->ac_ubelem = ubelem; -+ /* -+ * Post-update *last_agino. At this point, agino will always point one -+ * inode past the last inode we processed successfully. Hence we -+ * substract that inode when setting the *last_agino cursor so that we -+ * return the correct cookie to userspace. On the next bulkstat call, -+ * the inode under the lastino cookie will be skipped as we have already -+ * processed it here. -+ */ -+ *last_agino = agino - 1; - - return error; - } -@@ -353,45 +356,33 @@ xfs_bulkstat( - xfs_agino_t agino; /* inode # in allocation group */ - xfs_agnumber_t agno; /* allocation group number */ - xfs_btree_cur_t *cur; /* btree cursor for ialloc btree */ -- int end_of_ag; /* set if we've seen the ag end */ -- int error; /* error code */ -- int fmterror;/* bulkstat formatter result */ -- int i; /* loop index */ -- int icount; /* count of inodes good in irbuf */ - size_t irbsize; /* size of irec buffer in bytes */ -- xfs_ino_t ino; /* inode number (filesystem) */ -- xfs_inobt_rec_incore_t *irbp; /* current irec buffer pointer */ - xfs_inobt_rec_incore_t *irbuf; /* start of irec buffer */ -- xfs_inobt_rec_incore_t *irbufend; /* end of good irec buffer entries */ -- xfs_ino_t lastino; /* last inode number returned */ - int nirbuf; /* size of irbuf */ -- int rval; /* return value error code */ -- int tmp; /* result value from btree calls */ - int ubcount; /* size of user's buffer */ -- int ubleft; /* bytes left in user's buffer */ -- char __user *ubufp; /* pointer into user's buffer */ -- int ubelem; /* spaces used in user's buffer */ -+ struct xfs_bulkstat_agichunk ac; -+ int error = 0; - - /* - * Get the last inode value, see if there's nothing to do. - */ -- ino = (xfs_ino_t)*lastinop; -- lastino = ino; -- agno = XFS_INO_TO_AGNO(mp, ino); -- agino = XFS_INO_TO_AGINO(mp, ino); -+ agno = XFS_INO_TO_AGNO(mp, *lastinop); -+ agino = XFS_INO_TO_AGINO(mp, *lastinop); - if (agno >= mp->m_sb.sb_agcount || -- ino != XFS_AGINO_TO_INO(mp, agno, agino)) { -+ *lastinop != XFS_AGINO_TO_INO(mp, agno, agino)) { - *done = 1; - *ubcountp = 0; - return 0; - } - - ubcount = *ubcountp; /* statstruct's */ -- ubleft = ubcount * statstruct_size; /* bytes */ -- *ubcountp = ubelem = 0; -+ ac.ac_ubuffer = &ubuffer; -+ ac.ac_ubleft = ubcount * statstruct_size; /* bytes */; -+ ac.ac_ubelem = 0; -+ -+ *ubcountp = 0; - *done = 0; -- fmterror = 0; -- ubufp = ubuffer; -+ - irbuf = kmem_zalloc_greedy(&irbsize, PAGE_SIZE, PAGE_SIZE * 4); - if (!irbuf) - return -ENOMEM; -@@ -402,9 +393,13 @@ xfs_bulkstat( - * Loop over the allocation groups, starting from the last - * inode returned; 0 means start of the allocation group. - */ -- rval = 0; -- while (XFS_BULKSTAT_UBLEFT(ubleft) && agno < mp->m_sb.sb_agcount) { -- cond_resched(); -+ while (agno < mp->m_sb.sb_agcount) { -+ struct xfs_inobt_rec_incore *irbp = irbuf; -+ struct xfs_inobt_rec_incore *irbufend = irbuf + nirbuf; -+ bool end_of_ag = false; -+ int icount = 0; -+ int stat; -+ - error = xfs_ialloc_read_agi(mp, NULL, agno, &agbp); - if (error) - break; -@@ -414,10 +409,6 @@ xfs_bulkstat( - */ - cur = xfs_inobt_init_cursor(mp, NULL, agbp, agno, - XFS_BTNUM_INO); -- irbp = irbuf; -- irbufend = irbuf + nirbuf; -- end_of_ag = 0; -- icount = 0; - if (agino > 0) { - /* - * In the middle of an allocation group, we need to get -@@ -427,22 +418,23 @@ xfs_bulkstat( - - error = xfs_bulkstat_grab_ichunk(cur, agino, &icount, &r); - if (error) -- break; -+ goto del_cursor; - if (icount) { - irbp->ir_startino = r.ir_startino; - irbp->ir_freecount = r.ir_freecount; - irbp->ir_free = r.ir_free; - irbp++; -- agino = r.ir_startino + XFS_INODES_PER_CHUNK; - } - /* Increment to the next record */ -- error = xfs_btree_increment(cur, 0, &tmp); -+ error = xfs_btree_increment(cur, 0, &stat); - } else { - /* Start of ag. Lookup the first inode chunk */ -- error = xfs_inobt_lookup(cur, 0, XFS_LOOKUP_GE, &tmp); -+ error = xfs_inobt_lookup(cur, 0, XFS_LOOKUP_GE, &stat); -+ } -+ if (error || stat == 0) { -+ end_of_ag = true; -+ goto del_cursor; - } -- if (error) -- break; - - /* - * Loop through inode btree records in this ag, -@@ -451,10 +443,10 @@ xfs_bulkstat( - while (irbp < irbufend && icount < ubcount) { - struct xfs_inobt_rec_incore r; - -- error = xfs_inobt_get_rec(cur, &r, &i); -- if (error || i == 0) { -- end_of_ag = 1; -- break; -+ error = xfs_inobt_get_rec(cur, &r, &stat); -+ if (error || stat == 0) { -+ end_of_ag = true; -+ goto del_cursor; - } - - /* -@@ -469,77 +461,79 @@ xfs_bulkstat( - irbp++; - icount += XFS_INODES_PER_CHUNK - r.ir_freecount; - } -- /* -- * Set agino to after this chunk and bump the cursor. -- */ -- agino = r.ir_startino + XFS_INODES_PER_CHUNK; -- error = xfs_btree_increment(cur, 0, &tmp); -+ error = xfs_btree_increment(cur, 0, &stat); -+ if (error || stat == 0) { -+ end_of_ag = true; -+ goto del_cursor; -+ } - cond_resched(); - } -+ - /* -- * Drop the btree buffers and the agi buffer. -- * We can't hold any of the locks these represent -- * when calling iget. -+ * Drop the btree buffers and the agi buffer as we can't hold any -+ * of the locks these represent when calling iget. If there is a -+ * pending error, then we are done. - */ -+del_cursor: - xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR); - xfs_buf_relse(agbp); -+ if (error) -+ break; - /* -- * Now format all the good inodes into the user's buffer. -+ * Now format all the good inodes into the user's buffer. The -+ * call to xfs_bulkstat_ag_ichunk() sets up the agino pointer -+ * for the next loop iteration. - */ - irbufend = irbp; - for (irbp = irbuf; -- irbp < irbufend && XFS_BULKSTAT_UBLEFT(ubleft); irbp++) { -- struct xfs_bulkstat_agichunk ac; -- -- ac.ac_lastino = lastino; -- ac.ac_ubuffer = &ubuffer; -- ac.ac_ubleft = ubleft; -- ac.ac_ubelem = ubelem; -+ irbp < irbufend && ac.ac_ubleft >= statstruct_size; -+ irbp++) { - error = xfs_bulkstat_ag_ichunk(mp, agno, irbp, -- formatter, statstruct_size, &ac); -+ formatter, statstruct_size, &ac, -+ &agino); - if (error) -- rval = error; -- -- lastino = ac.ac_lastino; -- ubleft = ac.ac_ubleft; -- ubelem = ac.ac_ubelem; -+ break; - - cond_resched(); - } -+ - /* -- * Set up for the next loop iteration. -+ * If we've run out of space or had a formatting error, we -+ * are now done - */ -- if (XFS_BULKSTAT_UBLEFT(ubleft)) { -- if (end_of_ag) { -- agno++; -- agino = 0; -- } else -- agino = XFS_INO_TO_AGINO(mp, lastino); -- } else -+ if (ac.ac_ubleft < statstruct_size || error) - break; -+ -+ if (end_of_ag) { -+ agno++; -+ agino = 0; -+ } - } - /* - * Done, we're either out of filesystem or space to put the data. - */ - kmem_free(irbuf); -- *ubcountp = ubelem; -+ *ubcountp = ac.ac_ubelem; -+ - /* -- * Found some inodes, return them now and return the error next time. -+ * We found some inodes, so clear the error status and return them. -+ * The lastino pointer will point directly at the inode that triggered -+ * any error that occurred, so on the next call the error will be -+ * triggered again and propagated to userspace as there will be no -+ * formatted inodes in the buffer. - */ -- if (ubelem) -- rval = 0; -- if (agno >= mp->m_sb.sb_agcount) { -- /* -- * If we ran out of filesystem, mark lastino as off -- * the end of the filesystem, so the next call -- * will return immediately. -- */ -- *lastinop = (xfs_ino_t)XFS_AGINO_TO_INO(mp, agno, 0); -+ if (ac.ac_ubelem) -+ error = 0; -+ -+ /* -+ * If we ran out of filesystem, lastino will point off the end of -+ * the filesystem so the next call will return immediately. -+ */ -+ *lastinop = XFS_AGINO_TO_INO(mp, agno, agino); -+ if (agno >= mp->m_sb.sb_agcount) - *done = 1; -- } else -- *lastinop = (xfs_ino_t)lastino; - -- return rval; -+ return error; - } - - int -diff --git a/fs/xfs/xfs_itable.h b/fs/xfs/xfs_itable.h -index aaed080..6ea8b39 100644 ---- a/fs/xfs/xfs_itable.h -+++ b/fs/xfs/xfs_itable.h -@@ -30,22 +30,6 @@ typedef int (*bulkstat_one_pf)(struct xfs_mount *mp, - int *ubused, - int *stat); - --struct xfs_bulkstat_agichunk { -- xfs_ino_t ac_lastino; /* last inode returned */ -- char __user **ac_ubuffer;/* pointer into user's buffer */ -- int ac_ubleft; /* bytes left in user's buffer */ -- int ac_ubelem; /* spaces used in user's buffer */ --}; -- --int --xfs_bulkstat_ag_ichunk( -- struct xfs_mount *mp, -- xfs_agnumber_t agno, -- struct xfs_inobt_rec_incore *irbp, -- bulkstat_one_pf formatter, -- size_t statstruct_size, -- struct xfs_bulkstat_agichunk *acp); -- - /* - * Values for stat return value. - */ -diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h -index e973540..2dd405c 100644 ---- a/include/drm/drm_pciids.h -+++ b/include/drm/drm_pciids.h -@@ -74,7 +74,6 @@ - {0x1002, 0x4C64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ - {0x1002, 0x4C66, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ - {0x1002, 0x4C67, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ -- {0x1002, 0x4C6E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|RADEON_IS_MOBILITY}, \ - {0x1002, 0x4E44, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ - {0x1002, 0x4E45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ - {0x1002, 0x4E46, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ -diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h -index 518b465..f2057ff8 100644 ---- a/include/linux/blkdev.h -+++ b/include/linux/blkdev.h -@@ -1142,8 +1142,7 @@ static inline bool blk_needs_flush_plug(struct task_struct *tsk) - /* - * tag stuff - */ --#define blk_rq_tagged(rq) \ -- ((rq)->mq_ctx || ((rq)->cmd_flags & REQ_QUEUED)) -+#define blk_rq_tagged(rq) ((rq)->cmd_flags & REQ_QUEUED) - extern int blk_queue_start_tag(struct request_queue *, struct request *); - extern struct request *blk_queue_find_tag(struct request_queue *, int); - extern void blk_queue_end_tag(struct request_queue *, struct request *); -@@ -1285,10 +1284,9 @@ static inline int queue_alignment_offset(struct request_queue *q) - static inline int queue_limit_alignment_offset(struct queue_limits *lim, sector_t sector) - { - unsigned int granularity = max(lim->physical_block_size, lim->io_min); -- unsigned int alignment = (sector << 9) & (granularity - 1); -+ unsigned int alignment = sector_div(sector, granularity >> 9) << 9; - -- return (granularity + lim->alignment_offset - alignment) -- & (granularity - 1); -+ return (granularity + lim->alignment_offset - alignment) % granularity; - } - - static inline int bdev_alignment_offset(struct block_device *bdev) -diff --git a/include/linux/hid.h b/include/linux/hid.h -index f53c4a9..26ee25f 100644 ---- a/include/linux/hid.h -+++ b/include/linux/hid.h -@@ -287,6 +287,7 @@ struct hid_item { - #define HID_QUIRK_HIDINPUT_FORCE 0x00000080 - #define HID_QUIRK_NO_EMPTY_INPUT 0x00000100 - #define HID_QUIRK_NO_INIT_INPUT_REPORTS 0x00000200 -+#define HID_QUIRK_ALWAYS_POLL 0x00000400 - #define HID_QUIRK_SKIP_OUTPUT_REPORTS 0x00010000 - #define HID_QUIRK_SKIP_OUTPUT_REPORT_ID 0x00020000 - #define HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP 0x00040000 -diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h -index e0752d2..2d946c9 100644 ---- a/include/linux/memcontrol.h -+++ b/include/linux/memcontrol.h -@@ -139,48 +139,23 @@ static inline bool mem_cgroup_disabled(void) - return false; - } - --void __mem_cgroup_begin_update_page_stat(struct page *page, bool *locked, -- unsigned long *flags); -- --extern atomic_t memcg_moving; -- --static inline void mem_cgroup_begin_update_page_stat(struct page *page, -- bool *locked, unsigned long *flags) --{ -- if (mem_cgroup_disabled()) -- return; -- rcu_read_lock(); -- *locked = false; -- if (atomic_read(&memcg_moving)) -- __mem_cgroup_begin_update_page_stat(page, locked, flags); --} -- --void __mem_cgroup_end_update_page_stat(struct page *page, -- unsigned long *flags); --static inline void mem_cgroup_end_update_page_stat(struct page *page, -- bool *locked, unsigned long *flags) --{ -- if (mem_cgroup_disabled()) -- return; -- if (*locked) -- __mem_cgroup_end_update_page_stat(page, flags); -- rcu_read_unlock(); --} -- --void mem_cgroup_update_page_stat(struct page *page, -- enum mem_cgroup_stat_index idx, -- int val); -- --static inline void mem_cgroup_inc_page_stat(struct page *page, -+struct mem_cgroup *mem_cgroup_begin_page_stat(struct page *page, bool *locked, -+ unsigned long *flags); -+void mem_cgroup_end_page_stat(struct mem_cgroup *memcg, bool locked, -+ unsigned long flags); -+void mem_cgroup_update_page_stat(struct mem_cgroup *memcg, -+ enum mem_cgroup_stat_index idx, int val); -+ -+static inline void mem_cgroup_inc_page_stat(struct mem_cgroup *memcg, - enum mem_cgroup_stat_index idx) - { -- mem_cgroup_update_page_stat(page, idx, 1); -+ mem_cgroup_update_page_stat(memcg, idx, 1); - } - --static inline void mem_cgroup_dec_page_stat(struct page *page, -+static inline void mem_cgroup_dec_page_stat(struct mem_cgroup *memcg, - enum mem_cgroup_stat_index idx) - { -- mem_cgroup_update_page_stat(page, idx, -1); -+ mem_cgroup_update_page_stat(memcg, idx, -1); - } - - unsigned long mem_cgroup_soft_limit_reclaim(struct zone *zone, int order, -@@ -315,13 +290,14 @@ mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p) - { - } - --static inline void mem_cgroup_begin_update_page_stat(struct page *page, -+static inline struct mem_cgroup *mem_cgroup_begin_page_stat(struct page *page, - bool *locked, unsigned long *flags) - { -+ return NULL; - } - --static inline void mem_cgroup_end_update_page_stat(struct page *page, -- bool *locked, unsigned long *flags) -+static inline void mem_cgroup_end_page_stat(struct mem_cgroup *memcg, -+ bool locked, unsigned long flags) - { - } - -@@ -343,12 +319,12 @@ static inline bool mem_cgroup_oom_synchronize(bool wait) - return false; - } - --static inline void mem_cgroup_inc_page_stat(struct page *page, -+static inline void mem_cgroup_inc_page_stat(struct mem_cgroup *memcg, - enum mem_cgroup_stat_index idx) - { - } - --static inline void mem_cgroup_dec_page_stat(struct page *page, -+static inline void mem_cgroup_dec_page_stat(struct mem_cgroup *memcg, - enum mem_cgroup_stat_index idx) - { - } -diff --git a/include/linux/mm.h b/include/linux/mm.h -index 16e6f1e..f952cc8 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -1174,6 +1174,7 @@ static inline void unmap_shared_mapping_range(struct address_space *mapping, - - extern void truncate_pagecache(struct inode *inode, loff_t new); - extern void truncate_setsize(struct inode *inode, loff_t newsize); -+void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to); - void truncate_pagecache_range(struct inode *inode, loff_t offset, loff_t end); - int truncate_inode_page(struct address_space *mapping, struct page *page); - int generic_error_remove_page(struct address_space *mapping, struct page *page); -@@ -1232,7 +1233,6 @@ int __set_page_dirty_no_writeback(struct page *page); - int redirty_page_for_writepage(struct writeback_control *wbc, - struct page *page); - void account_page_dirtied(struct page *page, struct address_space *mapping); --void account_page_writeback(struct page *page); - int set_page_dirty(struct page *page); - int set_page_dirty_lock(struct page *page); - int clear_page_dirty_for_io(struct page *page); -diff --git a/include/linux/of.h b/include/linux/of.h -index 6c4363b..ee0fc7e 100644 ---- a/include/linux/of.h -+++ b/include/linux/of.h -@@ -267,14 +267,12 @@ extern int of_property_read_u64(const struct device_node *np, - extern int of_property_read_string(struct device_node *np, - const char *propname, - const char **out_string); --extern int of_property_read_string_index(struct device_node *np, -- const char *propname, -- int index, const char **output); - extern int of_property_match_string(struct device_node *np, - const char *propname, - const char *string); --extern int of_property_count_strings(struct device_node *np, -- const char *propname); -+extern int of_property_read_string_helper(struct device_node *np, -+ const char *propname, -+ const char **out_strs, size_t sz, int index); - extern int of_device_is_compatible(const struct device_node *device, - const char *); - extern int of_device_is_available(const struct device_node *device); -@@ -486,15 +484,9 @@ static inline int of_property_read_string(struct device_node *np, - return -ENOSYS; - } - --static inline int of_property_read_string_index(struct device_node *np, -- const char *propname, int index, -- const char **out_string) --{ -- return -ENOSYS; --} -- --static inline int of_property_count_strings(struct device_node *np, -- const char *propname) -+static inline int of_property_read_string_helper(struct device_node *np, -+ const char *propname, -+ const char **out_strs, size_t sz, int index) - { - return -ENOSYS; - } -@@ -668,6 +660,70 @@ static inline int of_property_count_u64_elems(const struct device_node *np, - } - - /** -+ * of_property_read_string_array() - Read an array of strings from a multiple -+ * strings property. -+ * @np: device node from which the property value is to be read. -+ * @propname: name of the property to be searched. -+ * @out_strs: output array of string pointers. -+ * @sz: number of array elements to read. -+ * -+ * Search for a property in a device tree node and retrieve a list of -+ * terminated string values (pointer to data, not a copy) in that property. -+ * -+ * If @out_strs is NULL, the number of strings in the property is returned. -+ */ -+static inline int of_property_read_string_array(struct device_node *np, -+ const char *propname, const char **out_strs, -+ size_t sz) -+{ -+ return of_property_read_string_helper(np, propname, out_strs, sz, 0); -+} -+ -+/** -+ * of_property_count_strings() - Find and return the number of strings from a -+ * multiple strings property. -+ * @np: device node from which the property value is to be read. -+ * @propname: name of the property to be searched. -+ * -+ * Search for a property in a device tree node and retrieve the number of null -+ * terminated string contain in it. Returns the number of strings on -+ * success, -EINVAL if the property does not exist, -ENODATA if property -+ * does not have a value, and -EILSEQ if the string is not null-terminated -+ * within the length of the property data. -+ */ -+static inline int of_property_count_strings(struct device_node *np, -+ const char *propname) -+{ -+ return of_property_read_string_helper(np, propname, NULL, 0, 0); -+} -+ -+/** -+ * of_property_read_string_index() - Find and read a string from a multiple -+ * strings property. -+ * @np: device node from which the property value is to be read. -+ * @propname: name of the property to be searched. -+ * @index: index of the string in the list of strings -+ * @out_string: pointer to null terminated return string, modified only if -+ * return value is 0. -+ * -+ * Search for a property in a device tree node and retrieve a null -+ * terminated string value (pointer to data, not a copy) in the list of strings -+ * contained in that property. -+ * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if -+ * property does not have a value, and -EILSEQ if the string is not -+ * null-terminated within the length of the property data. -+ * -+ * The out_string pointer is modified only if a valid string can be decoded. -+ */ -+static inline int of_property_read_string_index(struct device_node *np, -+ const char *propname, -+ int index, const char **output) -+{ -+ int rc = of_property_read_string_helper(np, propname, output, 1, index); -+ return rc < 0 ? rc : 0; -+} -+ -+/** - * of_property_read_bool - Findfrom a property - * @np: device node from which the property value is to be read. - * @propname: name of the property to be searched. -diff --git a/include/linux/oom.h b/include/linux/oom.h -index 647395a..e8d6e10 100644 ---- a/include/linux/oom.h -+++ b/include/linux/oom.h -@@ -50,6 +50,9 @@ static inline bool oom_task_origin(const struct task_struct *p) - extern unsigned long oom_badness(struct task_struct *p, - struct mem_cgroup *memcg, const nodemask_t *nodemask, - unsigned long totalpages); -+ -+extern int oom_kills_count(void); -+extern void note_oom_kill(void); - extern void oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order, - unsigned int points, unsigned long totalpages, - struct mem_cgroup *memcg, nodemask_t *nodemask, -diff --git a/include/linux/string.h b/include/linux/string.h -index d36977e..3b42b37 100644 ---- a/include/linux/string.h -+++ b/include/linux/string.h -@@ -132,7 +132,7 @@ int bprintf(u32 *bin_buf, size_t size, const char *fmt, ...) __printf(3, 4); - #endif - - extern ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos, -- const void *from, size_t available); -+ const void *from, size_t available); - - /** - * strstarts - does @str start with @prefix? -@@ -144,7 +144,8 @@ static inline bool strstarts(const char *str, const char *prefix) - return strncmp(str, prefix, strlen(prefix)) == 0; - } - --extern size_t memweight(const void *ptr, size_t bytes); -+size_t memweight(const void *ptr, size_t bytes); -+void memzero_explicit(void *s, size_t count); - - /** - * kbasename - return the last part of a pathname. -diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h -index fcbfe87..cf391ee 100644 ---- a/include/linux/sunrpc/xprt.h -+++ b/include/linux/sunrpc/xprt.h -@@ -357,6 +357,7 @@ int xs_swapper(struct rpc_xprt *xprt, int enable); - #define XPRT_CONNECTION_ABORT (7) - #define XPRT_CONNECTION_CLOSE (8) - #define XPRT_CONGESTED (9) -+#define XPRT_CONNECTION_REUSE (10) - - static inline void xprt_set_connected(struct rpc_xprt *xprt) - { -diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h -index 32e0f5c..4a185a0 100644 ---- a/include/linux/usb/quirks.h -+++ b/include/linux/usb/quirks.h -@@ -44,4 +44,7 @@ - /* device generates spurious wakeup, ignore remote wakeup capability */ - #define USB_QUIRK_IGNORE_REMOTE_WAKEUP 0x00000200 - -+/* device can't handle device_qualifier descriptor requests */ -+#define USB_QUIRK_DEVICE_QUALIFIER 0x00000100 -+ - #endif /* __LINUX_USB_QUIRKS_H */ -diff --git a/include/net/ipv6.h b/include/net/ipv6.h -index a2db816..268c8f1 100644 ---- a/include/net/ipv6.h -+++ b/include/net/ipv6.h -@@ -669,6 +669,8 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add - return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr)); - } - -+void ipv6_proxy_select_ident(struct sk_buff *skb); -+ - int ip6_dst_hoplimit(struct dst_entry *dst); - - static inline int ip6_sk_dst_hoplimit(struct ipv6_pinfo *np, struct flowi6 *fl6, -diff --git a/include/scsi/scsi_tcq.h b/include/scsi/scsi_tcq.h -index e645835..56ed843 100644 ---- a/include/scsi/scsi_tcq.h -+++ b/include/scsi/scsi_tcq.h -@@ -67,8 +67,9 @@ static inline void scsi_activate_tcq(struct scsi_device *sdev, int depth) - if (!sdev->tagged_supported) - return; - -- if (!shost_use_blk_mq(sdev->host) && -- !blk_queue_tagged(sdev->request_queue)) -+ if (shost_use_blk_mq(sdev->host)) -+ queue_flag_set_unlocked(QUEUE_FLAG_QUEUED, sdev->request_queue); -+ else if (!blk_queue_tagged(sdev->request_queue)) - blk_queue_init_tags(sdev->request_queue, depth, - sdev->host->bqt); - -@@ -81,8 +82,7 @@ static inline void scsi_activate_tcq(struct scsi_device *sdev, int depth) - **/ - static inline void scsi_deactivate_tcq(struct scsi_device *sdev, int depth) - { -- if (!shost_use_blk_mq(sdev->host) && -- blk_queue_tagged(sdev->request_queue)) -+ if (blk_queue_tagged(sdev->request_queue)) - blk_queue_free_tags(sdev->request_queue); - scsi_adjust_queue_depth(sdev, 0, depth); - } -diff --git a/include/uapi/drm/vmwgfx_drm.h b/include/uapi/drm/vmwgfx_drm.h -index 4fc66f6..c472bedb 100644 ---- a/include/uapi/drm/vmwgfx_drm.h -+++ b/include/uapi/drm/vmwgfx_drm.h -@@ -29,7 +29,7 @@ - #define __VMWGFX_DRM_H__ - - #ifndef __KERNEL__ --#include <drm.h> -+#include <drm/drm.h> - #endif - - #define DRM_VMW_MAX_SURFACE_FACES 6 -diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h -index 1874ebe..a1d7e93 100644 ---- a/include/uapi/linux/input.h -+++ b/include/uapi/linux/input.h -@@ -739,6 +739,13 @@ struct input_keymap_entry { - #define KEY_BRIGHTNESS_MIN 0x250 /* Set Brightness to Minimum */ - #define KEY_BRIGHTNESS_MAX 0x251 /* Set Brightness to Maximum */ - -+#define KEY_KBDINPUTASSIST_PREV 0x260 -+#define KEY_KBDINPUTASSIST_NEXT 0x261 -+#define KEY_KBDINPUTASSIST_PREVGROUP 0x262 -+#define KEY_KBDINPUTASSIST_NEXTGROUP 0x263 -+#define KEY_KBDINPUTASSIST_ACCEPT 0x264 -+#define KEY_KBDINPUTASSIST_CANCEL 0x265 -+ - #define BTN_TRIGGER_HAPPY 0x2c0 - #define BTN_TRIGGER_HAPPY1 0x2c0 - #define BTN_TRIGGER_HAPPY2 0x2c1 -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 963bf13..658f232 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -902,13 +902,23 @@ static void put_ctx(struct perf_event_context *ctx) - } - } - --static void unclone_ctx(struct perf_event_context *ctx) -+/* -+ * This must be done under the ctx->lock, such as to serialize against -+ * context_equiv(), therefore we cannot call put_ctx() since that might end up -+ * calling scheduler related locks and ctx->lock nests inside those. -+ */ -+static __must_check struct perf_event_context * -+unclone_ctx(struct perf_event_context *ctx) - { -- if (ctx->parent_ctx) { -- put_ctx(ctx->parent_ctx); -+ struct perf_event_context *parent_ctx = ctx->parent_ctx; -+ -+ lockdep_assert_held(&ctx->lock); -+ -+ if (parent_ctx) - ctx->parent_ctx = NULL; -- } - ctx->generation++; -+ -+ return parent_ctx; - } - - static u32 perf_event_pid(struct perf_event *event, struct task_struct *p) -@@ -2210,6 +2220,9 @@ static void ctx_sched_out(struct perf_event_context *ctx, - static int context_equiv(struct perf_event_context *ctx1, - struct perf_event_context *ctx2) - { -+ lockdep_assert_held(&ctx1->lock); -+ lockdep_assert_held(&ctx2->lock); -+ - /* Pinning disables the swap optimization */ - if (ctx1->pin_count || ctx2->pin_count) - return 0; -@@ -2943,6 +2956,7 @@ static int event_enable_on_exec(struct perf_event *event, - */ - static void perf_event_enable_on_exec(struct perf_event_context *ctx) - { -+ struct perf_event_context *clone_ctx = NULL; - struct perf_event *event; - unsigned long flags; - int enabled = 0; -@@ -2974,7 +2988,7 @@ static void perf_event_enable_on_exec(struct perf_event_context *ctx) - * Unclone this context if we enabled any event. - */ - if (enabled) -- unclone_ctx(ctx); -+ clone_ctx = unclone_ctx(ctx); - - raw_spin_unlock(&ctx->lock); - -@@ -2984,6 +2998,9 @@ static void perf_event_enable_on_exec(struct perf_event_context *ctx) - perf_event_context_sched_in(ctx, ctx->task); - out: - local_irq_restore(flags); -+ -+ if (clone_ctx) -+ put_ctx(clone_ctx); - } - - void perf_event_exec(void) -@@ -3135,7 +3152,7 @@ errout: - static struct perf_event_context * - find_get_context(struct pmu *pmu, struct task_struct *task, int cpu) - { -- struct perf_event_context *ctx; -+ struct perf_event_context *ctx, *clone_ctx = NULL; - struct perf_cpu_context *cpuctx; - unsigned long flags; - int ctxn, err; -@@ -3169,9 +3186,12 @@ find_get_context(struct pmu *pmu, struct task_struct *task, int cpu) - retry: - ctx = perf_lock_task_context(task, ctxn, &flags); - if (ctx) { -- unclone_ctx(ctx); -+ clone_ctx = unclone_ctx(ctx); - ++ctx->pin_count; - raw_spin_unlock_irqrestore(&ctx->lock, flags); -+ -+ if (clone_ctx) -+ put_ctx(clone_ctx); - } else { - ctx = alloc_perf_context(pmu, task); - err = -ENOMEM; -@@ -7523,7 +7543,7 @@ __perf_event_exit_task(struct perf_event *child_event, - static void perf_event_exit_task_context(struct task_struct *child, int ctxn) - { - struct perf_event *child_event, *next; -- struct perf_event_context *child_ctx, *parent_ctx; -+ struct perf_event_context *child_ctx, *clone_ctx = NULL; - unsigned long flags; - - if (likely(!child->perf_event_ctxp[ctxn])) { -@@ -7550,28 +7570,16 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn) - child->perf_event_ctxp[ctxn] = NULL; - - /* -- * In order to avoid freeing: child_ctx->parent_ctx->task -- * under perf_event_context::lock, grab another reference. -- */ -- parent_ctx = child_ctx->parent_ctx; -- if (parent_ctx) -- get_ctx(parent_ctx); -- -- /* - * If this context is a clone; unclone it so it can't get - * swapped to another process while we're removing all - * the events from it. - */ -- unclone_ctx(child_ctx); -+ clone_ctx = unclone_ctx(child_ctx); - update_context_time(child_ctx); - raw_spin_unlock_irqrestore(&child_ctx->lock, flags); - -- /* -- * Now that we no longer hold perf_event_context::lock, drop -- * our extra child_ctx->parent_ctx reference. -- */ -- if (parent_ctx) -- put_ctx(parent_ctx); -+ if (clone_ctx) -+ put_ctx(clone_ctx); - - /* - * Report the task dead after unscheduling the events so that we -diff --git a/kernel/freezer.c b/kernel/freezer.c -index aa6a8aa..8f9279b 100644 ---- a/kernel/freezer.c -+++ b/kernel/freezer.c -@@ -42,6 +42,9 @@ bool freezing_slow_path(struct task_struct *p) - if (p->flags & (PF_NOFREEZE | PF_SUSPEND_TASK)) - return false; - -+ if (test_thread_flag(TIF_MEMDIE)) -+ return false; -+ - if (pm_nosig_freezing || cgroup_freezing(p)) - return true; - -diff --git a/kernel/futex.c b/kernel/futex.c -index f3a3a07..22b3f1b 100644 ---- a/kernel/futex.c -+++ b/kernel/futex.c -@@ -641,8 +641,14 @@ static struct futex_pi_state * alloc_pi_state(void) - return pi_state; - } - -+/* -+ * Must be called with the hb lock held. -+ */ - static void free_pi_state(struct futex_pi_state *pi_state) - { -+ if (!pi_state) -+ return; -+ - if (!atomic_dec_and_test(&pi_state->refcount)) - return; - -@@ -1521,15 +1527,6 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags, - } - - retry: -- if (pi_state != NULL) { -- /* -- * We will have to lookup the pi_state again, so free this one -- * to keep the accounting correct. -- */ -- free_pi_state(pi_state); -- pi_state = NULL; -- } -- - ret = get_futex_key(uaddr1, flags & FLAGS_SHARED, &key1, VERIFY_READ); - if (unlikely(ret != 0)) - goto out; -@@ -1619,6 +1616,8 @@ retry_private: - case 0: - break; - case -EFAULT: -+ free_pi_state(pi_state); -+ pi_state = NULL; - double_unlock_hb(hb1, hb2); - hb_waiters_dec(hb2); - put_futex_key(&key2); -@@ -1634,6 +1633,8 @@ retry_private: - * exit to complete. - * - The user space value changed. - */ -+ free_pi_state(pi_state); -+ pi_state = NULL; - double_unlock_hb(hb1, hb2); - hb_waiters_dec(hb2); - put_futex_key(&key2); -@@ -1710,6 +1711,7 @@ retry_private: - } - - out_unlock: -+ free_pi_state(pi_state); - double_unlock_hb(hb1, hb2); - hb_waiters_dec(hb2); - -@@ -1727,8 +1729,6 @@ out_put_keys: - out_put_key1: - put_futex_key(&key1); - out: -- if (pi_state != NULL) -- free_pi_state(pi_state); - return ret ? ret : task_count; - } - -diff --git a/kernel/module.c b/kernel/module.c -index 03214bd2..1c47139 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -1842,7 +1842,9 @@ static void free_module(struct module *mod) - - /* We leave it in list to prevent duplicate loads, but make sure - * that noone uses it while it's being deconstructed. */ -+ mutex_lock(&module_mutex); - mod->state = MODULE_STATE_UNFORMED; -+ mutex_unlock(&module_mutex); - - /* Remove dynamic debug info */ - ddebug_remove_module(mod->name); -diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c -index a9dfa79..1f35a34 100644 ---- a/kernel/power/hibernate.c -+++ b/kernel/power/hibernate.c -@@ -502,8 +502,14 @@ int hibernation_restore(int platform_mode) - error = dpm_suspend_start(PMSG_QUIESCE); - if (!error) { - error = resume_target_kernel(platform_mode); -- dpm_resume_end(PMSG_RECOVER); -+ /* -+ * The above should either succeed and jump to the new kernel, -+ * or return with an error. Otherwise things are just -+ * undefined, so let's be paranoid. -+ */ -+ BUG_ON(!error); - } -+ dpm_resume_end(PMSG_RECOVER); - pm_restore_gfp_mask(); - resume_console(); - pm_restore_console(); -diff --git a/kernel/power/process.c b/kernel/power/process.c -index 4ee194e..7a37cf3 100644 ---- a/kernel/power/process.c -+++ b/kernel/power/process.c -@@ -108,6 +108,28 @@ static int try_to_freeze_tasks(bool user_only) - return todo ? -EBUSY : 0; - } - -+/* -+ * Returns true if all freezable tasks (except for current) are frozen already -+ */ -+static bool check_frozen_processes(void) -+{ -+ struct task_struct *g, *p; -+ bool ret = true; -+ -+ read_lock(&tasklist_lock); -+ for_each_process_thread(g, p) { -+ if (p != current && !freezer_should_skip(p) && -+ !frozen(p)) { -+ ret = false; -+ goto done; -+ } -+ } -+done: -+ read_unlock(&tasklist_lock); -+ -+ return ret; -+} -+ - /** - * freeze_processes - Signal user space processes to enter the refrigerator. - * The current thread will not be frozen. The same process that calls -@@ -118,6 +140,7 @@ static int try_to_freeze_tasks(bool user_only) - int freeze_processes(void) - { - int error; -+ int oom_kills_saved; - - error = __usermodehelper_disable(UMH_FREEZING); - if (error) -@@ -131,12 +154,27 @@ int freeze_processes(void) - - printk("Freezing user space processes ... "); - pm_freezing = true; -+ oom_kills_saved = oom_kills_count(); - error = try_to_freeze_tasks(true); - if (!error) { -- printk("done."); - __usermodehelper_set_disable_depth(UMH_DISABLED); - oom_killer_disable(); -+ -+ /* -+ * There might have been an OOM kill while we were -+ * freezing tasks and the killed task might be still -+ * on the way out so we have to double check for race. -+ */ -+ if (oom_kills_count() != oom_kills_saved && -+ !check_frozen_processes()) { -+ __usermodehelper_set_disable_depth(UMH_ENABLED); -+ printk("OOM in progress."); -+ error = -EBUSY; -+ goto done; -+ } -+ printk("done."); - } -+done: - printk("\n"); - BUG_ON(in_atomic()); - -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index ec1a286..6d7cb91 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -1977,6 +1977,8 @@ unsigned long to_ratio(u64 period, u64 runtime) - #ifdef CONFIG_SMP - inline struct dl_bw *dl_bw_of(int i) - { -+ rcu_lockdep_assert(rcu_read_lock_sched_held(), -+ "sched RCU must be held"); - return &cpu_rq(i)->rd->dl_bw; - } - -@@ -1985,6 +1987,8 @@ static inline int dl_bw_cpus(int i) - struct root_domain *rd = cpu_rq(i)->rd; - int cpus = 0; - -+ rcu_lockdep_assert(rcu_read_lock_sched_held(), -+ "sched RCU must be held"); - for_each_cpu_and(i, rd->span, cpu_active_mask) - cpus++; - -@@ -4004,13 +4008,14 @@ long sched_setaffinity(pid_t pid, const struct cpumask *in_mask) - * root_domain. - */ - #ifdef CONFIG_SMP -- if (task_has_dl_policy(p)) { -- const struct cpumask *span = task_rq(p)->rd->span; -- -- if (dl_bandwidth_enabled() && !cpumask_subset(span, new_mask)) { -+ if (task_has_dl_policy(p) && dl_bandwidth_enabled()) { -+ rcu_read_lock(); -+ if (!cpumask_subset(task_rq(p)->rd->span, new_mask)) { - retval = -EBUSY; -+ rcu_read_unlock(); - goto out_unlock; - } -+ rcu_read_unlock(); - } - #endif - again: -@@ -7580,6 +7585,8 @@ static int sched_dl_global_constraints(void) - int cpu, ret = 0; - unsigned long flags; - -+ rcu_read_lock(); -+ - /* - * Here we want to check the bandwidth not being set to some - * value smaller than the currently allocated bandwidth in -@@ -7601,6 +7608,8 @@ static int sched_dl_global_constraints(void) - break; - } - -+ rcu_read_unlock(); -+ - return ret; - } - -@@ -7616,6 +7625,7 @@ static void sched_dl_do_global(void) - if (global_rt_runtime() != RUNTIME_INF) - new_bw = to_ratio(global_rt_period(), global_rt_runtime()); - -+ rcu_read_lock(); - /* - * FIXME: As above... - */ -@@ -7626,6 +7636,7 @@ static void sched_dl_do_global(void) - dl_b->bw = new_bw; - raw_spin_unlock_irqrestore(&dl_b->lock, flags); - } -+ rcu_read_unlock(); - } - - static int sched_rt_global_validate(void) -diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c -index 42b463a..31ea01f 100644 ---- a/kernel/time/posix-timers.c -+++ b/kernel/time/posix-timers.c -@@ -636,6 +636,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock, - goto out; - } - } else { -+ memset(&event.sigev_value, 0, sizeof(event.sigev_value)); - event.sigev_notify = SIGEV_SIGNAL; - event.sigev_signo = SIGALRM; - event.sigev_value.sival_int = new_timer->it_id; -diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c -index 759d5e0..7e3cd7a 100644 ---- a/kernel/trace/trace_syscalls.c -+++ b/kernel/trace/trace_syscalls.c -@@ -313,7 +313,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id) - int size; - - syscall_nr = trace_get_syscall_nr(current, regs); -- if (syscall_nr < 0) -+ if (syscall_nr < 0 || syscall_nr >= NR_syscalls) - return; - - /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE) */ -@@ -360,7 +360,7 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret) - int syscall_nr; - - syscall_nr = trace_get_syscall_nr(current, regs); -- if (syscall_nr < 0) -+ if (syscall_nr < 0 || syscall_nr >= NR_syscalls) - return; - - /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE()) */ -@@ -567,7 +567,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id) - int size; - - syscall_nr = trace_get_syscall_nr(current, regs); -- if (syscall_nr < 0) -+ if (syscall_nr < 0 || syscall_nr >= NR_syscalls) - return; - if (!test_bit(syscall_nr, enabled_perf_enter_syscalls)) - return; -@@ -641,7 +641,7 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret) - int size; - - syscall_nr = trace_get_syscall_nr(current, regs); -- if (syscall_nr < 0) -+ if (syscall_nr < 0 || syscall_nr >= NR_syscalls) - return; - if (!test_bit(syscall_nr, enabled_perf_exit_syscalls)) - return; -diff --git a/lib/bitmap.c b/lib/bitmap.c -index 1e031f2..33ce011 100644 ---- a/lib/bitmap.c -+++ b/lib/bitmap.c -@@ -131,7 +131,9 @@ void __bitmap_shift_right(unsigned long *dst, - lower = src[off + k]; - if (left && off + k == lim - 1) - lower &= mask; -- dst[k] = upper << (BITS_PER_LONG - rem) | lower >> rem; -+ dst[k] = lower >> rem; -+ if (rem) -+ dst[k] |= upper << (BITS_PER_LONG - rem); - if (left && k == lim - 1) - dst[k] &= mask; - } -@@ -172,7 +174,9 @@ void __bitmap_shift_left(unsigned long *dst, - upper = src[k]; - if (left && k == lim - 1) - upper &= (1UL << left) - 1; -- dst[k + off] = lower >> (BITS_PER_LONG - rem) | upper << rem; -+ dst[k + off] = upper << rem; -+ if (rem) -+ dst[k + off] |= lower >> (BITS_PER_LONG - rem); - if (left && k + off == lim - 1) - dst[k + off] &= (1UL << left) - 1; - } -diff --git a/lib/scatterlist.c b/lib/scatterlist.c -index 9cdf62f..c9f2e8c 100644 ---- a/lib/scatterlist.c -+++ b/lib/scatterlist.c -@@ -203,10 +203,10 @@ void __sg_free_table(struct sg_table *table, unsigned int max_ents, - } - - table->orig_nents -= sg_size; -- if (!skip_first_chunk) { -- free_fn(sgl, alloc_size); -+ if (skip_first_chunk) - skip_first_chunk = false; -- } -+ else -+ free_fn(sgl, alloc_size); - sgl = next; - } - -diff --git a/lib/string.c b/lib/string.c -index f3c6ff5..70db57a 100644 ---- a/lib/string.c -+++ b/lib/string.c -@@ -604,6 +604,22 @@ void *memset(void *s, int c, size_t count) - EXPORT_SYMBOL(memset); - #endif - -+/** -+ * memzero_explicit - Fill a region of memory (e.g. sensitive -+ * keying data) with 0s. -+ * @s: Pointer to the start of the area. -+ * @count: The size of the area. -+ * -+ * memzero_explicit() doesn't need an arch-specific version as -+ * it just invokes the one of memset() implicitly. -+ */ -+void memzero_explicit(void *s, size_t count) -+{ -+ memset(s, 0, count); -+ OPTIMIZER_HIDE_VAR(s); -+} -+EXPORT_SYMBOL(memzero_explicit); -+ - #ifndef __HAVE_ARCH_MEMCPY - /** - * memcpy - Copy one area of memory to another -diff --git a/mm/balloon_compaction.c b/mm/balloon_compaction.c -index 52abeeb..1811ea2 100644 ---- a/mm/balloon_compaction.c -+++ b/mm/balloon_compaction.c -@@ -93,11 +93,13 @@ struct page *balloon_page_dequeue(struct balloon_dev_info *b_dev_info) - * to be released by the balloon driver. - */ - if (trylock_page(page)) { -+#ifdef CONFIG_BALLOON_COMPACTION - if (!PagePrivate(page)) { - /* raced with isolation */ - unlock_page(page); - continue; - } -+#endif - spin_lock_irqsave(&b_dev_info->pages_lock, flags); - balloon_page_delete(page); - spin_unlock_irqrestore(&b_dev_info->pages_lock, flags); -diff --git a/mm/cma.c b/mm/cma.c -index 0ab5646..2904f45 100644 ---- a/mm/cma.c -+++ b/mm/cma.c -@@ -123,6 +123,7 @@ static int __init cma_activate_area(struct cma *cma) - - err: - kfree(cma->bitmap); -+ cma->count = 0; - return -EINVAL; - } - -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index f8ffd94..45c6d67 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -200,7 +200,7 @@ retry: - preempt_disable(); - if (cmpxchg(&huge_zero_page, NULL, zero_page)) { - preempt_enable(); -- __free_page(zero_page); -+ __free_pages(zero_page, compound_order(zero_page)); - goto retry; - } - -@@ -232,7 +232,7 @@ static unsigned long shrink_huge_zero_page_scan(struct shrinker *shrink, - if (atomic_cmpxchg(&huge_zero_refcount, 1, 0) == 1) { - struct page *zero_page = xchg(&huge_zero_page, NULL); - BUG_ON(zero_page == NULL); -- __free_page(zero_page); -+ __free_pages(zero_page, compound_order(zero_page)); - return HPAGE_PMD_NR; - } - -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index 28928ce..48914e1 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -1545,12 +1545,8 @@ int mem_cgroup_swappiness(struct mem_cgroup *memcg) - * start move here. - */ - --/* for quick checking without looking up memcg */ --atomic_t memcg_moving __read_mostly; -- - static void mem_cgroup_start_move(struct mem_cgroup *memcg) - { -- atomic_inc(&memcg_moving); - atomic_inc(&memcg->moving_account); - synchronize_rcu(); - } -@@ -1561,10 +1557,8 @@ static void mem_cgroup_end_move(struct mem_cgroup *memcg) - * Now, mem_cgroup_clear_mc() may call this function with NULL. - * We check NULL in callee rather than caller. - */ -- if (memcg) { -- atomic_dec(&memcg_moving); -+ if (memcg) - atomic_dec(&memcg->moving_account); -- } - } - - /* -@@ -2249,41 +2243,52 @@ cleanup: - return true; - } - --/* -- * Used to update mapped file or writeback or other statistics. -+/** -+ * mem_cgroup_begin_page_stat - begin a page state statistics transaction -+ * @page: page that is going to change accounted state -+ * @locked: &memcg->move_lock slowpath was taken -+ * @flags: IRQ-state flags for &memcg->move_lock - * -- * Notes: Race condition -+ * This function must mark the beginning of an accounted page state -+ * change to prevent double accounting when the page is concurrently -+ * being moved to another memcg: - * -- * Charging occurs during page instantiation, while the page is -- * unmapped and locked in page migration, or while the page table is -- * locked in THP migration. No race is possible. -+ * memcg = mem_cgroup_begin_page_stat(page, &locked, &flags); -+ * if (TestClearPageState(page)) -+ * mem_cgroup_update_page_stat(memcg, state, -1); -+ * mem_cgroup_end_page_stat(memcg, locked, flags); - * -- * Uncharge happens to pages with zero references, no race possible. -+ * The RCU lock is held throughout the transaction. The fast path can -+ * get away without acquiring the memcg->move_lock (@locked is false) -+ * because page moving starts with an RCU grace period. - * -- * Charge moving between groups is protected by checking mm->moving -- * account and taking the move_lock in the slowpath. -+ * The RCU lock also protects the memcg from being freed when the page -+ * state that is going to change is the only thing preventing the page -+ * from being uncharged. E.g. end-writeback clearing PageWriteback(), -+ * which allows migration to go ahead and uncharge the page before the -+ * account transaction might be complete. - */ -- --void __mem_cgroup_begin_update_page_stat(struct page *page, -- bool *locked, unsigned long *flags) -+struct mem_cgroup *mem_cgroup_begin_page_stat(struct page *page, -+ bool *locked, -+ unsigned long *flags) - { - struct mem_cgroup *memcg; - struct page_cgroup *pc; - -+ rcu_read_lock(); -+ -+ if (mem_cgroup_disabled()) -+ return NULL; -+ - pc = lookup_page_cgroup(page); - again: - memcg = pc->mem_cgroup; - if (unlikely(!memcg || !PageCgroupUsed(pc))) -- return; -- /* -- * If this memory cgroup is not under account moving, we don't -- * need to take move_lock_mem_cgroup(). Because we already hold -- * rcu_read_lock(), any calls to move_account will be delayed until -- * rcu_read_unlock(). -- */ -- VM_BUG_ON(!rcu_read_lock_held()); -+ return NULL; -+ -+ *locked = false; - if (atomic_read(&memcg->moving_account) <= 0) -- return; -+ return memcg; - - move_lock_mem_cgroup(memcg, flags); - if (memcg != pc->mem_cgroup || !PageCgroupUsed(pc)) { -@@ -2291,36 +2296,40 @@ again: - goto again; - } - *locked = true; -+ -+ return memcg; - } - --void __mem_cgroup_end_update_page_stat(struct page *page, unsigned long *flags) -+/** -+ * mem_cgroup_end_page_stat - finish a page state statistics transaction -+ * @memcg: the memcg that was accounted against -+ * @locked: value received from mem_cgroup_begin_page_stat() -+ * @flags: value received from mem_cgroup_begin_page_stat() -+ */ -+void mem_cgroup_end_page_stat(struct mem_cgroup *memcg, bool locked, -+ unsigned long flags) - { -- struct page_cgroup *pc = lookup_page_cgroup(page); -+ if (memcg && locked) -+ move_unlock_mem_cgroup(memcg, &flags); - -- /* -- * It's guaranteed that pc->mem_cgroup never changes while -- * lock is held because a routine modifies pc->mem_cgroup -- * should take move_lock_mem_cgroup(). -- */ -- move_unlock_mem_cgroup(pc->mem_cgroup, flags); -+ rcu_read_unlock(); - } - --void mem_cgroup_update_page_stat(struct page *page, -+/** -+ * mem_cgroup_update_page_stat - update page state statistics -+ * @memcg: memcg to account against -+ * @idx: page state item to account -+ * @val: number of pages (positive or negative) -+ * -+ * See mem_cgroup_begin_page_stat() for locking requirements. -+ */ -+void mem_cgroup_update_page_stat(struct mem_cgroup *memcg, - enum mem_cgroup_stat_index idx, int val) - { -- struct mem_cgroup *memcg; -- struct page_cgroup *pc = lookup_page_cgroup(page); -- unsigned long uninitialized_var(flags); -- -- if (mem_cgroup_disabled()) -- return; -- - VM_BUG_ON(!rcu_read_lock_held()); -- memcg = pc->mem_cgroup; -- if (unlikely(!memcg || !PageCgroupUsed(pc))) -- return; - -- this_cpu_add(memcg->stat->count[idx], val); -+ if (memcg) -+ this_cpu_add(memcg->stat->count[idx], val); - } - - /* -diff --git a/mm/memory.c b/mm/memory.c -index e229970..37b80fc 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -1147,6 +1147,7 @@ again: - print_bad_pte(vma, addr, ptent, page); - if (unlikely(!__tlb_remove_page(tlb, page))) { - force_flush = 1; -+ addr += PAGE_SIZE; - break; - } - continue; -diff --git a/mm/oom_kill.c b/mm/oom_kill.c -index 1e11df8..f1fb141 100644 ---- a/mm/oom_kill.c -+++ b/mm/oom_kill.c -@@ -404,6 +404,23 @@ static void dump_header(struct task_struct *p, gfp_t gfp_mask, int order, - dump_tasks(memcg, nodemask); - } - -+/* -+ * Number of OOM killer invocations (including memcg OOM killer). -+ * Primarily used by PM freezer to check for potential races with -+ * OOM killed frozen task. -+ */ -+static atomic_t oom_kills = ATOMIC_INIT(0); -+ -+int oom_kills_count(void) -+{ -+ return atomic_read(&oom_kills); -+} -+ -+void note_oom_kill(void) -+{ -+ atomic_inc(&oom_kills); -+} -+ - #define K(x) ((x) << (PAGE_SHIFT-10)) - /* - * Must be called while holding a reference to p, which will be released upon -diff --git a/mm/page-writeback.c b/mm/page-writeback.c -index 91d73ef..ba5fd97 100644 ---- a/mm/page-writeback.c -+++ b/mm/page-writeback.c -@@ -2116,23 +2116,6 @@ void account_page_dirtied(struct page *page, struct address_space *mapping) - EXPORT_SYMBOL(account_page_dirtied); - - /* -- * Helper function for set_page_writeback family. -- * -- * The caller must hold mem_cgroup_begin/end_update_page_stat() lock -- * while calling this function. -- * See test_set_page_writeback for example. -- * -- * NOTE: Unlike account_page_dirtied this does not rely on being atomic -- * wrt interrupts. -- */ --void account_page_writeback(struct page *page) --{ -- mem_cgroup_inc_page_stat(page, MEM_CGROUP_STAT_WRITEBACK); -- inc_zone_page_state(page, NR_WRITEBACK); --} --EXPORT_SYMBOL(account_page_writeback); -- --/* - * For address_spaces which do not use buffers. Just tag the page as dirty in - * its radix tree. - * -@@ -2344,11 +2327,12 @@ EXPORT_SYMBOL(clear_page_dirty_for_io); - int test_clear_page_writeback(struct page *page) - { - struct address_space *mapping = page_mapping(page); -- int ret; -- bool locked; - unsigned long memcg_flags; -+ struct mem_cgroup *memcg; -+ bool locked; -+ int ret; - -- mem_cgroup_begin_update_page_stat(page, &locked, &memcg_flags); -+ memcg = mem_cgroup_begin_page_stat(page, &locked, &memcg_flags); - if (mapping) { - struct backing_dev_info *bdi = mapping->backing_dev_info; - unsigned long flags; -@@ -2369,22 +2353,23 @@ int test_clear_page_writeback(struct page *page) - ret = TestClearPageWriteback(page); - } - if (ret) { -- mem_cgroup_dec_page_stat(page, MEM_CGROUP_STAT_WRITEBACK); -+ mem_cgroup_dec_page_stat(memcg, MEM_CGROUP_STAT_WRITEBACK); - dec_zone_page_state(page, NR_WRITEBACK); - inc_zone_page_state(page, NR_WRITTEN); - } -- mem_cgroup_end_update_page_stat(page, &locked, &memcg_flags); -+ mem_cgroup_end_page_stat(memcg, locked, memcg_flags); - return ret; - } - - int __test_set_page_writeback(struct page *page, bool keep_write) - { - struct address_space *mapping = page_mapping(page); -- int ret; -- bool locked; - unsigned long memcg_flags; -+ struct mem_cgroup *memcg; -+ bool locked; -+ int ret; - -- mem_cgroup_begin_update_page_stat(page, &locked, &memcg_flags); -+ memcg = mem_cgroup_begin_page_stat(page, &locked, &memcg_flags); - if (mapping) { - struct backing_dev_info *bdi = mapping->backing_dev_info; - unsigned long flags; -@@ -2410,9 +2395,11 @@ int __test_set_page_writeback(struct page *page, bool keep_write) - } else { - ret = TestSetPageWriteback(page); - } -- if (!ret) -- account_page_writeback(page); -- mem_cgroup_end_update_page_stat(page, &locked, &memcg_flags); -+ if (!ret) { -+ mem_cgroup_inc_page_stat(memcg, MEM_CGROUP_STAT_WRITEBACK); -+ inc_zone_page_state(page, NR_WRITEBACK); -+ } -+ mem_cgroup_end_page_stat(memcg, locked, memcg_flags); - return ret; - - } -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index eee9619..8c5029f 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -2253,6 +2253,14 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order, - } - - /* -+ * PM-freezer should be notified that there might be an OOM killer on -+ * its way to kill and wake somebody up. This is too early and we might -+ * end up not killing anything but false positives are acceptable. -+ * See freeze_processes. -+ */ -+ note_oom_kill(); -+ -+ /* - * Go through the zonelist yet one more time, keep very high watermark - * here, this is only to catch a parallel oom killing, we must fail if - * we're still under heavy pressure. -diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c -index 3708264..5331c2b 100644 ---- a/mm/page_cgroup.c -+++ b/mm/page_cgroup.c -@@ -171,6 +171,7 @@ static void free_page_cgroup(void *addr) - sizeof(struct page_cgroup) * PAGES_PER_SECTION; - - BUG_ON(PageReserved(page)); -+ kmemleak_free(addr); - free_pages_exact(addr, table_size); - } - } -diff --git a/mm/percpu.c b/mm/percpu.c -index da997f9..2139e30 100644 ---- a/mm/percpu.c -+++ b/mm/percpu.c -@@ -1932,8 +1932,6 @@ void __init setup_per_cpu_areas(void) - - if (pcpu_setup_first_chunk(ai, fc) < 0) - panic("Failed to initialize percpu areas."); -- -- pcpu_free_alloc_info(ai); - } - - #endif /* CONFIG_SMP */ -diff --git a/mm/rmap.c b/mm/rmap.c -index 3e8491c..e01318d 100644 ---- a/mm/rmap.c -+++ b/mm/rmap.c -@@ -1042,15 +1042,16 @@ void page_add_new_anon_rmap(struct page *page, - */ - void page_add_file_rmap(struct page *page) - { -- bool locked; -+ struct mem_cgroup *memcg; - unsigned long flags; -+ bool locked; - -- mem_cgroup_begin_update_page_stat(page, &locked, &flags); -+ memcg = mem_cgroup_begin_page_stat(page, &locked, &flags); - if (atomic_inc_and_test(&page->_mapcount)) { - __inc_zone_page_state(page, NR_FILE_MAPPED); -- mem_cgroup_inc_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED); -+ mem_cgroup_inc_page_stat(memcg, MEM_CGROUP_STAT_FILE_MAPPED); - } -- mem_cgroup_end_update_page_stat(page, &locked, &flags); -+ mem_cgroup_end_page_stat(memcg, locked, flags); - } - - /** -@@ -1061,9 +1062,10 @@ void page_add_file_rmap(struct page *page) - */ - void page_remove_rmap(struct page *page) - { -+ struct mem_cgroup *uninitialized_var(memcg); - bool anon = PageAnon(page); -- bool locked; - unsigned long flags; -+ bool locked; - - /* - * The anon case has no mem_cgroup page_stat to update; but may -@@ -1071,7 +1073,7 @@ void page_remove_rmap(struct page *page) - * we hold the lock against page_stat move: so avoid it on anon. - */ - if (!anon) -- mem_cgroup_begin_update_page_stat(page, &locked, &flags); -+ memcg = mem_cgroup_begin_page_stat(page, &locked, &flags); - - /* page still mapped by someone else? */ - if (!atomic_add_negative(-1, &page->_mapcount)) -@@ -1096,8 +1098,7 @@ void page_remove_rmap(struct page *page) - -hpage_nr_pages(page)); - } else { - __dec_zone_page_state(page, NR_FILE_MAPPED); -- mem_cgroup_dec_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED); -- mem_cgroup_end_update_page_stat(page, &locked, &flags); -+ mem_cgroup_dec_page_stat(memcg, MEM_CGROUP_STAT_FILE_MAPPED); - } - if (unlikely(PageMlocked(page))) - clear_page_mlock(page); -@@ -1110,10 +1111,9 @@ void page_remove_rmap(struct page *page) - * Leaving it set also helps swapoff to reinstate ptes - * faster for those pages still in swapcache. - */ -- return; - out: - if (!anon) -- mem_cgroup_end_update_page_stat(page, &locked, &flags); -+ mem_cgroup_end_page_stat(memcg, locked, flags); - } - - /* -diff --git a/mm/truncate.c b/mm/truncate.c -index 96d1673..c646084 100644 ---- a/mm/truncate.c -+++ b/mm/truncate.c -@@ -20,6 +20,7 @@ - #include <linux/buffer_head.h> /* grr. try_to_release_page, - do_invalidatepage */ - #include <linux/cleancache.h> -+#include <linux/rmap.h> - #include "internal.h" - - static void clear_exceptional_entry(struct address_space *mapping, -@@ -719,12 +720,67 @@ EXPORT_SYMBOL(truncate_pagecache); - */ - void truncate_setsize(struct inode *inode, loff_t newsize) - { -+ loff_t oldsize = inode->i_size; -+ - i_size_write(inode, newsize); -+ if (newsize > oldsize) -+ pagecache_isize_extended(inode, oldsize, newsize); - truncate_pagecache(inode, newsize); - } - EXPORT_SYMBOL(truncate_setsize); - - /** -+ * pagecache_isize_extended - update pagecache after extension of i_size -+ * @inode: inode for which i_size was extended -+ * @from: original inode size -+ * @to: new inode size -+ * -+ * Handle extension of inode size either caused by extending truncate or by -+ * write starting after current i_size. We mark the page straddling current -+ * i_size RO so that page_mkwrite() is called on the nearest write access to -+ * the page. This way filesystem can be sure that page_mkwrite() is called on -+ * the page before user writes to the page via mmap after the i_size has been -+ * changed. -+ * -+ * The function must be called after i_size is updated so that page fault -+ * coming after we unlock the page will already see the new i_size. -+ * The function must be called while we still hold i_mutex - this not only -+ * makes sure i_size is stable but also that userspace cannot observe new -+ * i_size value before we are prepared to store mmap writes at new inode size. -+ */ -+void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to) -+{ -+ int bsize = 1 << inode->i_blkbits; -+ loff_t rounded_from; -+ struct page *page; -+ pgoff_t index; -+ -+ WARN_ON(to > inode->i_size); -+ -+ if (from >= to || bsize == PAGE_CACHE_SIZE) -+ return; -+ /* Page straddling @from will not have any hole block created? */ -+ rounded_from = round_up(from, bsize); -+ if (to <= rounded_from || !(rounded_from & (PAGE_CACHE_SIZE - 1))) -+ return; -+ -+ index = from >> PAGE_CACHE_SHIFT; -+ page = find_lock_page(inode->i_mapping, index); -+ /* Page not cached? Nothing to do */ -+ if (!page) -+ return; -+ /* -+ * See clear_page_dirty_for_io() for details why set_page_dirty() -+ * is needed. -+ */ -+ if (page_mkclean(page)) -+ set_page_dirty(page); -+ unlock_page(page); -+ page_cache_release(page); -+} -+EXPORT_SYMBOL(pagecache_isize_extended); -+ -+/** - * truncate_pagecache_range - unmap and remove pagecache that is hole-punched - * @inode: inode - * @lstart: offset of beginning of hole -diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c -index b2f571d..9f02369 100644 ---- a/net/ceph/messenger.c -+++ b/net/ceph/messenger.c -@@ -292,7 +292,11 @@ int ceph_msgr_init(void) - if (ceph_msgr_slab_init()) - return -ENOMEM; - -- ceph_msgr_wq = alloc_workqueue("ceph-msgr", 0, 0); -+ /* -+ * The number of active work items is limited by the number of -+ * connections, so leave @max_active at default. -+ */ -+ ceph_msgr_wq = alloc_workqueue("ceph-msgr", WQ_MEM_RECLAIM, 0); - if (ceph_msgr_wq) - return 0; - -diff --git a/net/core/tso.c b/net/core/tso.c -index 8c3203c..630b30b 100644 ---- a/net/core/tso.c -+++ b/net/core/tso.c -@@ -1,6 +1,7 @@ - #include <linux/export.h> - #include <net/ip.h> - #include <net/tso.h> -+#include <asm/unaligned.h> - - /* Calculate expected number of TX descriptors */ - int tso_count_descs(struct sk_buff *skb) -@@ -23,7 +24,7 @@ void tso_build_hdr(struct sk_buff *skb, char *hdr, struct tso_t *tso, - iph->id = htons(tso->ip_id); - iph->tot_len = htons(size + hdr_len - mac_hdr_len); - tcph = (struct tcphdr *)(hdr + skb_transport_offset(skb)); -- tcph->seq = htonl(tso->tcp_seq); -+ put_unaligned_be32(tso->tcp_seq, &tcph->seq); - tso->ip_id++; - - if (!is_last) { -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index b10cd43a..4a74ea8 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -535,7 +535,7 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi) - return 1; - - attrlen = rtnh_attrlen(rtnh); -- if (attrlen < 0) { -+ if (attrlen > 0) { - struct nlattr *nla, *attrs = rtnh_attrs(rtnh); - - nla = nla_find(attrs, attrlen, RTA_GATEWAY); -diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c -index 6556263..dd73bea 100644 ---- a/net/ipv4/gre_offload.c -+++ b/net/ipv4/gre_offload.c -@@ -51,7 +51,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb, - - greh = (struct gre_base_hdr *)skb_transport_header(skb); - -- ghl = skb_inner_network_header(skb) - skb_transport_header(skb); -+ ghl = skb_inner_mac_header(skb) - skb_transport_header(skb); - if (unlikely(ghl < sizeof(*greh))) - goto out; - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index 215af2b..c43a1e2 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1533,6 +1533,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, - struct sk_buff *nskb; - struct sock *sk; - struct inet_sock *inet; -+ int err; - - if (ip_options_echo(&replyopts.opt.opt, skb)) - return; -@@ -1572,8 +1573,13 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, - sock_net_set(sk, net); - __skb_queue_head_init(&sk->sk_write_queue); - sk->sk_sndbuf = sysctl_wmem_default; -- ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, len, 0, -- &ipc, &rt, MSG_DONTWAIT); -+ err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, -+ len, 0, &ipc, &rt, MSG_DONTWAIT); -+ if (unlikely(err)) { -+ ip_flush_pending_frames(sk); -+ goto out; -+ } -+ - nskb = skb_peek(&sk->sk_write_queue); - if (nskb) { - if (arg->csumoffset >= 0) -@@ -1585,7 +1591,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, - skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb)); - ip_push_pending_frames(sk, &fl4); - } -- -+out: - put_cpu_var(unicast_sock); - - ip_rt_put(rt); -diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c -index f4c987b..88c386c 100644 ---- a/net/ipv4/ip_tunnel_core.c -+++ b/net/ipv4/ip_tunnel_core.c -@@ -91,11 +91,12 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto) - skb_pull_rcsum(skb, hdr_len); - - if (inner_proto == htons(ETH_P_TEB)) { -- struct ethhdr *eh = (struct ethhdr *)skb->data; -+ struct ethhdr *eh; - - if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) - return -ENOMEM; - -+ eh = (struct ethhdr *)skb->data; - if (likely(ntohs(eh->h_proto) >= ETH_P_802_3_MIN)) - skb->protocol = eh->h_proto; - else -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index cbadb94..29836f8 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -1798,6 +1798,7 @@ local_input: - no_route: - RT_CACHE_STAT_INC(in_no_route); - res.type = RTN_UNREACHABLE; -+ res.fi = NULL; - goto local_input; - - /* -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 541f26a..6b0b38f 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -2985,61 +2985,42 @@ EXPORT_SYMBOL(compat_tcp_getsockopt); - #endif - - #ifdef CONFIG_TCP_MD5SIG --static struct tcp_md5sig_pool __percpu *tcp_md5sig_pool __read_mostly; -+static DEFINE_PER_CPU(struct tcp_md5sig_pool, tcp_md5sig_pool); - static DEFINE_MUTEX(tcp_md5sig_mutex); -- --static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool __percpu *pool) --{ -- int cpu; -- -- for_each_possible_cpu(cpu) { -- struct tcp_md5sig_pool *p = per_cpu_ptr(pool, cpu); -- -- if (p->md5_desc.tfm) -- crypto_free_hash(p->md5_desc.tfm); -- } -- free_percpu(pool); --} -+static bool tcp_md5sig_pool_populated = false; - - static void __tcp_alloc_md5sig_pool(void) - { - int cpu; -- struct tcp_md5sig_pool __percpu *pool; -- -- pool = alloc_percpu(struct tcp_md5sig_pool); -- if (!pool) -- return; - - for_each_possible_cpu(cpu) { -- struct crypto_hash *hash; -- -- hash = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); -- if (IS_ERR_OR_NULL(hash)) -- goto out_free; -+ if (!per_cpu(tcp_md5sig_pool, cpu).md5_desc.tfm) { -+ struct crypto_hash *hash; - -- per_cpu_ptr(pool, cpu)->md5_desc.tfm = hash; -+ hash = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); -+ if (IS_ERR_OR_NULL(hash)) -+ return; -+ per_cpu(tcp_md5sig_pool, cpu).md5_desc.tfm = hash; -+ } - } -- /* before setting tcp_md5sig_pool, we must commit all writes -- * to memory. See ACCESS_ONCE() in tcp_get_md5sig_pool() -+ /* before setting tcp_md5sig_pool_populated, we must commit all writes -+ * to memory. See smp_rmb() in tcp_get_md5sig_pool() - */ - smp_wmb(); -- tcp_md5sig_pool = pool; -- return; --out_free: -- __tcp_free_md5sig_pool(pool); -+ tcp_md5sig_pool_populated = true; - } - - bool tcp_alloc_md5sig_pool(void) - { -- if (unlikely(!tcp_md5sig_pool)) { -+ if (unlikely(!tcp_md5sig_pool_populated)) { - mutex_lock(&tcp_md5sig_mutex); - -- if (!tcp_md5sig_pool) -+ if (!tcp_md5sig_pool_populated) - __tcp_alloc_md5sig_pool(); - - mutex_unlock(&tcp_md5sig_mutex); - } -- return tcp_md5sig_pool != NULL; -+ return tcp_md5sig_pool_populated; - } - EXPORT_SYMBOL(tcp_alloc_md5sig_pool); - -@@ -3053,13 +3034,13 @@ EXPORT_SYMBOL(tcp_alloc_md5sig_pool); - */ - struct tcp_md5sig_pool *tcp_get_md5sig_pool(void) - { -- struct tcp_md5sig_pool __percpu *p; -- - local_bh_disable(); -- p = ACCESS_ONCE(tcp_md5sig_pool); -- if (p) -- return __this_cpu_ptr(p); - -+ if (tcp_md5sig_pool_populated) { -+ /* coupled with smp_wmb() in __tcp_alloc_md5sig_pool() */ -+ smp_rmb(); -+ return this_cpu_ptr(&tcp_md5sig_pool); -+ } - local_bh_enable(); - return NULL; - } -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index cd17f00..3f49eae 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -208,8 +208,6 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - inet->inet_dport = usin->sin_port; - inet->inet_daddr = daddr; - -- inet_set_txhash(sk); -- - inet_csk(sk)->icsk_ext_hdr_len = 0; - if (inet_opt) - inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen; -@@ -226,6 +224,8 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - if (err) - goto failure; - -+ inet_set_txhash(sk); -+ - rt = ip_route_newports(fl4, rt, orig_sport, orig_dport, - inet->inet_sport, inet->inet_dport, sk); - if (IS_ERR(rt)) { -diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c -index 5ec867e..1d4156d 100644 ---- a/net/ipv6/output_core.c -+++ b/net/ipv6/output_core.c -@@ -3,11 +3,45 @@ - * not configured or static. These functions are needed by GSO/GRO implementation. - */ - #include <linux/export.h> -+#include <net/ip.h> - #include <net/ipv6.h> - #include <net/ip6_fib.h> - #include <net/addrconf.h> - #include <net/secure_seq.h> - -+/* This function exists only for tap drivers that must support broken -+ * clients requesting UFO without specifying an IPv6 fragment ID. -+ * -+ * This is similar to ipv6_select_ident() but we use an independent hash -+ * seed to limit information leakage. -+ * -+ * The network header must be set before calling this. -+ */ -+void ipv6_proxy_select_ident(struct sk_buff *skb) -+{ -+ static u32 ip6_proxy_idents_hashrnd __read_mostly; -+ struct in6_addr buf[2]; -+ struct in6_addr *addrs; -+ u32 hash, id; -+ -+ addrs = skb_header_pointer(skb, -+ skb_network_offset(skb) + -+ offsetof(struct ipv6hdr, saddr), -+ sizeof(buf), buf); -+ if (!addrs) -+ return; -+ -+ net_get_random_once(&ip6_proxy_idents_hashrnd, -+ sizeof(ip6_proxy_idents_hashrnd)); -+ -+ hash = __ipv6_addr_jhash(&addrs[1], ip6_proxy_idents_hashrnd); -+ hash = __ipv6_addr_jhash(&addrs[0], hash); -+ -+ id = ip_idents_reserve(hash, 1); -+ skb_shinfo(skb)->ip6_frag_id = htonl(id); -+} -+EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident); -+ - int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) - { - u16 offset = sizeof(struct ipv6hdr); -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 29964c3..264c0f2 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -198,8 +198,6 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, - sk->sk_v6_daddr = usin->sin6_addr; - np->flow_label = fl6.flowlabel; - -- ip6_set_txhash(sk); -- - /* - * TCP over IPv4 - */ -@@ -295,6 +293,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, - if (err) - goto late_failure; - -+ ip6_set_txhash(sk); -+ - if (!tp->write_seq && likely(!tp->repair)) - tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32, - sk->sk_v6_daddr.s6_addr32, -diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c -index 8fdadfd..6081329 100644 ---- a/net/mac80211/rate.c -+++ b/net/mac80211/rate.c -@@ -448,7 +448,7 @@ static void rate_fixup_ratelist(struct ieee80211_vif *vif, - */ - if (!(rates[0].flags & IEEE80211_TX_RC_MCS)) { - u32 basic_rates = vif->bss_conf.basic_rates; -- s8 baserate = basic_rates ? ffs(basic_rates - 1) : 0; -+ s8 baserate = basic_rates ? ffs(basic_rates) - 1 : 0; - - rate = &sband->bitrates[rates[0].idx]; - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index c416725..f1de72d 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -96,6 +96,14 @@ static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait); - static int netlink_dump(struct sock *sk); - static void netlink_skb_destructor(struct sk_buff *skb); - -+/* nl_table locking explained: -+ * Lookup and traversal are protected with nl_sk_hash_lock or nl_table_lock -+ * combined with an RCU read-side lock. Insertion and removal are protected -+ * with nl_sk_hash_lock while using RCU list modification primitives and may -+ * run in parallel to nl_table_lock protected lookups. Destruction of the -+ * Netlink socket may only occur *after* nl_table_lock has been acquired -+ * either during or after the socket has been removed from the list. -+ */ - DEFINE_RWLOCK(nl_table_lock); - EXPORT_SYMBOL_GPL(nl_table_lock); - static atomic_t nl_table_users = ATOMIC_INIT(0); -@@ -109,10 +117,10 @@ EXPORT_SYMBOL_GPL(nl_sk_hash_lock); - static int lockdep_nl_sk_hash_is_held(void) - { - #ifdef CONFIG_LOCKDEP -- return (debug_locks) ? lockdep_is_held(&nl_sk_hash_lock) : 1; --#else -- return 1; -+ if (debug_locks) -+ return lockdep_is_held(&nl_sk_hash_lock) || lockdep_is_held(&nl_table_lock); - #endif -+ return 1; - } - - static ATOMIC_NOTIFIER_HEAD(netlink_chain); -@@ -715,7 +723,7 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, - * after validation, the socket and the ring may only be used by a - * single process, otherwise we fall back to copying. - */ -- if (atomic_long_read(&sk->sk_socket->file->f_count) > 2 || -+ if (atomic_long_read(&sk->sk_socket->file->f_count) > 1 || - atomic_read(&nlk->mapped) > 1) - excl = false; - -@@ -1028,11 +1036,13 @@ static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid) - struct netlink_table *table = &nl_table[protocol]; - struct sock *sk; - -+ read_lock(&nl_table_lock); - rcu_read_lock(); - sk = __netlink_lookup(table, portid, net); - if (sk) - sock_hold(sk); - rcu_read_unlock(); -+ read_unlock(&nl_table_lock); - - return sk; - } -@@ -1257,9 +1267,6 @@ static int netlink_release(struct socket *sock) - } - netlink_table_ungrab(); - -- /* Wait for readers to complete */ -- synchronize_net(); -- - kfree(nlk->groups); - nlk->groups = NULL; - -@@ -1281,6 +1288,7 @@ static int netlink_autobind(struct socket *sock) - - retry: - cond_resched(); -+ netlink_table_grab(); - rcu_read_lock(); - if (__netlink_lookup(table, portid, net)) { - /* Bind collision, search negative portid values. */ -@@ -1288,9 +1296,11 @@ retry: - if (rover > -4097) - rover = -4097; - rcu_read_unlock(); -+ netlink_table_ungrab(); - goto retry; - } - rcu_read_unlock(); -+ netlink_table_ungrab(); - - err = netlink_insert(sk, net, portid); - if (err == -EADDRINUSE) -@@ -2921,14 +2931,16 @@ static struct sock *netlink_seq_socket_idx(struct seq_file *seq, loff_t pos) - } - - static void *netlink_seq_start(struct seq_file *seq, loff_t *pos) -- __acquires(RCU) -+ __acquires(nl_table_lock) __acquires(RCU) - { -+ read_lock(&nl_table_lock); - rcu_read_lock(); - return *pos ? netlink_seq_socket_idx(seq, *pos - 1) : SEQ_START_TOKEN; - } - - static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos) - { -+ struct rhashtable *ht; - struct netlink_sock *nlk; - struct nl_seq_iter *iter; - struct net *net; -@@ -2943,19 +2955,19 @@ static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos) - iter = seq->private; - nlk = v; - -- rht_for_each_entry_rcu(nlk, nlk->node.next, node) -+ i = iter->link; -+ ht = &nl_table[i].hash; -+ rht_for_each_entry(nlk, nlk->node.next, ht, node) - if (net_eq(sock_net((struct sock *)nlk), net)) - return nlk; - -- i = iter->link; - j = iter->hash_idx + 1; - - do { -- struct rhashtable *ht = &nl_table[i].hash; - const struct bucket_table *tbl = rht_dereference_rcu(ht->tbl, ht); - - for (; j < tbl->size; j++) { -- rht_for_each_entry_rcu(nlk, tbl->buckets[j], node) { -+ rht_for_each_entry(nlk, tbl->buckets[j], ht, node) { - if (net_eq(sock_net((struct sock *)nlk), net)) { - iter->link = i; - iter->hash_idx = j; -@@ -2971,9 +2983,10 @@ static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos) - } - - static void netlink_seq_stop(struct seq_file *seq, void *v) -- __releases(RCU) -+ __releases(RCU) __releases(nl_table_lock) - { - rcu_read_unlock(); -+ read_unlock(&nl_table_lock); - } - - -diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c -index 488ddee..e0b94ce 100644 ---- a/net/sunrpc/clnt.c -+++ b/net/sunrpc/clnt.c -@@ -461,6 +461,8 @@ struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args, - - if (args->flags & RPC_CLNT_CREATE_AUTOBIND) - clnt->cl_autobind = 1; -+ if (args->flags & RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT) -+ clnt->cl_noretranstimeo = 1; - if (args->flags & RPC_CLNT_CREATE_DISCRTRY) - clnt->cl_discrtry = 1; - if (!(args->flags & RPC_CLNT_CREATE_QUIET)) -@@ -579,6 +581,7 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args, - /* Turn off autobind on clones */ - new->cl_autobind = 0; - new->cl_softrtry = clnt->cl_softrtry; -+ new->cl_noretranstimeo = clnt->cl_noretranstimeo; - new->cl_discrtry = clnt->cl_discrtry; - new->cl_chatty = clnt->cl_chatty; - return new; -diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c -index 43cd89e..700f879 100644 ---- a/net/sunrpc/xprtsock.c -+++ b/net/sunrpc/xprtsock.c -@@ -845,6 +845,8 @@ static void xs_error_report(struct sock *sk) - dprintk("RPC: xs_error_report client %p, error=%d...\n", - xprt, -err); - trace_rpc_socket_error(xprt, sk->sk_socket, err); -+ if (test_bit(XPRT_CONNECTION_REUSE, &xprt->state)) -+ goto out; - xprt_wake_pending_tasks(xprt, err); - out: - read_unlock_bh(&sk->sk_callback_lock); -@@ -2245,7 +2247,9 @@ static void xs_tcp_setup_socket(struct work_struct *work) - abort_and_exit = test_and_clear_bit(XPRT_CONNECTION_ABORT, - &xprt->state); - /* "close" the socket, preserving the local port */ -+ set_bit(XPRT_CONNECTION_REUSE, &xprt->state); - xs_tcp_reuse_connection(transport); -+ clear_bit(XPRT_CONNECTION_REUSE, &xprt->state); - - if (abort_and_exit) - goto out_eagain; -diff --git a/net/tipc/link.c b/net/tipc/link.c -index fb1485d..6402065 100644 ---- a/net/tipc/link.c -+++ b/net/tipc/link.c -@@ -1936,7 +1936,12 @@ void tipc_link_bundle_rcv(struct sk_buff *buf) - } - omsg = buf_msg(obuf); - pos += align(msg_size(omsg)); -- if (msg_isdata(omsg) || (msg_user(omsg) == CONN_MANAGER)) { -+ if (msg_isdata(omsg)) { -+ if (unlikely(msg_type(omsg) == TIPC_MCAST_MSG)) -+ tipc_sk_mcast_rcv(obuf); -+ else -+ tipc_sk_rcv(obuf); -+ } else if (msg_user(omsg) == CONN_MANAGER) { - tipc_sk_rcv(obuf); - } else if (msg_user(omsg) == NAME_DISTRIBUTOR) { - tipc_named_rcv(obuf); -diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c -index 3bcb80d..970772c 100644 ---- a/security/integrity/evm/evm_main.c -+++ b/security/integrity/evm/evm_main.c -@@ -284,6 +284,13 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, - goto out; - } - evm_status = evm_verify_current_integrity(dentry); -+ if (evm_status == INTEGRITY_NOXATTRS) { -+ struct integrity_iint_cache *iint; -+ -+ iint = integrity_iint_find(dentry->d_inode); -+ if (iint && (iint->flags & IMA_NEW_FILE)) -+ return 0; -+ } - out: - if (evm_status != INTEGRITY_PASS) - integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode, -@@ -311,9 +318,12 @@ int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, - { - const struct evm_ima_xattr_data *xattr_data = xattr_value; - -- if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0) -- && (xattr_data->type == EVM_XATTR_HMAC)) -- return -EPERM; -+ if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) { -+ if (!xattr_value_len) -+ return -EINVAL; -+ if (xattr_data->type != EVM_IMA_XATTR_DIGSIG) -+ return -EPERM; -+ } - return evm_protect_xattr(dentry, xattr_name, xattr_value, - xattr_value_len); - } -diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c -index 225fd94..5850943 100644 ---- a/security/integrity/ima/ima_appraise.c -+++ b/security/integrity/ima/ima_appraise.c -@@ -378,6 +378,8 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, - result = ima_protect_xattr(dentry, xattr_name, xattr_value, - xattr_value_len); - if (result == 1) { -+ if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST)) -+ return -EINVAL; - ima_reset_appraise_flags(dentry->d_inode, - (xvalue->type == EVM_IMA_XATTR_DIGSIG) ? 1 : 0); - result = 0; -diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h -index 904e68a..6885058 100644 ---- a/security/integrity/integrity.h -+++ b/security/integrity/integrity.h -@@ -61,6 +61,7 @@ enum evm_ima_xattr_type { - EVM_XATTR_HMAC, - EVM_IMA_XATTR_DIGSIG, - IMA_XATTR_DIGEST_NG, -+ IMA_XATTR_LAST - }; - - struct evm_ima_xattr_data { -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index b0e9404..e03bad5 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -481,6 +481,7 @@ next_inode: - list_entry(sbsec->isec_head.next, - struct inode_security_struct, list); - struct inode *inode = isec->inode; -+ list_del_init(&isec->list); - spin_unlock(&sbsec->isec_lock); - inode = igrab(inode); - if (inode) { -@@ -489,7 +490,6 @@ next_inode: - iput(inode); - } - spin_lock(&sbsec->isec_lock); -- list_del_init(&isec->list); - goto next_inode; - } - spin_unlock(&sbsec->isec_lock); -diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c -index 102e8fd..2d957ba 100644 ---- a/sound/core/pcm_compat.c -+++ b/sound/core/pcm_compat.c -@@ -210,6 +210,8 @@ static int snd_pcm_status_user_compat(struct snd_pcm_substream *substream, - if (err < 0) - return err; - -+ if (clear_user(src, sizeof(*src))) -+ return -EFAULT; - if (put_user(status.state, &src->state) || - compat_put_timespec(&status.trigger_tstamp, &src->trigger_tstamp) || - compat_put_timespec(&status.tstamp, &src->tstamp) || -diff --git a/sound/firewire/bebob/bebob_focusrite.c b/sound/firewire/bebob/bebob_focusrite.c -index 45a0eed..3b052ed 100644 ---- a/sound/firewire/bebob/bebob_focusrite.c -+++ b/sound/firewire/bebob/bebob_focusrite.c -@@ -27,12 +27,14 @@ - #define SAFFIRE_CLOCK_SOURCE_INTERNAL 0 - #define SAFFIRE_CLOCK_SOURCE_SPDIF 1 - --/* '1' is absent, why... */ -+/* clock sources as returned from register of Saffire Pro 10 and 26 */ - #define SAFFIREPRO_CLOCK_SOURCE_INTERNAL 0 -+#define SAFFIREPRO_CLOCK_SOURCE_SKIP 1 /* never used on hardware */ - #define SAFFIREPRO_CLOCK_SOURCE_SPDIF 2 --#define SAFFIREPRO_CLOCK_SOURCE_ADAT1 3 --#define SAFFIREPRO_CLOCK_SOURCE_ADAT2 4 -+#define SAFFIREPRO_CLOCK_SOURCE_ADAT1 3 /* not used on s.pro. 10 */ -+#define SAFFIREPRO_CLOCK_SOURCE_ADAT2 4 /* not used on s.pro. 10 */ - #define SAFFIREPRO_CLOCK_SOURCE_WORDCLOCK 5 -+#define SAFFIREPRO_CLOCK_SOURCE_COUNT 6 - - /* S/PDIF, ADAT1, ADAT2 is enabled or not. three quadlets */ - #define SAFFIREPRO_ENABLE_DIG_IFACES 0x01a4 -@@ -101,13 +103,34 @@ saffire_write_quad(struct snd_bebob *bebob, u64 offset, u32 value) - &data, sizeof(__be32), 0); - } - -+static char *const saffirepro_10_clk_src_labels[] = { -+ SND_BEBOB_CLOCK_INTERNAL, "S/PDIF", "Word Clock" -+}; - static char *const saffirepro_26_clk_src_labels[] = { - SND_BEBOB_CLOCK_INTERNAL, "S/PDIF", "ADAT1", "ADAT2", "Word Clock" - }; -- --static char *const saffirepro_10_clk_src_labels[] = { -- SND_BEBOB_CLOCK_INTERNAL, "S/PDIF", "Word Clock" -+/* Value maps between registers and labels for SaffirePro 10/26. */ -+static const signed char saffirepro_clk_maps[][SAFFIREPRO_CLOCK_SOURCE_COUNT] = { -+ /* SaffirePro 10 */ -+ [0] = { -+ [SAFFIREPRO_CLOCK_SOURCE_INTERNAL] = 0, -+ [SAFFIREPRO_CLOCK_SOURCE_SKIP] = -1, /* not supported */ -+ [SAFFIREPRO_CLOCK_SOURCE_SPDIF] = 1, -+ [SAFFIREPRO_CLOCK_SOURCE_ADAT1] = -1, /* not supported */ -+ [SAFFIREPRO_CLOCK_SOURCE_ADAT2] = -1, /* not supported */ -+ [SAFFIREPRO_CLOCK_SOURCE_WORDCLOCK] = 2, -+ }, -+ /* SaffirePro 26 */ -+ [1] = { -+ [SAFFIREPRO_CLOCK_SOURCE_INTERNAL] = 0, -+ [SAFFIREPRO_CLOCK_SOURCE_SKIP] = -1, /* not supported */ -+ [SAFFIREPRO_CLOCK_SOURCE_SPDIF] = 1, -+ [SAFFIREPRO_CLOCK_SOURCE_ADAT1] = 2, -+ [SAFFIREPRO_CLOCK_SOURCE_ADAT2] = 3, -+ [SAFFIREPRO_CLOCK_SOURCE_WORDCLOCK] = 4, -+ } - }; -+ - static int - saffirepro_both_clk_freq_get(struct snd_bebob *bebob, unsigned int *rate) - { -@@ -138,24 +161,35 @@ saffirepro_both_clk_freq_set(struct snd_bebob *bebob, unsigned int rate) - - return saffire_write_quad(bebob, SAFFIREPRO_RATE_NOREBOOT, id); - } -+ -+/* -+ * query hardware for current clock source, return our internally -+ * used clock index in *id, depending on hardware. -+ */ - static int - saffirepro_both_clk_src_get(struct snd_bebob *bebob, unsigned int *id) - { - int err; -- u32 value; -+ u32 value; /* clock source read from hw register */ -+ const signed char *map; - - err = saffire_read_quad(bebob, SAFFIREPRO_OFFSET_CLOCK_SOURCE, &value); - if (err < 0) - goto end; - -- if (bebob->spec->clock->labels == saffirepro_10_clk_src_labels) { -- if (value == SAFFIREPRO_CLOCK_SOURCE_WORDCLOCK) -- *id = 2; -- else if (value == SAFFIREPRO_CLOCK_SOURCE_SPDIF) -- *id = 1; -- } else if (value > 1) { -- *id = value - 1; -+ /* depending on hardware, use a different mapping */ -+ if (bebob->spec->clock->labels == saffirepro_10_clk_src_labels) -+ map = saffirepro_clk_maps[0]; -+ else -+ map = saffirepro_clk_maps[1]; -+ -+ /* In a case that this driver cannot handle the value of register. */ -+ if (value >= SAFFIREPRO_CLOCK_SOURCE_COUNT || map[value] < 0) { -+ err = -EIO; -+ goto end; - } -+ -+ *id = (unsigned int)map[value]; - end: - return err; - } -diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c -index ef4d0c9..1aab0a32 100644 ---- a/sound/firewire/bebob/bebob_stream.c -+++ b/sound/firewire/bebob/bebob_stream.c -@@ -129,12 +129,24 @@ snd_bebob_stream_check_internal_clock(struct snd_bebob *bebob, bool *internal) - /* 1.The device has its own operation to switch source of clock */ - if (clk_spec) { - err = clk_spec->get(bebob, &id); -- if (err < 0) -+ if (err < 0) { - dev_err(&bebob->unit->device, - "fail to get clock source: %d\n", err); -- else if (strncmp(clk_spec->labels[id], SND_BEBOB_CLOCK_INTERNAL, -- strlen(SND_BEBOB_CLOCK_INTERNAL)) == 0) -+ goto end; -+ } -+ -+ if (id >= clk_spec->num) { -+ dev_err(&bebob->unit->device, -+ "clock source %d out of range 0..%d\n", -+ id, clk_spec->num - 1); -+ err = -EIO; -+ goto end; -+ } -+ -+ if (strncmp(clk_spec->labels[id], SND_BEBOB_CLOCK_INTERNAL, -+ strlen(SND_BEBOB_CLOCK_INTERNAL)) == 0) - *internal = true; -+ - goto end; - } - -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index aa302fb..0a7f848 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -373,6 +373,8 @@ static void __mark_pages_wc(struct azx *chip, struct snd_dma_buffer *dmab, bool - #ifdef CONFIG_SND_DMA_SGBUF - if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_SG) { - struct snd_sg_buf *sgbuf = dmab->private_data; -+ if (chip->driver_type == AZX_DRIVER_CMEDIA) -+ return; /* deal with only CORB/RIRB buffers */ - if (on) - set_pages_array_wc(sgbuf->page_table, sgbuf->pages); - else -@@ -1768,7 +1770,7 @@ static void pcm_mmap_prepare(struct snd_pcm_substream *substream, - #ifdef CONFIG_X86 - struct azx_pcm *apcm = snd_pcm_substream_chip(substream); - struct azx *chip = apcm->chip; -- if (!azx_snoop(chip)) -+ if (!azx_snoop(chip) && chip->driver_type != AZX_DRIVER_CMEDIA) - area->vm_page_prot = pgprot_writecombine(area->vm_page_prot); - #endif - } -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index b7b293c..0c9d588 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -5008,9 +5008,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x2224, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), - SND_PCI_QUIRK(0x103c, 0x2225, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), - SND_PCI_QUIRK(0x103c, 0x2246, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), -- SND_PCI_QUIRK(0x103c, 0x2247, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), -- SND_PCI_QUIRK(0x103c, 0x2248, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), -- SND_PCI_QUIRK(0x103c, 0x2249, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), - SND_PCI_QUIRK(0x103c, 0x2253, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), - SND_PCI_QUIRK(0x103c, 0x2254, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), - SND_PCI_QUIRK(0x103c, 0x2255, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), -diff --git a/sound/soc/codecs/adau1761.c b/sound/soc/codecs/adau1761.c -index 848cab8..2e9e90d 100644 ---- a/sound/soc/codecs/adau1761.c -+++ b/sound/soc/codecs/adau1761.c -@@ -405,6 +405,7 @@ static const struct snd_soc_dapm_widget adau1761_dapm_widgets[] = { - 2, 0, NULL, 0), - - SND_SOC_DAPM_SUPPLY("Slew Clock", ADAU1761_CLK_ENABLE0, 6, 0, NULL, 0), -+ SND_SOC_DAPM_SUPPLY("ALC Clock", ADAU1761_CLK_ENABLE0, 5, 0, NULL, 0), - - SND_SOC_DAPM_SUPPLY_S("Digital Clock 0", 1, ADAU1761_CLK_ENABLE1, - 0, 0, NULL, 0), -@@ -436,6 +437,9 @@ static const struct snd_soc_dapm_route adau1761_dapm_routes[] = { - { "Right Playback Mixer", NULL, "Slew Clock" }, - { "Left Playback Mixer", NULL, "Slew Clock" }, - -+ { "Left Input Mixer", NULL, "ALC Clock" }, -+ { "Right Input Mixer", NULL, "ALC Clock" }, -+ - { "Digital Clock 0", NULL, "SYSCLK" }, - { "Digital Clock 1", NULL, "SYSCLK" }, - }; -diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c -index 64f179e..5e8626a 100644 ---- a/sound/soc/codecs/tlv320aic3x.c -+++ b/sound/soc/codecs/tlv320aic3x.c -@@ -1121,6 +1121,7 @@ static int aic3x_regulator_event(struct notifier_block *nb, - static int aic3x_set_power(struct snd_soc_codec *codec, int power) - { - struct aic3x_priv *aic3x = snd_soc_codec_get_drvdata(codec); -+ unsigned int pll_c, pll_d; - int ret; - - if (power) { -@@ -1138,6 +1139,18 @@ static int aic3x_set_power(struct snd_soc_codec *codec, int power) - /* Sync reg_cache with the hardware */ - regcache_cache_only(aic3x->regmap, false); - regcache_sync(aic3x->regmap); -+ -+ /* Rewrite paired PLL D registers in case cached sync skipped -+ * writing one of them and thus caused other one also not -+ * being written -+ */ -+ pll_c = snd_soc_read(codec, AIC3X_PLL_PROGC_REG); -+ pll_d = snd_soc_read(codec, AIC3X_PLL_PROGD_REG); -+ if (pll_c == aic3x_reg[AIC3X_PLL_PROGC_REG].def || -+ pll_d == aic3x_reg[AIC3X_PLL_PROGD_REG].def) { -+ snd_soc_write(codec, AIC3X_PLL_PROGC_REG, pll_c); -+ snd_soc_write(codec, AIC3X_PLL_PROGD_REG, pll_d); -+ } - } else { - /* - * Do soft reset to this codec instance in order to clear -diff --git a/sound/soc/intel/sst-haswell-pcm.c b/sound/soc/intel/sst-haswell-pcm.c -index 61bf6da..e895732 100644 ---- a/sound/soc/intel/sst-haswell-pcm.c -+++ b/sound/soc/intel/sst-haswell-pcm.c -@@ -693,9 +693,7 @@ static int hsw_pcm_new(struct snd_soc_pcm_runtime *rtd) - } - - #define HSW_FORMATS \ -- (SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S24_LE | \ -- SNDRV_PCM_FMTBIT_S20_3LE | SNDRV_PCM_FMTBIT_S16_LE |\ -- SNDRV_PCM_FMTBIT_S8) -+ (SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE) - - static struct snd_soc_dai_driver hsw_dais[] = { - { -diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c -index d074aa9..a3e0a0d 100644 ---- a/sound/soc/soc-core.c -+++ b/sound/soc/soc-core.c -@@ -4315,10 +4315,10 @@ void snd_soc_remove_platform(struct snd_soc_platform *platform) - snd_soc_component_del_unlocked(&platform->component); - mutex_unlock(&client_mutex); - -- snd_soc_component_cleanup(&platform->component); -- - dev_dbg(platform->dev, "ASoC: Unregistered platform '%s'\n", - platform->component.name); -+ -+ snd_soc_component_cleanup(&platform->component); - } - EXPORT_SYMBOL_GPL(snd_soc_remove_platform); - -diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c -index 177bd86..7098e6b 100644 ---- a/sound/soc/soc-dapm.c -+++ b/sound/soc/soc-dapm.c -@@ -591,9 +591,9 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w, - int shared; - struct snd_kcontrol *kcontrol; - bool wname_in_long_name, kcname_in_long_name; -- char *long_name; -+ char *long_name = NULL; - const char *name; -- int ret; -+ int ret = 0; - - prefix = soc_dapm_prefix(dapm); - if (prefix) -@@ -652,15 +652,17 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w, - - kcontrol = snd_soc_cnew(&w->kcontrol_news[kci], NULL, name, - prefix); -- kfree(long_name); -- if (!kcontrol) -- return -ENOMEM; -+ if (!kcontrol) { -+ ret = -ENOMEM; -+ goto exit_free; -+ } -+ - kcontrol->private_free = dapm_kcontrol_free; - - ret = dapm_kcontrol_data_alloc(w, kcontrol); - if (ret) { - snd_ctl_free_one(kcontrol); -- return ret; -+ goto exit_free; - } - - ret = snd_ctl_add(card, kcontrol); -@@ -668,17 +670,18 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w, - dev_err(dapm->dev, - "ASoC: failed to add widget %s dapm kcontrol %s: %d\n", - w->name, name, ret); -- return ret; -+ goto exit_free; - } - } - - ret = dapm_kcontrol_add_widget(kcontrol, w); -- if (ret) -- return ret; -+ if (ret == 0) -+ w->kcontrols[kci] = kcontrol; - -- w->kcontrols[kci] = kcontrol; -+exit_free: -+ kfree(long_name); - -- return 0; -+ return ret; - } - - /* create new dapm mixer control */ -diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c -index 642c862..002311a 100644 ---- a/sound/soc/soc-pcm.c -+++ b/sound/soc/soc-pcm.c -@@ -352,7 +352,7 @@ static void soc_pcm_apply_msb(struct snd_pcm_substream *substream) - } else { - for (i = 0; i < rtd->num_codecs; i++) { - codec_dai = rtd->codec_dais[i]; -- if (codec_dai->driver->playback.sig_bits == 0) { -+ if (codec_dai->driver->capture.sig_bits == 0) { - bits = 0; - break; - } -diff --git a/sound/usb/card.c b/sound/usb/card.c -index 7ecd0e8..f61ebb1 100644 ---- a/sound/usb/card.c -+++ b/sound/usb/card.c -@@ -591,18 +591,19 @@ static void snd_usb_audio_disconnect(struct usb_device *dev, - { - struct snd_card *card; - struct list_head *p; -+ bool was_shutdown; - - if (chip == (void *)-1L) - return; - - card = chip->card; - down_write(&chip->shutdown_rwsem); -+ was_shutdown = chip->shutdown; - chip->shutdown = 1; - up_write(&chip->shutdown_rwsem); - - mutex_lock(®ister_mutex); -- chip->num_interfaces--; -- if (chip->num_interfaces <= 0) { -+ if (!was_shutdown) { - struct snd_usb_endpoint *ep; - - snd_card_disconnect(card); -@@ -622,6 +623,10 @@ static void snd_usb_audio_disconnect(struct usb_device *dev, - list_for_each(p, &chip->mixer_list) { - snd_usb_mixer_disconnect(p); - } -+ } -+ -+ chip->num_interfaces--; -+ if (chip->num_interfaces <= 0) { - usb_chip[chip->index] = NULL; - mutex_unlock(®ister_mutex); - snd_card_free_when_closed(card); -diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c -index 714b949..1f0dc1e 100644 ---- a/virt/kvm/iommu.c -+++ b/virt/kvm/iommu.c -@@ -43,13 +43,13 @@ static void kvm_iommu_put_pages(struct kvm *kvm, - gfn_t base_gfn, unsigned long npages); - - static pfn_t kvm_pin_pages(struct kvm_memory_slot *slot, gfn_t gfn, -- unsigned long size) -+ unsigned long npages) - { - gfn_t end_gfn; - pfn_t pfn; - - pfn = gfn_to_pfn_memslot(slot, gfn); -- end_gfn = gfn + (size >> PAGE_SHIFT); -+ end_gfn = gfn + npages; - gfn += 1; - - if (is_error_noslot_pfn(pfn)) -@@ -119,7 +119,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) - * Pin all pages we are about to map in memory. This is - * important because we unmap and unpin in 4kb steps later. - */ -- pfn = kvm_pin_pages(slot, gfn, page_size); -+ pfn = kvm_pin_pages(slot, gfn, page_size >> PAGE_SHIFT); - if (is_error_noslot_pfn(pfn)) { - gfn += 1; - continue; -@@ -131,7 +131,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) - if (r) { - printk(KERN_ERR "kvm_iommu_map_address:" - "iommu failed to map pfn=%llx\n", pfn); -- kvm_unpin_pages(kvm, pfn, page_size); -+ kvm_unpin_pages(kvm, pfn, page_size >> PAGE_SHIFT); - goto unmap_pages; - } - diff --git a/3.14.24/0000_README b/3.17.4/0000_README index 5926788..3efa937 100644 --- a/3.14.24/0000_README +++ b/3.17.4/0000_README @@ -2,11 +2,7 @@ README ----------------------------------------------------------------------------- Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 1023_linux-3.14.24.patch -From: http://www.kernel.org -Desc: Linux 3.14.24 - -Patch: 4420_grsecurity-3.0-3.14.24-201411150026.patch +Patch: 4420_grsecurity-3.0-3.17.4-201411220955.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.17.3/4420_grsecurity-3.0-3.17.3-201411150027.patch b/3.17.4/4420_grsecurity-3.0-3.17.4-201411220955.patch index d924e57..8d9a284 100644 --- a/3.17.3/4420_grsecurity-3.0-3.17.3-201411150027.patch +++ b/3.17.4/4420_grsecurity-3.0-3.17.4-201411220955.patch @@ -370,7 +370,7 @@ index 1edd5fd..107ff46 100644 pcd. [PARIDE] diff --git a/Makefile b/Makefile -index 57a45b1..62f9358 100644 +index b60b64d..33b7ec8 100644 --- a/Makefile +++ b/Makefile @@ -303,8 +303,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -3873,7 +3873,7 @@ index 2dea8b5..6499da2 100644 extern void ux500_cpu_die(unsigned int cpu); diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig -index ae69809..2665202 100644 +index 7eb94e6..799ad3e 100644 --- a/arch/arm/mm/Kconfig +++ b/arch/arm/mm/Kconfig @@ -446,6 +446,7 @@ config CPU_32v5 @@ -3892,15 +3892,16 @@ index ae69809..2665202 100644 help This option enables or disables the use of domain switching via the set_fs() function. -@@ -799,6 +801,7 @@ config NEED_KUSER_HELPERS +@@ -798,7 +800,7 @@ config NEED_KUSER_HELPERS + config KUSER_HELPERS bool "Enable kuser helpers in vector page" if !NEED_KUSER_HELPERS +- depends on MMU ++ depends on MMU && (!(CPU_V6 || CPU_V6K || CPU_V7) || GRKERNSEC_OLD_ARM_USERLAND) default y -+ depends on !(CPU_V6 || CPU_V6K || CPU_V7) || GRKERNSEC_OLD_ARM_USERLAND help Warning: disabling this option may break user programs. - -@@ -811,7 +814,7 @@ config KUSER_HELPERS +@@ -812,7 +814,7 @@ config KUSER_HELPERS See Documentation/arm/kernel_user_helpers.txt for details. However, the fixed address nature of these helpers can be used @@ -4944,19 +4945,6 @@ index 3bf8f4e..5dd5491 100644 #define access_ok(type, addr, size) __range_ok(addr, size) #define user_addr_max get_fs -diff --git a/arch/arm64/lib/clear_user.S b/arch/arm64/lib/clear_user.S -index 6e0ed93..c17967f 100644 ---- a/arch/arm64/lib/clear_user.S -+++ b/arch/arm64/lib/clear_user.S -@@ -46,7 +46,7 @@ USER(9f, strh wzr, [x0], #2 ) - sub x1, x1, #2 - 4: adds x1, x1, #1 - b.mi 5f -- strb wzr, [x0] -+USER(9f, strb wzr, [x0] ) - 5: mov x0, #0 - ret - ENDPROC(__clear_user) diff --git a/arch/avr32/include/asm/cache.h b/arch/avr32/include/asm/cache.h index c3a58a1..78fbf54 100644 --- a/arch/avr32/include/asm/cache.h @@ -5130,7 +5118,7 @@ index f6c3a16..cd422a4 100644 { int c, old; diff --git a/arch/frv/include/asm/cache.h b/arch/frv/include/asm/cache.h -index 2797163..c2a401d 100644 +index 2797163..c2a401df9 100644 --- a/arch/frv/include/asm/cache.h +++ b/arch/frv/include/asm/cache.h @@ -12,10 +12,11 @@ @@ -6989,7 +6977,7 @@ index 7de8658..c109224 100644 /* * We stash processor id into a COP0 register to retrieve it fast diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h -index a109510..94ee3f6 100644 +index a109510..0a764f7 100644 --- a/arch/mips/include/asm/uaccess.h +++ b/arch/mips/include/asm/uaccess.h @@ -130,6 +130,7 @@ extern u64 __ua_limit; @@ -7000,6 +6988,32 @@ index a109510..94ee3f6 100644 #define access_ok(type, addr, size) \ likely(__access_ok((addr), (size), __access_mask)) +@@ -301,7 +302,8 @@ do { \ + __get_kernel_common((x), size, __gu_ptr); \ + else \ + __get_user_common((x), size, __gu_ptr); \ +- } \ ++ } else \ ++ (x) = 0; \ + \ + __gu_err; \ + }) +@@ -316,6 +318,7 @@ do { \ + " .insn \n" \ + " .section .fixup,\"ax\" \n" \ + "3: li %0, %4 \n" \ ++ " move %1, $0 \n" \ + " j 2b \n" \ + " .previous \n" \ + " .section __ex_table,\"a\" \n" \ +@@ -630,6 +633,7 @@ do { \ + " .insn \n" \ + " .section .fixup,\"ax\" \n" \ + "3: li %0, %4 \n" \ ++ " move %1, $0 \n" \ + " j 2b \n" \ + " .previous \n" \ + " .section __ex_table,\"a\" \n" \ diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c index 1188e00..41cf144 100644 --- a/arch/mips/kernel/binfmt_elfn32.c @@ -11261,10 +11275,10 @@ index c13c9f2..d572c34 100644 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c -index c9300bf..b2080cf 100644 +index 81954ee..6cfaa98 100644 --- a/arch/sparc/kernel/smp_64.c +++ b/arch/sparc/kernel/smp_64.c -@@ -883,7 +883,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu) +@@ -887,7 +887,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu) return; #ifdef CONFIG_DEBUG_DCFLUSH @@ -11273,7 +11287,7 @@ index c9300bf..b2080cf 100644 #endif this_cpu = get_cpu(); -@@ -907,7 +907,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu) +@@ -911,7 +911,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu) xcall_deliver(data0, __pa(pg_addr), (u64) pg_addr, cpumask_of(cpu)); #ifdef CONFIG_DEBUG_DCFLUSH @@ -11282,7 +11296,7 @@ index c9300bf..b2080cf 100644 #endif } } -@@ -926,7 +926,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page) +@@ -930,7 +930,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page) preempt_disable(); #ifdef CONFIG_DEBUG_DCFLUSH @@ -11291,7 +11305,7 @@ index c9300bf..b2080cf 100644 #endif data0 = 0; pg_addr = page_address(page); -@@ -943,7 +943,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page) +@@ -947,7 +947,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page) xcall_deliver(data0, __pa(pg_addr), (u64) pg_addr, cpu_online_mask); #ifdef CONFIG_DEBUG_DCFLUSH @@ -13449,7 +13463,7 @@ index bd49ec6..94c7f58 100644 } diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile -index 0fcd913..3bb5c42 100644 +index 14fe7cb..829b962 100644 --- a/arch/x86/boot/compressed/Makefile +++ b/arch/x86/boot/compressed/Makefile @@ -16,6 +16,9 @@ KBUILD_CFLAGS += $(cflags-y) @@ -13505,7 +13519,7 @@ index a53440e..c3dbf1e 100644 .previous diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S -index cbed140..5f2ca57 100644 +index 1d7fbbc..36ecd58 100644 --- a/arch/x86/boot/compressed/head_32.S +++ b/arch/x86/boot/compressed/head_32.S @@ -140,10 +140,10 @@ preferred_addr: @@ -13522,7 +13536,7 @@ index cbed140..5f2ca57 100644 /* Target address to relocate to for decompression */ diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S -index 2884e0c..904a2f7 100644 +index 6b1766c..ad465c9 100644 --- a/arch/x86/boot/compressed/head_64.S +++ b/arch/x86/boot/compressed/head_64.S @@ -94,10 +94,10 @@ ENTRY(startup_32) @@ -13551,7 +13565,7 @@ index 2884e0c..904a2f7 100644 1: /* Target address to relocate to for decompression */ -@@ -431,8 +431,8 @@ gdt: +@@ -434,8 +434,8 @@ gdt: .long gdt .word 0 .quad 0x0000000000000000 /* NULL descriptor */ @@ -13563,7 +13577,7 @@ index 2884e0c..904a2f7 100644 .quad 0x0000000000000000 /* TS continued */ gdt_end: diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c -index 57ab74d..7c52182 100644 +index 30dd59a..cd9edc3 100644 --- a/arch/x86/boot/compressed/misc.c +++ b/arch/x86/boot/compressed/misc.c @@ -242,7 +242,7 @@ static void handle_relocations(void *output, unsigned long output_len) @@ -13602,7 +13616,7 @@ index 57ab74d..7c52182 100644 break; default: /* Ignore other PT_* */ break; } -@@ -395,7 +398,7 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap, +@@ -402,7 +405,7 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap, error("Destination address too large"); #endif #ifndef CONFIG_RELOCATABLE @@ -27427,7 +27441,7 @@ index ca5b02d..c0b2f6a 100644 ip = *(u64 *)(fp+8); if (!in_sched_functions(ip)) diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c -index 678c0ad..2fc2a7b 100644 +index b1a5dfa..ed94526 100644 --- a/arch/x86/kernel/ptrace.c +++ b/arch/x86/kernel/ptrace.c @@ -186,10 +186,10 @@ unsigned long kernel_stack_pointer(struct pt_regs *regs) @@ -27535,9 +27549,9 @@ index 678c0ad..2fc2a7b 100644 } void user_single_step_siginfo(struct task_struct *tsk, -@@ -1450,6 +1464,10 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, - # define IS_IA32 0 - #endif +@@ -1441,6 +1455,10 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, + force_sig_info(SIGTRAP, &info, tsk); + } +#ifdef CONFIG_GRKERNSEC_SETXID +extern void gr_delayed_cred_worker(void); @@ -27546,7 +27560,7 @@ index 678c0ad..2fc2a7b 100644 /* * We must return the syscall number to actually look up in the table. * This can be -1L to skip running any syscall at all. -@@ -1460,6 +1478,11 @@ long syscall_trace_enter(struct pt_regs *regs) +@@ -1451,6 +1469,11 @@ long syscall_trace_enter(struct pt_regs *regs) user_exit(); @@ -27558,7 +27572,7 @@ index 678c0ad..2fc2a7b 100644 /* * If we stepped into a sysenter/syscall insn, it trapped in * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP. -@@ -1515,6 +1538,11 @@ void syscall_trace_leave(struct pt_regs *regs) +@@ -1506,6 +1529,11 @@ void syscall_trace_leave(struct pt_regs *regs) */ user_exit(); @@ -29502,7 +29516,7 @@ index 41a5426..c0b3c00 100644 vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 9d292e8..cea125a 100644 +index d6aeccf..cea125a 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1857,8 +1857,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data) @@ -29525,15 +29539,6 @@ index 9d292e8..cea125a 100644 if (copy_to_user(user_msr_list->indices, &msrs_to_save, num_msrs_to_save * sizeof(u32))) goto out; -@@ -5002,7 +5004,7 @@ static int handle_emulation_failure(struct kvm_vcpu *vcpu) - - ++vcpu->stat.insn_emulation_fail; - trace_kvm_emulate_insn_failed(vcpu); -- if (!is_guest_mode(vcpu)) { -+ if (!is_guest_mode(vcpu) && kvm_x86_ops->get_cpl(vcpu) == 0) { - vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR; - vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION; - vcpu->run->internal.ndata = 0; @@ -5639,7 +5641,7 @@ static struct notifier_block pvclock_gtod_notifier = { }; #endif @@ -40089,10 +40094,10 @@ index b0c18ed..1713a80 100644 cpu_notifier_register_begin(); diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index c05821e..373651a 100644 +index 07c8276..38bd07c 100644 --- a/drivers/cpufreq/cpufreq.c +++ b/drivers/cpufreq/cpufreq.c -@@ -2106,7 +2106,7 @@ void cpufreq_unregister_governor(struct cpufreq_governor *governor) +@@ -2107,7 +2107,7 @@ void cpufreq_unregister_governor(struct cpufreq_governor *governor) } mutex_lock(&cpufreq_governor_mutex); @@ -40101,7 +40106,7 @@ index c05821e..373651a 100644 mutex_unlock(&cpufreq_governor_mutex); return; } -@@ -2322,7 +2322,7 @@ static int cpufreq_cpu_callback(struct notifier_block *nfb, +@@ -2323,7 +2323,7 @@ static int cpufreq_cpu_callback(struct notifier_block *nfb, return NOTIFY_OK; } @@ -40110,7 +40115,7 @@ index c05821e..373651a 100644 .notifier_call = cpufreq_cpu_callback, }; -@@ -2362,13 +2362,17 @@ int cpufreq_boost_trigger_state(int state) +@@ -2363,13 +2363,17 @@ int cpufreq_boost_trigger_state(int state) return 0; write_lock_irqsave(&cpufreq_driver_lock, flags); @@ -40130,7 +40135,7 @@ index c05821e..373651a 100644 write_unlock_irqrestore(&cpufreq_driver_lock, flags); pr_err("%s: Cannot %s BOOST\n", -@@ -2425,8 +2429,11 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) +@@ -2426,8 +2430,11 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) pr_debug("trying to register driver %s\n", driver_data->name); @@ -40144,7 +40149,7 @@ index c05821e..373651a 100644 write_lock_irqsave(&cpufreq_driver_lock, flags); if (cpufreq_driver) { -@@ -2441,8 +2448,11 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) +@@ -2442,8 +2449,11 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) * Check if driver provides function to enable boost - * if not, use cpufreq_boost_set_sw as default */ @@ -40801,20 +40806,6 @@ index 57ea7f4..af06b76 100644 card->driver->update_phy_reg(card, 4, PHY_LINK_ACTIVE | PHY_CONTENDER, 0); -diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c -index 5d997a3..2a3973a 100644 ---- a/drivers/firewire/core-cdev.c -+++ b/drivers/firewire/core-cdev.c -@@ -1637,8 +1637,7 @@ static int dispatch_ioctl(struct client *client, - _IOC_SIZE(cmd) > sizeof(buffer)) - return -ENOTTY; - -- if (_IOC_DIR(cmd) == _IOC_READ) -- memset(&buffer, 0, _IOC_SIZE(cmd)); -+ memset(&buffer, 0, sizeof(buffer)); - - if (_IOC_DIR(cmd) & _IOC_WRITE) - if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd))) diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c index 2c6d5e1..a2cca6b 100644 --- a/drivers/firewire/core-device.c @@ -41990,10 +41981,10 @@ index 4a85bb6..aaea819 100644 if (regcomp (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) { diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c -index 6684fbf..2e11bf0 100644 +index 5d4416f..80b7fc4 100644 --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c -@@ -1213,7 +1213,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev) +@@ -1214,7 +1214,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev) * locking inversion with the driver load path. And the access here is * completely racy anyway. So don't bother with locking for now. */ @@ -44997,7 +44988,7 @@ index 32b958d..34011e8 100644 void dm_uevent_add(struct mapped_device *md, struct list_head *elist) diff --git a/drivers/md/md.c b/drivers/md/md.c -index 1294238..a442227 100644 +index b7f603c..723d2bd 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -194,10 +194,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev); @@ -45069,7 +45060,7 @@ index 1294238..a442227 100644 INIT_LIST_HEAD(&rdev->same_set); init_waitqueue_head(&rdev->blocked_wait); -@@ -7068,7 +7068,7 @@ static int md_seq_show(struct seq_file *seq, void *v) +@@ -7072,7 +7072,7 @@ static int md_seq_show(struct seq_file *seq, void *v) spin_unlock(&pers_lock); seq_printf(seq, "\n"); @@ -45078,7 +45069,7 @@ index 1294238..a442227 100644 return 0; } if (v == (void*)2) { -@@ -7171,7 +7171,7 @@ static int md_seq_open(struct inode *inode, struct file *file) +@@ -7175,7 +7175,7 @@ static int md_seq_open(struct inode *inode, struct file *file) return error; seq = file->private_data; @@ -45087,7 +45078,7 @@ index 1294238..a442227 100644 return error; } -@@ -7188,7 +7188,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait) +@@ -7192,7 +7192,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait) /* always allow read */ mask = POLLIN | POLLRDNORM; @@ -45096,7 +45087,7 @@ index 1294238..a442227 100644 mask |= POLLERR | POLLPRI; return mask; } -@@ -7232,7 +7232,7 @@ static int is_mddev_idle(struct mddev *mddev, int init) +@@ -7236,7 +7236,7 @@ static int is_mddev_idle(struct mddev *mddev, int init) struct gendisk *disk = rdev->bdev->bd_contains->bd_disk; curr_events = (int)part_stat_read(&disk->part0, sectors[0]) + (int)part_stat_read(&disk->part0, sectors[1]) - @@ -46461,20 +46452,6 @@ index 6b0b8b6b..4038398 100644 return 1; } -diff --git a/drivers/media/usb/ttusb-dec/ttusbdecfe.c b/drivers/media/usb/ttusb-dec/ttusbdecfe.c -index 5c45c9d..9c29552 100644 ---- a/drivers/media/usb/ttusb-dec/ttusbdecfe.c -+++ b/drivers/media/usb/ttusb-dec/ttusbdecfe.c -@@ -156,6 +156,9 @@ static int ttusbdecfe_dvbs_diseqc_send_master_cmd(struct dvb_frontend* fe, struc - 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00 }; - -+ if (cmd->msg_len > sizeof(b) - 4) -+ return -EINVAL; -+ - memcpy(&b[4], cmd->msg, cmd->msg_len); - - state->config->send_command(fe, 0x72, diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c index cca6c2f..77b9a18 100644 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c @@ -48378,10 +48355,10 @@ index 8cffcdf..aadf043 100644 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb) diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -index fac3821..52c1a04 100644 +index 9f5f3c3..86d21a6 100644 --- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -@@ -2355,7 +2355,7 @@ static void get_regs(struct net_device *dev, struct ethtool_regs *regs, +@@ -2359,7 +2359,7 @@ static void get_regs(struct net_device *dev, struct ethtool_regs *regs, int i; struct adapter *ap = netdev2adap(dev); @@ -48728,10 +48705,10 @@ index 5f17ad0..e0463c8 100644 }; diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c -index 9b5481c..eb32d45 100644 +index 07c942b..2d8b073 100644 --- a/drivers/net/macvtap.c +++ b/drivers/net/macvtap.c -@@ -1021,7 +1021,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd, +@@ -1023,7 +1023,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd, } ret = 0; @@ -48740,7 +48717,7 @@ index 9b5481c..eb32d45 100644 put_user(q->flags, &ifr->ifr_flags)) ret = -EFAULT; macvtap_put_vlan(vlan); -@@ -1191,7 +1191,7 @@ static int macvtap_device_event(struct notifier_block *unused, +@@ -1193,7 +1193,7 @@ static int macvtap_device_event(struct notifier_block *unused, return NOTIFY_DONE; } @@ -48750,7 +48727,7 @@ index 9b5481c..eb32d45 100644 }; diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index 90c639b..bab8c01 100644 +index 17ecdd6..79ad848 100644 --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@ -1020,7 +1020,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) @@ -48771,6 +48748,21 @@ index 90c639b..bab8c01 100644 break; err = 0; break; +diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c +index 1aff970..cc2ee29 100644 +--- a/drivers/net/ppp/pptp.c ++++ b/drivers/net/ppp/pptp.c +@@ -506,7 +506,9 @@ static int pptp_getname(struct socket *sock, struct sockaddr *uaddr, + int len = sizeof(struct sockaddr_pppox); + struct sockaddr_pppox sp; + +- sp.sa_family = AF_PPPOX; ++ memset(&sp.sa_addr, 0, sizeof(sp.sa_addr)); ++ ++ sp.sa_family = AF_PPPOX; + sp.sa_protocol = PX_PROTO_PPTP; + sp.sa_addr.pptp = pppox_sk(sock->sk)->proto.pptp.src_addr; + diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index 079f7ad..b2a2bfa7 100644 --- a/drivers/net/slip/slhc.c @@ -48798,10 +48790,10 @@ index 1f76c2ea..9681171 100644 }; diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index 610d166..a3cc744 100644 +index d965e8a..f119e64 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c -@@ -1859,7 +1859,7 @@ unlock: +@@ -1861,7 +1861,7 @@ unlock: } static long __tun_chr_ioctl(struct file *file, unsigned int cmd, @@ -48810,7 +48802,7 @@ index 610d166..a3cc744 100644 { struct tun_file *tfile = file->private_data; struct tun_struct *tun; -@@ -1872,6 +1872,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd, +@@ -1874,6 +1874,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd, unsigned int ifindex; int ret; @@ -48960,108 +48952,10 @@ index 59caa06..de191b3 100644 #define VIRTNET_DRIVER_VERSION "1.0.0" diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index b483127..69aa8ff 100644 +index 81a8a29..ae60a58 100644 --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c -@@ -274,13 +274,15 @@ static inline struct vxlan_rdst *first_remote_rtnl(struct vxlan_fdb *fdb) - return list_first_entry(&fdb->remotes, struct vxlan_rdst, list); - } - --/* Find VXLAN socket based on network namespace and UDP port */ --static struct vxlan_sock *vxlan_find_sock(struct net *net, __be16 port) -+/* Find VXLAN socket based on network namespace, address family and UDP port */ -+static struct vxlan_sock *vxlan_find_sock(struct net *net, -+ sa_family_t family, __be16 port) - { - struct vxlan_sock *vs; - - hlist_for_each_entry_rcu(vs, vs_head(net, port), hlist) { -- if (inet_sk(vs->sock->sk)->inet_sport == port) -+ if (inet_sk(vs->sock->sk)->inet_sport == port && -+ inet_sk(vs->sock->sk)->sk.sk_family == family) - return vs; - } - return NULL; -@@ -299,11 +301,12 @@ static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs, u32 id) - } - - /* Look up VNI in a per net namespace table */ --static struct vxlan_dev *vxlan_find_vni(struct net *net, u32 id, __be16 port) -+static struct vxlan_dev *vxlan_find_vni(struct net *net, u32 id, -+ sa_family_t family, __be16 port) - { - struct vxlan_sock *vs; - -- vs = vxlan_find_sock(net, port); -+ vs = vxlan_find_sock(net, family, port); - if (!vs) - return NULL; - -@@ -1820,7 +1823,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, - struct vxlan_dev *dst_vxlan; - - ip_rt_put(rt); -- dst_vxlan = vxlan_find_vni(vxlan->net, vni, dst_port); -+ dst_vxlan = vxlan_find_vni(vxlan->net, vni, -+ dst->sa.sa_family, dst_port); - if (!dst_vxlan) - goto tx_error; - vxlan_encap_bypass(skb, vxlan, dst_vxlan); -@@ -1874,7 +1878,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, - struct vxlan_dev *dst_vxlan; - - dst_release(ndst); -- dst_vxlan = vxlan_find_vni(vxlan->net, vni, dst_port); -+ dst_vxlan = vxlan_find_vni(vxlan->net, vni, -+ dst->sa.sa_family, dst_port); - if (!dst_vxlan) - goto tx_error; - vxlan_encap_bypass(skb, vxlan, dst_vxlan); -@@ -2034,13 +2039,15 @@ static int vxlan_init(struct net_device *dev) - struct vxlan_dev *vxlan = netdev_priv(dev); - struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id); - struct vxlan_sock *vs; -+ bool ipv6 = vxlan->flags & VXLAN_F_IPV6; - - dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); - if (!dev->tstats) - return -ENOMEM; - - spin_lock(&vn->sock_lock); -- vs = vxlan_find_sock(vxlan->net, vxlan->dst_port); -+ vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET, -+ vxlan->dst_port); - if (vs) { - /* If we have a socket with same port already, reuse it */ - atomic_inc(&vs->refcnt); -@@ -2439,6 +2446,7 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port, - { - struct vxlan_net *vn = net_generic(net, vxlan_net_id); - struct vxlan_sock *vs; -+ bool ipv6 = flags & VXLAN_F_IPV6; - - vs = vxlan_socket_create(net, port, rcv, data, flags); - if (!IS_ERR(vs)) -@@ -2448,7 +2456,7 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port, - return vs; - - spin_lock(&vn->sock_lock); -- vs = vxlan_find_sock(net, port); -+ vs = vxlan_find_sock(net, ipv6 ? AF_INET6 : AF_INET, port); - if (vs) { - if (vs->rcv == rcv) - atomic_inc(&vs->refcnt); -@@ -2607,7 +2615,8 @@ static int vxlan_newlink(struct net *net, struct net_device *dev, - nla_get_u8(data[IFLA_VXLAN_UDP_ZERO_CSUM6_RX])) - vxlan->flags |= VXLAN_F_UDP_ZERO_CSUM6_RX; - -- if (vxlan_find_vni(net, vni, vxlan->dst_port)) { -+ if (vxlan_find_vni(net, vni, use_ipv6 ? AF_INET6 : AF_INET, -+ vxlan->dst_port)) { - pr_info("duplicate VNI %u\n", vni); - return -EEXIST; - } -@@ -2751,7 +2760,7 @@ nla_put_failure: +@@ -2762,7 +2762,7 @@ nla_put_failure: return -EMSGSIZE; } @@ -49070,7 +48964,7 @@ index b483127..69aa8ff 100644 .kind = "vxlan", .maxtype = IFLA_VXLAN_MAX, .policy = vxlan_policy, -@@ -2798,7 +2807,7 @@ static int vxlan_lowerdev_event(struct notifier_block *unused, +@@ -2809,7 +2809,7 @@ static int vxlan_lowerdev_event(struct notifier_block *unused, return NOTIFY_DONE; } @@ -49774,7 +49668,7 @@ index 0ffb6ff..c0b7f0e 100644 memset(buf, 0, sizeof(buf)); buf_size = min(count, sizeof(buf) - 1); diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c -index d7231a8..80df8ba 100644 +index 6c02467..771bb8a 100644 --- a/drivers/net/wireless/iwlwifi/pcie/trans.c +++ b/drivers/net/wireless/iwlwifi/pcie/trans.c @@ -1686,7 +1686,7 @@ static ssize_t iwl_dbgfs_interrupt_write(struct file *file, @@ -49796,10 +49690,10 @@ index d7231a8..80df8ba 100644 memset(buf, 0, sizeof(buf)); diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index 1326f61..9e56010f 100644 +index 6b48c865..19646a7 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -2575,20 +2575,20 @@ static int __init init_mac80211_hwsim(void) +@@ -2577,20 +2577,20 @@ static int __init init_mac80211_hwsim(void) if (channels < 1) return -EINVAL; @@ -64826,7 +64720,7 @@ index f4ccfe6..a5cf064 100644 static struct callback_op callback_ops[]; diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c -index 577a36f..1cde799 100644 +index 0689aa5..299386e 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -1228,16 +1228,16 @@ static int nfs_size_need_update(const struct inode *inode, const struct nfs_fatt @@ -80383,19 +80277,6 @@ index 411dd7e..ee38878 100644 /** * struct clk_init_data - holds init data that's common to all clocks and is -diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h -index 653f0e2..abcafaa 100644 ---- a/include/linux/clocksource.h -+++ b/include/linux/clocksource.h -@@ -287,7 +287,7 @@ extern struct clocksource* clocksource_get_next(void); - extern void clocksource_change_rating(struct clocksource *cs, int rating); - extern void clocksource_suspend(void); - extern void clocksource_resume(void); --extern struct clocksource * __init __weak clocksource_default_clock(void); -+extern struct clocksource * __init clocksource_default_clock(void); - extern void clocksource_mark_unstable(struct clocksource *cs); - - extern u64 diff --git a/include/linux/compat.h b/include/linux/compat.h index e649426..a74047b 100644 --- a/include/linux/compat.h @@ -80730,32 +80611,6 @@ index 2997af6..424ddc1 100644 int cpumask_any_but(const struct cpumask *mask, unsigned int cpu); int cpumask_set_cpu_local_first(int i, int numa_node, cpumask_t *dstp); -diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h -index 72ab536..3849fce 100644 ---- a/include/linux/crash_dump.h -+++ b/include/linux/crash_dump.h -@@ -14,14 +14,13 @@ - extern unsigned long long elfcorehdr_addr; - extern unsigned long long elfcorehdr_size; - --extern int __weak elfcorehdr_alloc(unsigned long long *addr, -- unsigned long long *size); --extern void __weak elfcorehdr_free(unsigned long long addr); --extern ssize_t __weak elfcorehdr_read(char *buf, size_t count, u64 *ppos); --extern ssize_t __weak elfcorehdr_read_notes(char *buf, size_t count, u64 *ppos); --extern int __weak remap_oldmem_pfn_range(struct vm_area_struct *vma, -- unsigned long from, unsigned long pfn, -- unsigned long size, pgprot_t prot); -+extern int elfcorehdr_alloc(unsigned long long *addr, unsigned long long *size); -+extern void elfcorehdr_free(unsigned long long addr); -+extern ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos); -+extern ssize_t elfcorehdr_read_notes(char *buf, size_t count, u64 *ppos); -+extern int remap_oldmem_pfn_range(struct vm_area_struct *vma, -+ unsigned long from, unsigned long pfn, -+ unsigned long size, pgprot_t prot); - - extern ssize_t copy_oldmem_page(unsigned long, char *, size_t, - unsigned long, int); diff --git a/include/linux/cred.h b/include/linux/cred.h index b2d0820..2ecafd3 100644 --- a/include/linux/cred.h @@ -83036,7 +82891,7 @@ index 44792ee..6172f2a 100644 extern struct key_type key_type_keyring; diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h -index 6b06d37..19f605f 100644 +index e465bb1..19f605f 100644 --- a/include/linux/kgdb.h +++ b/include/linux/kgdb.h @@ -52,7 +52,7 @@ extern int kgdb_connected; @@ -83057,7 +82912,7 @@ index 6b06d37..19f605f 100644 /** * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB. -@@ -279,11 +279,11 @@ struct kgdb_io { +@@ -279,7 +279,7 @@ struct kgdb_io { void (*pre_exception) (void); void (*post_exception) (void); int is_console; @@ -83066,11 +82921,6 @@ index 6b06d37..19f605f 100644 extern struct kgdb_arch arch_kgdb_ops; --extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs); -+extern unsigned long kgdb_arch_pc(int exception, struct pt_regs *regs); - - #ifdef CONFIG_SERIAL_KGDB_NMI - extern int kgdb_register_nmi_console(void); diff --git a/include/linux/kmod.h b/include/linux/kmod.h index 0555cc6..40116ce 100644 --- a/include/linux/kmod.h @@ -83320,19 +83170,6 @@ index c45c089..298841c 100644 { u32 remainder; return div_u64_rem(dividend, divisor, &remainder); -diff --git a/include/linux/memory.h b/include/linux/memory.h -index bb7384e..8b8d8d1 100644 ---- a/include/linux/memory.h -+++ b/include/linux/memory.h -@@ -35,7 +35,7 @@ struct memory_block { - }; - - int arch_get_memory_phys_device(unsigned long start_pfn); --unsigned long __weak memory_block_size_bytes(void); -+unsigned long memory_block_size_bytes(void); - - /* These states are exposed to userspace as text strings in sysfs */ - #define MEM_ONLINE (1<<0) /* exposed to userspace */ diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h index f230a97..714c006 100644 --- a/include/linux/mempolicy.h @@ -83689,10 +83526,10 @@ index c5d5278..f0b68c8 100644 } diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index 318df70..b74ec01 100644 +index b21bac4..94142ca 100644 --- a/include/linux/mmzone.h +++ b/include/linux/mmzone.h -@@ -518,7 +518,7 @@ struct zone { +@@ -527,7 +527,7 @@ struct zone { ZONE_PADDING(_pad3_) /* Zone statistics */ @@ -86806,24 +86643,8 @@ index 4a5b9a3..ca27d73 100644 .update = sctp_csum_update, .combine = sctp_csum_combine, }; -diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h -index 9fbd856..856f01c 100644 ---- a/include/net/sctp/sctp.h -+++ b/include/net/sctp/sctp.h -@@ -426,6 +426,11 @@ static inline void sctp_assoc_pending_pmtu(struct sock *sk, struct sctp_associat - asoc->pmtu_pending = 0; - } - -+static inline bool sctp_chunk_pending(const struct sctp_chunk *chunk) -+{ -+ return !list_empty(&chunk->list); -+} -+ - /* Walk through a list of TLV parameters. Don't trust the - * individual parameter lengths and instead depend on - * the chunk length to indicate when to stop. Make sure diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h -index 7f4eeb3..aaa63d9 100644 +index 72a31db..aaa63d9 100644 --- a/include/net/sctp/sm.h +++ b/include/net/sctp/sm.h @@ -80,7 +80,7 @@ typedef void (sctp_timer_event_t) (unsigned long); @@ -86835,19 +86656,6 @@ index 7f4eeb3..aaa63d9 100644 /* A naming convention of "sctp_sf_xxx" applies to all the state functions * currently in use. -@@ -248,9 +248,9 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *, - int, __be16); - struct sctp_chunk *sctp_make_asconf_set_prim(struct sctp_association *asoc, - union sctp_addr *addr); --int sctp_verify_asconf(const struct sctp_association *asoc, -- struct sctp_paramhdr *param_hdr, void *chunk_end, -- struct sctp_paramhdr **errp); -+bool sctp_verify_asconf(const struct sctp_association *asoc, -+ struct sctp_chunk *chunk, bool addr_param_needed, -+ struct sctp_paramhdr **errp); - struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, - struct sctp_chunk *asconf); - int sctp_process_asconf_ack(struct sctp_association *asoc, @@ -292,7 +292,7 @@ __u32 sctp_generate_tag(const struct sctp_endpoint *); __u32 sctp_generate_tsn(const struct sctp_endpoint *); @@ -87891,7 +87699,7 @@ index bece48c..e911bd8 100644 next_state = Reset; return 0; diff --git a/init/main.c b/init/main.c -index bb1aed9..64f9745 100644 +index d0f4b59..0c4b184 100644 --- a/init/main.c +++ b/init/main.c @@ -98,6 +98,8 @@ extern void radix_tree_init(void); @@ -88092,7 +87900,7 @@ index b5ef4f7..ff31d87 100644 case SHMDT: return sys_shmdt(compat_ptr(ptr)); diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c -index c3f0326..d4e0579 100644 +index e8075b2..76f2c6a 100644 --- a/ipc/ipc_sysctl.c +++ b/ipc/ipc_sysctl.c @@ -30,7 +30,7 @@ static void *get_ipc(struct ctl_table *table) @@ -88137,9 +87945,9 @@ index c3f0326..d4e0579 100644 { - struct ctl_table ipc_table; + ctl_table_no_const ipc_table; - size_t lenp_bef = *lenp; int oldval; int rc; + diff --git a/ipc/mq_sysctl.c b/ipc/mq_sysctl.c index 68d4e95..1477ded 100644 --- a/ipc/mq_sysctl.c @@ -88267,7 +88075,7 @@ index 27d74e6..8be0be2 100644 if ((requested_mode & ~granted_mode & 0007) && !ns_capable(ns->user_ns, CAP_IPC_OWNER)) diff --git a/kernel/audit.c b/kernel/audit.c -index ba2ff5a..c6c0deb 100644 +index 6726aa6..bb864a9 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -122,7 +122,7 @@ u32 audit_sig_sid = 0; @@ -91960,7 +91768,7 @@ index 858c565..7efd915 100644 static void check_cpu_stalls(void) diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c -index 1b70cb6..ea62b0a 100644 +index 89a404a..f42a019 100644 --- a/kernel/rcu/tree.c +++ b/kernel/rcu/tree.c @@ -263,7 +263,7 @@ static void rcu_momentary_dyntick_idle(void) @@ -92193,7 +92001,7 @@ index 1b70cb6..ea62b0a 100644 - ACCESS_ONCE(rsp->gp_flags) |= RCU_GP_FLAG_FQS; + ACCESS_ONCE_RW(rsp->gp_flags) |= RCU_GP_FLAG_FQS; raw_spin_unlock_irqrestore(&rnp_old->lock, flags); - wake_up(&rsp->gp_wq); /* Memory barrier implied by wake_up() path. */ + rcu_gp_kthread_wake(rsp); } @@ -2550,7 +2550,7 @@ __rcu_process_callbacks(struct rcu_state *rsp) /* @@ -94062,7 +93870,7 @@ index 5916a8e..5cd3b1f 100644 start_pg = ftrace_allocate_pages(count); if (!start_pg) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 2d75c94..5ef6d32 100644 +index a56e07c..d46f0ba 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -352,9 +352,9 @@ struct buffer_data_page { @@ -94088,7 +93896,7 @@ index 2d75c94..5ef6d32 100644 local_t dropped_events; local_t committing; local_t commits; -@@ -1005,8 +1005,8 @@ static int rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer, +@@ -1032,8 +1032,8 @@ static int rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer, * * We add a counter to the write field to denote this. */ @@ -94099,7 +93907,7 @@ index 2d75c94..5ef6d32 100644 /* * Just make sure we have seen our old_write and synchronize -@@ -1034,8 +1034,8 @@ static int rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer, +@@ -1061,8 +1061,8 @@ static int rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer, * cmpxchg to only update if an interrupt did not already * do it for us. If the cmpxchg fails, we don't care. */ @@ -94110,7 +93918,7 @@ index 2d75c94..5ef6d32 100644 /* * No need to worry about races with clearing out the commit. -@@ -1402,12 +1402,12 @@ static void rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer); +@@ -1429,12 +1429,12 @@ static void rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer); static inline unsigned long rb_page_entries(struct buffer_page *bpage) { @@ -94125,7 +93933,7 @@ index 2d75c94..5ef6d32 100644 } static int -@@ -1502,7 +1502,7 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned int nr_pages) +@@ -1529,7 +1529,7 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned int nr_pages) * bytes consumed in ring buffer from here. * Increment overrun to account for the lost events. */ @@ -94134,7 +93942,7 @@ index 2d75c94..5ef6d32 100644 local_sub(BUF_PAGE_SIZE, &cpu_buffer->entries_bytes); } -@@ -2064,7 +2064,7 @@ rb_handle_head_page(struct ring_buffer_per_cpu *cpu_buffer, +@@ -2091,7 +2091,7 @@ rb_handle_head_page(struct ring_buffer_per_cpu *cpu_buffer, * it is our responsibility to update * the counters. */ @@ -94143,7 +93951,7 @@ index 2d75c94..5ef6d32 100644 local_sub(BUF_PAGE_SIZE, &cpu_buffer->entries_bytes); /* -@@ -2214,7 +2214,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer, +@@ -2241,7 +2241,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer, if (tail == BUF_PAGE_SIZE) tail_page->real_end = 0; @@ -94152,7 +93960,7 @@ index 2d75c94..5ef6d32 100644 return; } -@@ -2249,7 +2249,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer, +@@ -2276,7 +2276,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer, rb_event_set_padding(event); /* Set the write back to the previous setting */ @@ -94161,7 +93969,7 @@ index 2d75c94..5ef6d32 100644 return; } -@@ -2261,7 +2261,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer, +@@ -2288,7 +2288,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer, /* Set write to end of buffer */ length = (tail + length) - BUF_PAGE_SIZE; @@ -94170,7 +93978,7 @@ index 2d75c94..5ef6d32 100644 } /* -@@ -2287,7 +2287,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer, +@@ -2314,7 +2314,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer, * about it. */ if (unlikely(next_page == commit_page)) { @@ -94179,7 +93987,7 @@ index 2d75c94..5ef6d32 100644 goto out_reset; } -@@ -2343,7 +2343,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer, +@@ -2370,7 +2370,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer, cpu_buffer->tail_page) && (cpu_buffer->commit_page == cpu_buffer->reader_page))) { @@ -94188,7 +93996,7 @@ index 2d75c94..5ef6d32 100644 goto out_reset; } } -@@ -2391,7 +2391,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer, +@@ -2418,7 +2418,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer, length += RB_LEN_TIME_EXTEND; tail_page = cpu_buffer->tail_page; @@ -94197,7 +94005,7 @@ index 2d75c94..5ef6d32 100644 /* set write to only the index of the write */ write &= RB_WRITE_MASK; -@@ -2415,7 +2415,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer, +@@ -2442,7 +2442,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer, kmemcheck_annotate_bitfield(event, bitfield); rb_update_event(cpu_buffer, event, length, add_timestamp, delta); @@ -94206,7 +94014,7 @@ index 2d75c94..5ef6d32 100644 /* * If this is the first commit on the page, then update -@@ -2448,7 +2448,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, +@@ -2475,7 +2475,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, if (bpage->page == (void *)addr && rb_page_write(bpage) == old_index) { unsigned long write_mask = @@ -94215,7 +94023,7 @@ index 2d75c94..5ef6d32 100644 unsigned long event_length = rb_event_length(event); /* * This is on the tail page. It is possible that -@@ -2458,7 +2458,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, +@@ -2485,7 +2485,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, */ old_index += write_mask; new_index += write_mask; @@ -94224,7 +94032,7 @@ index 2d75c94..5ef6d32 100644 if (index == old_index) { /* update counters */ local_sub(event_length, &cpu_buffer->entries_bytes); -@@ -2850,7 +2850,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer, +@@ -2877,7 +2877,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer, /* Do the likely case first */ if (likely(bpage->page == (void *)addr)) { @@ -94233,7 +94041,7 @@ index 2d75c94..5ef6d32 100644 return; } -@@ -2862,7 +2862,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer, +@@ -2889,7 +2889,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer, start = bpage; do { if (bpage->page == (void *)addr) { @@ -94242,7 +94050,7 @@ index 2d75c94..5ef6d32 100644 return; } rb_inc_page(cpu_buffer, &bpage); -@@ -3146,7 +3146,7 @@ static inline unsigned long +@@ -3173,7 +3173,7 @@ static inline unsigned long rb_num_of_entries(struct ring_buffer_per_cpu *cpu_buffer) { return local_read(&cpu_buffer->entries) - @@ -94251,7 +94059,7 @@ index 2d75c94..5ef6d32 100644 } /** -@@ -3235,7 +3235,7 @@ unsigned long ring_buffer_overrun_cpu(struct ring_buffer *buffer, int cpu) +@@ -3262,7 +3262,7 @@ unsigned long ring_buffer_overrun_cpu(struct ring_buffer *buffer, int cpu) return 0; cpu_buffer = buffer->buffers[cpu]; @@ -94260,7 +94068,7 @@ index 2d75c94..5ef6d32 100644 return ret; } -@@ -3258,7 +3258,7 @@ ring_buffer_commit_overrun_cpu(struct ring_buffer *buffer, int cpu) +@@ -3285,7 +3285,7 @@ ring_buffer_commit_overrun_cpu(struct ring_buffer *buffer, int cpu) return 0; cpu_buffer = buffer->buffers[cpu]; @@ -94269,7 +94077,7 @@ index 2d75c94..5ef6d32 100644 return ret; } -@@ -3343,7 +3343,7 @@ unsigned long ring_buffer_overruns(struct ring_buffer *buffer) +@@ -3370,7 +3370,7 @@ unsigned long ring_buffer_overruns(struct ring_buffer *buffer) /* if you care about this being correct, lock the buffer */ for_each_buffer_cpu(buffer, cpu) { cpu_buffer = buffer->buffers[cpu]; @@ -94278,7 +94086,7 @@ index 2d75c94..5ef6d32 100644 } return overruns; -@@ -3514,8 +3514,8 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer) +@@ -3541,8 +3541,8 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer) /* * Reset the reader page to size zero. */ @@ -94289,7 +94097,7 @@ index 2d75c94..5ef6d32 100644 local_set(&cpu_buffer->reader_page->page->commit, 0); cpu_buffer->reader_page->real_end = 0; -@@ -3549,7 +3549,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer) +@@ -3576,7 +3576,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer) * want to compare with the last_overrun. */ smp_mb(); @@ -94298,7 +94106,7 @@ index 2d75c94..5ef6d32 100644 /* * Here's the tricky part. -@@ -4121,8 +4121,8 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer) +@@ -4148,8 +4148,8 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer) cpu_buffer->head_page = list_entry(cpu_buffer->pages, struct buffer_page, list); @@ -94309,7 +94117,7 @@ index 2d75c94..5ef6d32 100644 local_set(&cpu_buffer->head_page->page->commit, 0); cpu_buffer->head_page->read = 0; -@@ -4132,14 +4132,14 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer) +@@ -4159,14 +4159,14 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer) INIT_LIST_HEAD(&cpu_buffer->reader_page->list); INIT_LIST_HEAD(&cpu_buffer->new_pages); @@ -94328,7 +94136,7 @@ index 2d75c94..5ef6d32 100644 local_set(&cpu_buffer->dropped_events, 0); local_set(&cpu_buffer->entries, 0); local_set(&cpu_buffer->committing, 0); -@@ -4544,8 +4544,8 @@ int ring_buffer_read_page(struct ring_buffer *buffer, +@@ -4571,8 +4571,8 @@ int ring_buffer_read_page(struct ring_buffer *buffer, rb_init_page(bpage); bpage = reader->page; reader->page = *data_page; @@ -94340,10 +94148,10 @@ index 2d75c94..5ef6d32 100644 *data_page = bpage; diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 8a52839..dd6d7c8 100644 +index 1520933..c651ebc 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c -@@ -3487,7 +3487,7 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set) +@@ -3488,7 +3488,7 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set) return 0; } @@ -95770,18 +95578,18 @@ index eeceeeb..a209d58 100644 if (!ptep) return VM_FAULT_OOM; diff --git a/mm/internal.h b/mm/internal.h -index a1b651b..f688570 100644 +index 5f2772f..4c3882c 100644 --- a/mm/internal.h +++ b/mm/internal.h -@@ -109,6 +109,7 @@ extern pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address); - * in mm/page_alloc.c - */ +@@ -134,6 +134,7 @@ __find_buddy_index(unsigned long page_idx, unsigned int order) + + extern int __isolate_free_page(struct page *page, unsigned int order); extern void __free_pages_bootmem(struct page *page, unsigned int order); +extern void free_compound_page(struct page *page); extern void prep_compound_page(struct page *page, unsigned long order); #ifdef CONFIG_MEMORY_FAILURE extern bool is_free_buddy_page(struct page *page); -@@ -351,7 +352,7 @@ extern u32 hwpoison_filter_enable; +@@ -376,7 +377,7 @@ extern u32 hwpoison_filter_enable; extern unsigned long vm_mmap_pgoff(struct file *, unsigned long, unsigned long, unsigned long, @@ -95791,7 +95599,7 @@ index a1b651b..f688570 100644 extern void set_pageblock_order(void); unsigned long reclaim_clean_pages_from_list(struct zone *zone, diff --git a/mm/iov_iter.c b/mm/iov_iter.c -index 9a09f20..6ef0515 100644 +index 141dcf7..7327fd3 100644 --- a/mm/iov_iter.c +++ b/mm/iov_iter.c @@ -173,7 +173,7 @@ static size_t __iovec_copy_from_user_inatomic(char *vaddr, @@ -96899,7 +96707,7 @@ index ce84cb0..6d5a9aa 100644 capable(CAP_IPC_LOCK)) ret = do_mlockall(flags); diff --git a/mm/mmap.c b/mm/mmap.c -index c0a3637..c760814 100644 +index ebc25fa..0ef0db0 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -41,6 +41,7 @@ @@ -97074,7 +96882,7 @@ index c0a3637..c760814 100644 + } if (err) return NULL; - khugepaged_enter_vma_merge(prev); + khugepaged_enter_vma_merge(prev, vm_flags); @@ -1067,12 +1138,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm, mpol_equal(policy, vma_policy(next)) && can_vma_merge_before(next, vm_flags, @@ -97104,7 +96912,7 @@ index c0a3637..c760814 100644 + } if (err) return NULL; - khugepaged_enter_vma_merge(area); + khugepaged_enter_vma_merge(area, vm_flags); @@ -1181,8 +1267,10 @@ none: void vm_stat_account(struct mm_struct *mm, unsigned long flags, struct file *file, long pages) @@ -97637,7 +97445,7 @@ index c0a3637..c760814 100644 + if (locknext) + vma_unlock_anon_vma(vma->vm_next); vma_unlock_anon_vma(vma); - khugepaged_enter_vma_merge(vma); + khugepaged_enter_vma_merge(vma, vma->vm_flags); validate_mm(vma->vm_mm); @@ -2205,6 +2525,8 @@ int expand_downwards(struct vm_area_struct *vma, unsigned long address) @@ -97708,7 +97516,7 @@ index c0a3637..c760814 100644 vma_unlock_anon_vma(vma); + if (lockprev) + vma_unlock_anon_vma(prev); - khugepaged_enter_vma_merge(vma); + khugepaged_enter_vma_merge(vma, vma->vm_flags); validate_mm(vma->vm_mm); return error; @@ -2358,6 +2711,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma) @@ -98570,7 +98378,7 @@ index ba5fd97..5a95869 100644 unsigned long bg_thresh, unsigned long dirty, diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 8c5029f..d6907f0 100644 +index c5fe124..2cf7f17 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -61,6 +61,7 @@ @@ -98590,7 +98398,7 @@ index 8c5029f..d6907f0 100644 { __free_pages_ok(page, compound_order(page)); } -@@ -751,6 +752,10 @@ static bool free_pages_prepare(struct page *page, unsigned int order) +@@ -740,6 +741,10 @@ static bool free_pages_prepare(struct page *page, unsigned int order) int i; int bad = 0; @@ -98601,7 +98409,7 @@ index 8c5029f..d6907f0 100644 trace_mm_page_free(page, order); kmemcheck_free_shadow(page, order); -@@ -767,6 +772,12 @@ static bool free_pages_prepare(struct page *page, unsigned int order) +@@ -756,6 +761,12 @@ static bool free_pages_prepare(struct page *page, unsigned int order) debug_check_no_obj_freed(page_address(page), PAGE_SIZE << order); } @@ -98614,7 +98422,7 @@ index 8c5029f..d6907f0 100644 arch_free_page(page, order); kernel_map_pages(page, 1 << order, 0); -@@ -790,6 +801,20 @@ static void __free_pages_ok(struct page *page, unsigned int order) +@@ -779,6 +790,20 @@ static void __free_pages_ok(struct page *page, unsigned int order) local_irq_restore(flags); } @@ -98635,7 +98443,7 @@ index 8c5029f..d6907f0 100644 void __init __free_pages_bootmem(struct page *page, unsigned int order) { unsigned int nr_pages = 1 << order; -@@ -805,6 +830,19 @@ void __init __free_pages_bootmem(struct page *page, unsigned int order) +@@ -794,6 +819,19 @@ void __init __free_pages_bootmem(struct page *page, unsigned int order) __ClearPageReserved(p); set_page_count(p, 0); @@ -98655,7 +98463,7 @@ index 8c5029f..d6907f0 100644 page_zone(page)->managed_pages += nr_pages; set_page_refcounted(page); __free_pages(page, order); -@@ -933,8 +971,10 @@ static int prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags) +@@ -922,8 +960,10 @@ static int prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags) arch_alloc_page(page, order); kernel_map_pages(page, 1 << order, 1); @@ -98666,7 +98474,7 @@ index 8c5029f..d6907f0 100644 if (order && (gfp_flags & __GFP_COMP)) prep_compound_page(page, order); -@@ -1612,7 +1652,7 @@ again: +@@ -1601,7 +1641,7 @@ again: } __mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order)); @@ -98675,7 +98483,7 @@ index 8c5029f..d6907f0 100644 !zone_is_fair_depleted(zone)) zone_set_flag(zone, ZONE_FAIR_DEPLETED); -@@ -1933,7 +1973,7 @@ static void reset_alloc_batches(struct zone *preferred_zone) +@@ -1922,7 +1962,7 @@ static void reset_alloc_batches(struct zone *preferred_zone) do { mod_zone_page_state(zone, NR_ALLOC_BATCH, high_wmark_pages(zone) - low_wmark_pages(zone) - @@ -98684,7 +98492,7 @@ index 8c5029f..d6907f0 100644 zone_clear_flag(zone, ZONE_FAIR_DEPLETED); } while (zone++ != preferred_zone); } -@@ -5710,7 +5750,7 @@ static void __setup_per_zone_wmarks(void) +@@ -5699,7 +5739,7 @@ static void __setup_per_zone_wmarks(void) __mod_zone_page_state(zone, NR_ALLOC_BATCH, high_wmark_pages(zone) - low_wmark_pages(zone) - @@ -101172,323 +100980,6 @@ index 1a19b98..df2b4ec 100644 if (!can_dir) { printk(KERN_INFO "can: failed to create /proc/net/can . " -diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c -index ffeba8f..c0d666a 100644 ---- a/net/ceph/crypto.c -+++ b/net/ceph/crypto.c -@@ -90,11 +90,82 @@ static struct crypto_blkcipher *ceph_crypto_alloc_cipher(void) - - static const u8 *aes_iv = (u8 *)CEPH_AES_IV; - -+/* -+ * Should be used for buffers allocated with ceph_kvmalloc(). -+ * Currently these are encrypt out-buffer (ceph_buffer) and decrypt -+ * in-buffer (msg front). -+ * -+ * Dispose of @sgt with teardown_sgtable(). -+ * -+ * @prealloc_sg is to avoid memory allocation inside sg_alloc_table() -+ * in cases where a single sg is sufficient. No attempt to reduce the -+ * number of sgs by squeezing physically contiguous pages together is -+ * made though, for simplicity. -+ */ -+static int setup_sgtable(struct sg_table *sgt, struct scatterlist *prealloc_sg, -+ const void *buf, unsigned int buf_len) -+{ -+ struct scatterlist *sg; -+ const bool is_vmalloc = is_vmalloc_addr(buf); -+ unsigned int off = offset_in_page(buf); -+ unsigned int chunk_cnt = 1; -+ unsigned int chunk_len = PAGE_ALIGN(off + buf_len); -+ int i; -+ int ret; -+ -+ if (buf_len == 0) { -+ memset(sgt, 0, sizeof(*sgt)); -+ return -EINVAL; -+ } -+ -+ if (is_vmalloc) { -+ chunk_cnt = chunk_len >> PAGE_SHIFT; -+ chunk_len = PAGE_SIZE; -+ } -+ -+ if (chunk_cnt > 1) { -+ ret = sg_alloc_table(sgt, chunk_cnt, GFP_NOFS); -+ if (ret) -+ return ret; -+ } else { -+ WARN_ON(chunk_cnt != 1); -+ sg_init_table(prealloc_sg, 1); -+ sgt->sgl = prealloc_sg; -+ sgt->nents = sgt->orig_nents = 1; -+ } -+ -+ for_each_sg(sgt->sgl, sg, sgt->orig_nents, i) { -+ struct page *page; -+ unsigned int len = min(chunk_len - off, buf_len); -+ -+ if (is_vmalloc) -+ page = vmalloc_to_page(buf); -+ else -+ page = virt_to_page(buf); -+ -+ sg_set_page(sg, page, len, off); -+ -+ off = 0; -+ buf += len; -+ buf_len -= len; -+ } -+ WARN_ON(buf_len != 0); -+ -+ return 0; -+} -+ -+static void teardown_sgtable(struct sg_table *sgt) -+{ -+ if (sgt->orig_nents > 1) -+ sg_free_table(sgt); -+} -+ - static int ceph_aes_encrypt(const void *key, int key_len, - void *dst, size_t *dst_len, - const void *src, size_t src_len) - { -- struct scatterlist sg_in[2], sg_out[1]; -+ struct scatterlist sg_in[2], prealloc_sg; -+ struct sg_table sg_out; - struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher(); - struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 }; - int ret; -@@ -110,16 +181,18 @@ static int ceph_aes_encrypt(const void *key, int key_len, - - *dst_len = src_len + zero_padding; - -- crypto_blkcipher_setkey((void *)tfm, key, key_len); - sg_init_table(sg_in, 2); - sg_set_buf(&sg_in[0], src, src_len); - sg_set_buf(&sg_in[1], pad, zero_padding); -- sg_init_table(sg_out, 1); -- sg_set_buf(sg_out, dst, *dst_len); -+ ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len); -+ if (ret) -+ goto out_tfm; -+ -+ crypto_blkcipher_setkey((void *)tfm, key, key_len); - iv = crypto_blkcipher_crt(tfm)->iv; - ivsize = crypto_blkcipher_ivsize(tfm); -- - memcpy(iv, aes_iv, ivsize); -+ - /* - print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1, - key, key_len, 1); -@@ -128,16 +201,22 @@ static int ceph_aes_encrypt(const void *key, int key_len, - print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1, - pad, zero_padding, 1); - */ -- ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in, -+ ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in, - src_len + zero_padding); -- crypto_free_blkcipher(tfm); -- if (ret < 0) -+ if (ret < 0) { - pr_err("ceph_aes_crypt failed %d\n", ret); -+ goto out_sg; -+ } - /* - print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1, - dst, *dst_len, 1); - */ -- return 0; -+ -+out_sg: -+ teardown_sgtable(&sg_out); -+out_tfm: -+ crypto_free_blkcipher(tfm); -+ return ret; - } - - static int ceph_aes_encrypt2(const void *key, int key_len, void *dst, -@@ -145,7 +224,8 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst, - const void *src1, size_t src1_len, - const void *src2, size_t src2_len) - { -- struct scatterlist sg_in[3], sg_out[1]; -+ struct scatterlist sg_in[3], prealloc_sg; -+ struct sg_table sg_out; - struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher(); - struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 }; - int ret; -@@ -161,17 +241,19 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst, - - *dst_len = src1_len + src2_len + zero_padding; - -- crypto_blkcipher_setkey((void *)tfm, key, key_len); - sg_init_table(sg_in, 3); - sg_set_buf(&sg_in[0], src1, src1_len); - sg_set_buf(&sg_in[1], src2, src2_len); - sg_set_buf(&sg_in[2], pad, zero_padding); -- sg_init_table(sg_out, 1); -- sg_set_buf(sg_out, dst, *dst_len); -+ ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len); -+ if (ret) -+ goto out_tfm; -+ -+ crypto_blkcipher_setkey((void *)tfm, key, key_len); - iv = crypto_blkcipher_crt(tfm)->iv; - ivsize = crypto_blkcipher_ivsize(tfm); -- - memcpy(iv, aes_iv, ivsize); -+ - /* - print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1, - key, key_len, 1); -@@ -182,23 +264,30 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst, - print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1, - pad, zero_padding, 1); - */ -- ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in, -+ ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in, - src1_len + src2_len + zero_padding); -- crypto_free_blkcipher(tfm); -- if (ret < 0) -+ if (ret < 0) { - pr_err("ceph_aes_crypt2 failed %d\n", ret); -+ goto out_sg; -+ } - /* - print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1, - dst, *dst_len, 1); - */ -- return 0; -+ -+out_sg: -+ teardown_sgtable(&sg_out); -+out_tfm: -+ crypto_free_blkcipher(tfm); -+ return ret; - } - - static int ceph_aes_decrypt(const void *key, int key_len, - void *dst, size_t *dst_len, - const void *src, size_t src_len) - { -- struct scatterlist sg_in[1], sg_out[2]; -+ struct sg_table sg_in; -+ struct scatterlist sg_out[2], prealloc_sg; - struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher(); - struct blkcipher_desc desc = { .tfm = tfm }; - char pad[16]; -@@ -210,16 +299,16 @@ static int ceph_aes_decrypt(const void *key, int key_len, - if (IS_ERR(tfm)) - return PTR_ERR(tfm); - -- crypto_blkcipher_setkey((void *)tfm, key, key_len); -- sg_init_table(sg_in, 1); - sg_init_table(sg_out, 2); -- sg_set_buf(sg_in, src, src_len); - sg_set_buf(&sg_out[0], dst, *dst_len); - sg_set_buf(&sg_out[1], pad, sizeof(pad)); -+ ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len); -+ if (ret) -+ goto out_tfm; - -+ crypto_blkcipher_setkey((void *)tfm, key, key_len); - iv = crypto_blkcipher_crt(tfm)->iv; - ivsize = crypto_blkcipher_ivsize(tfm); -- - memcpy(iv, aes_iv, ivsize); - - /* -@@ -228,12 +317,10 @@ static int ceph_aes_decrypt(const void *key, int key_len, - print_hex_dump(KERN_ERR, "dec in: ", DUMP_PREFIX_NONE, 16, 1, - src, src_len, 1); - */ -- -- ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len); -- crypto_free_blkcipher(tfm); -+ ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len); - if (ret < 0) { - pr_err("ceph_aes_decrypt failed %d\n", ret); -- return ret; -+ goto out_sg; - } - - if (src_len <= *dst_len) -@@ -251,7 +338,12 @@ static int ceph_aes_decrypt(const void *key, int key_len, - print_hex_dump(KERN_ERR, "dec out: ", DUMP_PREFIX_NONE, 16, 1, - dst, *dst_len, 1); - */ -- return 0; -+ -+out_sg: -+ teardown_sgtable(&sg_in); -+out_tfm: -+ crypto_free_blkcipher(tfm); -+ return ret; - } - - static int ceph_aes_decrypt2(const void *key, int key_len, -@@ -259,7 +351,8 @@ static int ceph_aes_decrypt2(const void *key, int key_len, - void *dst2, size_t *dst2_len, - const void *src, size_t src_len) - { -- struct scatterlist sg_in[1], sg_out[3]; -+ struct sg_table sg_in; -+ struct scatterlist sg_out[3], prealloc_sg; - struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher(); - struct blkcipher_desc desc = { .tfm = tfm }; - char pad[16]; -@@ -271,17 +364,17 @@ static int ceph_aes_decrypt2(const void *key, int key_len, - if (IS_ERR(tfm)) - return PTR_ERR(tfm); - -- sg_init_table(sg_in, 1); -- sg_set_buf(sg_in, src, src_len); - sg_init_table(sg_out, 3); - sg_set_buf(&sg_out[0], dst1, *dst1_len); - sg_set_buf(&sg_out[1], dst2, *dst2_len); - sg_set_buf(&sg_out[2], pad, sizeof(pad)); -+ ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len); -+ if (ret) -+ goto out_tfm; - - crypto_blkcipher_setkey((void *)tfm, key, key_len); - iv = crypto_blkcipher_crt(tfm)->iv; - ivsize = crypto_blkcipher_ivsize(tfm); -- - memcpy(iv, aes_iv, ivsize); - - /* -@@ -290,12 +383,10 @@ static int ceph_aes_decrypt2(const void *key, int key_len, - print_hex_dump(KERN_ERR, "dec in: ", DUMP_PREFIX_NONE, 16, 1, - src, src_len, 1); - */ -- -- ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len); -- crypto_free_blkcipher(tfm); -+ ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len); - if (ret < 0) { - pr_err("ceph_aes_decrypt failed %d\n", ret); -- return ret; -+ goto out_sg; - } - - if (src_len <= *dst1_len) -@@ -325,7 +416,11 @@ static int ceph_aes_decrypt2(const void *key, int key_len, - dst2, *dst2_len, 1); - */ - -- return 0; -+out_sg: -+ teardown_sgtable(&sg_in); -+out_tfm: -+ crypto_free_blkcipher(tfm); -+ return ret; - } - - diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c index 9f02369..e6160e9 100644 --- a/net/ceph/messenger.c @@ -102863,7 +102354,7 @@ index c43a1e2..73cbbe1 100644 return -ENOMEM; } diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c -index 5cb830c..81a7a56 100644 +index 2407e5d..edc2f1a 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1188,7 +1188,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, @@ -103871,7 +103362,7 @@ index 06ba3e5..5c08d38 100644 table = kmemdup(ipv6_icmp_table_template, sizeof(ipv6_icmp_table_template), diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index 97299d7..c8e6894 100644 +index cacb493..3cae894 100644 --- a/net/ipv6/ip6_gre.c +++ b/net/ipv6/ip6_gre.c @@ -71,8 +71,8 @@ struct ip6gre_net { @@ -103885,7 +103376,7 @@ index 97299d7..c8e6894 100644 static int ip6gre_tunnel_init(struct net_device *dev); static void ip6gre_tunnel_setup(struct net_device *dev); static void ip6gre_tunnel_link(struct ip6gre_net *ign, struct ip6_tnl *t); -@@ -1286,7 +1286,7 @@ static void ip6gre_fb_tunnel_init(struct net_device *dev) +@@ -1285,7 +1285,7 @@ static void ip6gre_fb_tunnel_init(struct net_device *dev) } @@ -103894,7 +103385,7 @@ index 97299d7..c8e6894 100644 .handler = ip6gre_rcv, .err_handler = ip6gre_err, .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL, -@@ -1645,7 +1645,7 @@ static const struct nla_policy ip6gre_policy[IFLA_GRE_MAX + 1] = { +@@ -1646,7 +1646,7 @@ static const struct nla_policy ip6gre_policy[IFLA_GRE_MAX + 1] = { [IFLA_GRE_FLAGS] = { .type = NLA_U32 }, }; @@ -103903,7 +103394,7 @@ index 97299d7..c8e6894 100644 .kind = "ip6gre", .maxtype = IFLA_GRE_MAX, .policy = ip6gre_policy, -@@ -1659,7 +1659,7 @@ static struct rtnl_link_ops ip6gre_link_ops __read_mostly = { +@@ -1660,7 +1660,7 @@ static struct rtnl_link_ops ip6gre_link_ops __read_mostly = { .fill_info = ip6gre_fill_info, }; @@ -103925,7 +103416,7 @@ index 65eda2a..620a102 100644 __skb_pull(skb, len); } diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 69a84b4..881c319 100644 +index d2eeb3b..c186e9a 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -86,7 +86,7 @@ static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2) @@ -103937,7 +103428,7 @@ index 69a84b4..881c319 100644 static int ip6_tnl_net_id __read_mostly; struct ip6_tnl_net { -@@ -1714,7 +1714,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = { +@@ -1706,7 +1706,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = { [IFLA_IPTUN_PROTO] = { .type = NLA_U8 }, }; @@ -103947,7 +103438,7 @@ index 69a84b4..881c319 100644 .maxtype = IFLA_IPTUN_MAX, .policy = ip6_tnl_policy, diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c -index 5833a22..6631377 100644 +index 99c9487..63f4d92 100644 --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -62,7 +62,7 @@ static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2) @@ -103959,7 +103450,7 @@ index 5833a22..6631377 100644 static int vti6_net_id __read_mostly; struct vti6_net { -@@ -981,7 +981,7 @@ static const struct nla_policy vti6_policy[IFLA_VTI_MAX + 1] = { +@@ -972,7 +972,7 @@ static const struct nla_policy vti6_policy[IFLA_VTI_MAX + 1] = { [IFLA_VTI_OKEY] = { .type = NLA_U32 }, }; @@ -104276,7 +103767,7 @@ index bafde82..af2c91f 100644 table = kmemdup(ipv6_route_table_template, sizeof(ipv6_route_table_template), diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c -index 6163f85..0070823 100644 +index ca1c7c4..37fba59 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c @@ -74,7 +74,7 @@ static void ipip6_tunnel_setup(struct net_device *dev); @@ -104288,7 +103779,7 @@ index 6163f85..0070823 100644 static int sit_net_id __read_mostly; struct sit_net { -@@ -485,11 +485,11 @@ static void ipip6_tunnel_uninit(struct net_device *dev) +@@ -484,11 +484,11 @@ static void ipip6_tunnel_uninit(struct net_device *dev) */ static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb) { @@ -104302,7 +103793,7 @@ index 6163f85..0070823 100644 return 1; skb2 = skb_clone(skb, GFP_ATOMIC); -@@ -498,7 +498,7 @@ static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb) +@@ -497,7 +497,7 @@ static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb) return 1; skb_dst_drop(skb2); @@ -104311,7 +103802,7 @@ index 6163f85..0070823 100644 skb_reset_network_header(skb2); rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, 0); -@@ -1662,7 +1662,7 @@ static void ipip6_dellink(struct net_device *dev, struct list_head *head) +@@ -1659,7 +1659,7 @@ static void ipip6_dellink(struct net_device *dev, struct list_head *head) unregister_netdevice_queue(dev, head); } @@ -104802,7 +104293,7 @@ index 927b4ea..88a30e2 100644 if (local->use_chanctx) *chandef = local->monitor_chandef; diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h -index ef7a089..fe1caf7 100644 +index 5d102b5..6199fca 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -28,6 +28,7 @@ @@ -104823,7 +104314,7 @@ index ef7a089..fe1caf7 100644 /* number of interfaces with corresponding FIF_ flags */ int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll, diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c -index f75e5f1..3d9ad4f 100644 +index 3538e5e..0aa7879 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -531,7 +531,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up) @@ -104862,7 +104353,7 @@ index f75e5f1..3d9ad4f 100644 drv_stop(local); err_del_bss: sdata->bss = NULL; -@@ -889,7 +889,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, +@@ -891,7 +891,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, } if (going_down) @@ -104871,7 +104362,7 @@ index f75e5f1..3d9ad4f 100644 switch (sdata->vif.type) { case NL80211_IFTYPE_AP_VLAN: -@@ -950,7 +950,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, +@@ -952,7 +952,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, } spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); @@ -104880,16 +104371,16 @@ index f75e5f1..3d9ad4f 100644 ieee80211_clear_tx_pending(local); /* -@@ -990,7 +990,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, - - ieee80211_recalc_ps(local, -1); +@@ -995,7 +995,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, + if (cancel_scan) + flush_delayed_work(&local->scan_work); - if (local->open_count == 0) { + if (local_read(&local->open_count) == 0) { ieee80211_stop_device(local); /* no reconfiguring after stop! */ -@@ -1001,7 +1001,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, +@@ -1006,7 +1006,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, ieee80211_configure_filter(local); ieee80211_hw_config(local, hw_reconf_flags); @@ -105011,7 +104502,7 @@ index fad5fdb..ba3672a 100644 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c -index ec8114f..6b2bfba 100644 +index 6582dce..a911da7 100644 --- a/net/netfilter/ipset/ip_set_core.c +++ b/net/netfilter/ipset/ip_set_core.c @@ -1921,7 +1921,7 @@ done: @@ -105383,10 +104874,10 @@ index c68c1e5..8b5d670 100644 } EXPORT_SYMBOL(nf_unregister_sockopt); diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c -index a11c5ff..aa413a7 100644 +index 3250735..1fac969 100644 --- a/net/netfilter/nfnetlink_log.c +++ b/net/netfilter/nfnetlink_log.c -@@ -79,7 +79,7 @@ static int nfnl_log_net_id __read_mostly; +@@ -80,7 +80,7 @@ static int nfnl_log_net_id __read_mostly; struct nfnl_log_net { spinlock_t instances_lock; struct hlist_head instance_table[INSTANCE_BUCKETS]; @@ -105395,7 +104886,7 @@ index a11c5ff..aa413a7 100644 }; static struct nfnl_log_net *nfnl_log_pernet(struct net *net) -@@ -561,7 +561,7 @@ __build_packet_message(struct nfnl_log_net *log, +@@ -563,7 +563,7 @@ __build_packet_message(struct nfnl_log_net *log, /* global sequence number */ if ((inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) && nla_put_be32(inst->skb, NFULA_SEQ_GLOBAL, @@ -105418,7 +104909,7 @@ index 108120f..5b169db 100644 queued = 0; err = 0; diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c -index 1840989..6895744 100644 +index 5b5ab9e..fc1015c 100644 --- a/net/netfilter/nft_compat.c +++ b/net/netfilter/nft_compat.c @@ -225,7 +225,7 @@ target_dump_info(struct sk_buff *skb, const struct xt_target *t, const void *in) @@ -105562,7 +105053,7 @@ index 11de55e..f25e448 100644 return 0; } diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index f1de72d..f983dcb 100644 +index 0007b81..cb08369 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -273,7 +273,7 @@ static void netlink_overrun(struct sock *sk) @@ -105574,7 +105065,7 @@ index f1de72d..f983dcb 100644 } static void netlink_rcv_wake(struct sock *sk) -@@ -3009,7 +3009,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v) +@@ -3010,7 +3010,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v) sk_wmem_alloc_get(s), nlk->cb_running, atomic_read(&s->sk_refcnt), @@ -106228,87 +105719,6 @@ index fc04fe9..8167357 100644 linkwatch_fire_event(dev); } } -diff --git a/net/sctp/associola.c b/net/sctp/associola.c -index a88b852..f791edd 100644 ---- a/net/sctp/associola.c -+++ b/net/sctp/associola.c -@@ -1668,6 +1668,8 @@ struct sctp_chunk *sctp_assoc_lookup_asconf_ack( - * ack chunk whose serial number matches that of the request. - */ - list_for_each_entry(ack, &asoc->asconf_ack_list, transmitted_list) { -+ if (sctp_chunk_pending(ack)) -+ continue; - if (ack->subh.addip_hdr->serial == serial) { - sctp_chunk_hold(ack); - return ack; -diff --git a/net/sctp/auth.c b/net/sctp/auth.c -index 0e85291..fb7976a 100644 ---- a/net/sctp/auth.c -+++ b/net/sctp/auth.c -@@ -862,8 +862,6 @@ int sctp_auth_set_key(struct sctp_endpoint *ep, - list_add(&cur_key->key_list, sh_keys); - - cur_key->key = key; -- sctp_auth_key_hold(key); -- - return 0; - nomem: - if (!replace) -diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c -index 4de12af..7e8a16c 100644 ---- a/net/sctp/inqueue.c -+++ b/net/sctp/inqueue.c -@@ -140,18 +140,9 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue) - } else { - /* Nothing to do. Next chunk in the packet, please. */ - ch = (sctp_chunkhdr_t *) chunk->chunk_end; -- - /* Force chunk->skb->data to chunk->chunk_end. */ -- skb_pull(chunk->skb, -- chunk->chunk_end - chunk->skb->data); -- -- /* Verify that we have at least chunk headers -- * worth of buffer left. -- */ -- if (skb_headlen(chunk->skb) < sizeof(sctp_chunkhdr_t)) { -- sctp_chunk_free(chunk); -- chunk = queue->in_progress = NULL; -- } -+ skb_pull(chunk->skb, chunk->chunk_end - chunk->skb->data); -+ /* We are guaranteed to pull a SCTP header. */ - } - } - -@@ -187,24 +178,14 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue) - skb_pull(chunk->skb, sizeof(sctp_chunkhdr_t)); - chunk->subh.v = NULL; /* Subheader is no longer valid. */ - -- if (chunk->chunk_end < skb_tail_pointer(chunk->skb)) { -+ if (chunk->chunk_end + sizeof(sctp_chunkhdr_t) < -+ skb_tail_pointer(chunk->skb)) { - /* This is not a singleton */ - chunk->singleton = 0; - } else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) { -- /* RFC 2960, Section 6.10 Bundling -- * -- * Partial chunks MUST NOT be placed in an SCTP packet. -- * If the receiver detects a partial chunk, it MUST drop -- * the chunk. -- * -- * Since the end of the chunk is past the end of our buffer -- * (which contains the whole packet, we can freely discard -- * the whole packet. -- */ -- sctp_chunk_free(chunk); -- chunk = queue->in_progress = NULL; -- -- return NULL; -+ /* Discard inside state machine. */ -+ chunk->pdiscard = 1; -+ chunk->chunk_end = skb_tail_pointer(chunk->skb); - } else { - /* We are at the end of the packet, so mark the chunk - * in case we need to send a SACK. diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c index 0e4198e..f94193e 100644 --- a/net/sctp/ipv6.c @@ -106383,182 +105793,6 @@ index 6240834..cac4b52 100644 } static int sctp_v4_protosw_init(void) -diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c -index ae0e616..9f32741 100644 ---- a/net/sctp/sm_make_chunk.c -+++ b/net/sctp/sm_make_chunk.c -@@ -2609,6 +2609,9 @@ do_addr_param: - addr_param = param.v + sizeof(sctp_addip_param_t); - - af = sctp_get_af_specific(param_type2af(param.p->type)); -+ if (af == NULL) -+ break; -+ - af->from_addr_param(&addr, addr_param, - htons(asoc->peer.port), 0); - -@@ -3110,50 +3113,63 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc, - return SCTP_ERROR_NO_ERROR; - } - --/* Verify the ASCONF packet before we process it. */ --int sctp_verify_asconf(const struct sctp_association *asoc, -- struct sctp_paramhdr *param_hdr, void *chunk_end, -- struct sctp_paramhdr **errp) { -- sctp_addip_param_t *asconf_param; -+/* Verify the ASCONF packet before we process it. */ -+bool sctp_verify_asconf(const struct sctp_association *asoc, -+ struct sctp_chunk *chunk, bool addr_param_needed, -+ struct sctp_paramhdr **errp) -+{ -+ sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) chunk->chunk_hdr; - union sctp_params param; -- int length, plen; -+ bool addr_param_seen = false; -+ -+ sctp_walk_params(param, addip, addip_hdr.params) { -+ size_t length = ntohs(param.p->length); - -- param.v = (sctp_paramhdr_t *) param_hdr; -- while (param.v <= chunk_end - sizeof(sctp_paramhdr_t)) { -- length = ntohs(param.p->length); - *errp = param.p; -- -- if (param.v > chunk_end - length || -- length < sizeof(sctp_paramhdr_t)) -- return 0; -- - switch (param.p->type) { -+ case SCTP_PARAM_ERR_CAUSE: -+ break; -+ case SCTP_PARAM_IPV4_ADDRESS: -+ if (length != sizeof(sctp_ipv4addr_param_t)) -+ return false; -+ addr_param_seen = true; -+ break; -+ case SCTP_PARAM_IPV6_ADDRESS: -+ if (length != sizeof(sctp_ipv6addr_param_t)) -+ return false; -+ addr_param_seen = true; -+ break; - case SCTP_PARAM_ADD_IP: - case SCTP_PARAM_DEL_IP: - case SCTP_PARAM_SET_PRIMARY: -- asconf_param = (sctp_addip_param_t *)param.v; -- plen = ntohs(asconf_param->param_hdr.length); -- if (plen < sizeof(sctp_addip_param_t) + -- sizeof(sctp_paramhdr_t)) -- return 0; -+ /* In ASCONF chunks, these need to be first. */ -+ if (addr_param_needed && !addr_param_seen) -+ return false; -+ length = ntohs(param.addip->param_hdr.length); -+ if (length < sizeof(sctp_addip_param_t) + -+ sizeof(sctp_paramhdr_t)) -+ return false; - break; - case SCTP_PARAM_SUCCESS_REPORT: - case SCTP_PARAM_ADAPTATION_LAYER_IND: - if (length != sizeof(sctp_addip_param_t)) -- return 0; -- -+ return false; - break; - default: -- break; -+ /* This is unkown to us, reject! */ -+ return false; - } -- -- param.v += WORD_ROUND(length); - } - -- if (param.v != chunk_end) -- return 0; -+ /* Remaining sanity checks. */ -+ if (addr_param_needed && !addr_param_seen) -+ return false; -+ if (!addr_param_needed && addr_param_seen) -+ return false; -+ if (param.v != chunk->chunk_end) -+ return false; - -- return 1; -+ return true; - } - - /* Process an incoming ASCONF chunk with the next expected serial no. and -@@ -3162,16 +3178,17 @@ int sctp_verify_asconf(const struct sctp_association *asoc, - struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, - struct sctp_chunk *asconf) - { -+ sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) asconf->chunk_hdr; -+ bool all_param_pass = true; -+ union sctp_params param; - sctp_addiphdr_t *hdr; - union sctp_addr_param *addr_param; - sctp_addip_param_t *asconf_param; - struct sctp_chunk *asconf_ack; -- - __be16 err_code; - int length = 0; - int chunk_len; - __u32 serial; -- int all_param_pass = 1; - - chunk_len = ntohs(asconf->chunk_hdr->length) - sizeof(sctp_chunkhdr_t); - hdr = (sctp_addiphdr_t *)asconf->skb->data; -@@ -3199,9 +3216,14 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, - goto done; - - /* Process the TLVs contained within the ASCONF chunk. */ -- while (chunk_len > 0) { -+ sctp_walk_params(param, addip, addip_hdr.params) { -+ /* Skip preceeding address parameters. */ -+ if (param.p->type == SCTP_PARAM_IPV4_ADDRESS || -+ param.p->type == SCTP_PARAM_IPV6_ADDRESS) -+ continue; -+ - err_code = sctp_process_asconf_param(asoc, asconf, -- asconf_param); -+ param.addip); - /* ADDIP 4.1 A7) - * If an error response is received for a TLV parameter, - * all TLVs with no response before the failed TLV are -@@ -3209,28 +3231,20 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, - * the failed response are considered unsuccessful unless - * a specific success indication is present for the parameter. - */ -- if (SCTP_ERROR_NO_ERROR != err_code) -- all_param_pass = 0; -- -+ if (err_code != SCTP_ERROR_NO_ERROR) -+ all_param_pass = false; - if (!all_param_pass) -- sctp_add_asconf_response(asconf_ack, -- asconf_param->crr_id, err_code, -- asconf_param); -+ sctp_add_asconf_response(asconf_ack, param.addip->crr_id, -+ err_code, param.addip); - - /* ADDIP 4.3 D11) When an endpoint receiving an ASCONF to add - * an IP address sends an 'Out of Resource' in its response, it - * MUST also fail any subsequent add or delete requests bundled - * in the ASCONF. - */ -- if (SCTP_ERROR_RSRC_LOW == err_code) -+ if (err_code == SCTP_ERROR_RSRC_LOW) - goto done; -- -- /* Move to the next ASCONF param. */ -- length = ntohs(asconf_param->param_hdr.length); -- asconf_param = (void *)asconf_param + length; -- chunk_len -= length; - } -- - done: - asoc->peer.addip_serial++; - diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c index fef2acd..c705c4f 100644 --- a/net/sctp/sm_sideeffect.c @@ -106572,61 +105806,6 @@ index fef2acd..c705c4f 100644 NULL, sctp_generate_t1_cookie_event, sctp_generate_t1_init_event, -diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c -index c8f6063..3ee27b7 100644 ---- a/net/sctp/sm_statefuns.c -+++ b/net/sctp/sm_statefuns.c -@@ -170,6 +170,9 @@ sctp_chunk_length_valid(struct sctp_chunk *chunk, - { - __u16 chunk_length = ntohs(chunk->chunk_hdr->length); - -+ /* Previously already marked? */ -+ if (unlikely(chunk->pdiscard)) -+ return 0; - if (unlikely(chunk_length < required_length)) - return 0; - -@@ -3591,9 +3594,7 @@ sctp_disposition_t sctp_sf_do_asconf(struct net *net, - struct sctp_chunk *asconf_ack = NULL; - struct sctp_paramhdr *err_param = NULL; - sctp_addiphdr_t *hdr; -- union sctp_addr_param *addr_param; - __u32 serial; -- int length; - - if (!sctp_vtag_verify(chunk, asoc)) { - sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG, -@@ -3618,17 +3619,8 @@ sctp_disposition_t sctp_sf_do_asconf(struct net *net, - hdr = (sctp_addiphdr_t *)chunk->skb->data; - serial = ntohl(hdr->serial); - -- addr_param = (union sctp_addr_param *)hdr->params; -- length = ntohs(addr_param->p.length); -- if (length < sizeof(sctp_paramhdr_t)) -- return sctp_sf_violation_paramlen(net, ep, asoc, type, arg, -- (void *)addr_param, commands); -- - /* Verify the ASCONF chunk before processing it. */ -- if (!sctp_verify_asconf(asoc, -- (sctp_paramhdr_t *)((void *)addr_param + length), -- (void *)chunk->chunk_end, -- &err_param)) -+ if (!sctp_verify_asconf(asoc, chunk, true, &err_param)) - return sctp_sf_violation_paramlen(net, ep, asoc, type, arg, - (void *)err_param, commands); - -@@ -3745,10 +3737,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack(struct net *net, - rcvd_serial = ntohl(addip_hdr->serial); - - /* Verify the ASCONF-ACK chunk before processing it. */ -- if (!sctp_verify_asconf(asoc, -- (sctp_paramhdr_t *)addip_hdr->params, -- (void *)asconf_ack->chunk_end, -- &err_param)) -+ if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param)) - return sctp_sf_violation_paramlen(net, ep, asoc, type, arg, - (void *)err_param, commands); - diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 634a2ab..8e93929 100644 --- a/net/sctp/socket.c @@ -108293,10 +107472,10 @@ index 0865b3e..7235dd4 100644 __ksymtab_gpl : { *(SORT(___ksymtab_gpl+*)) } __ksymtab_unused : { *(SORT(___ksymtab_unused+*)) } diff --git a/scripts/package/builddeb b/scripts/package/builddeb -index 35d5a58..9e04789 100644 +index 7c0e6e4..bf2c90e 100644 --- a/scripts/package/builddeb +++ b/scripts/package/builddeb -@@ -295,6 +295,7 @@ fi +@@ -293,6 +293,7 @@ fi (cd $srctree; find arch/$SRCARCH -name module.lds -o -name Kbuild.platforms -o -name Platform) >> "$objtree/debian/hdrsrcfiles" (cd $srctree; find $(find arch/$SRCARCH -name include -o -name scripts -type d) -type f) >> "$objtree/debian/hdrsrcfiles" (cd $objtree; find arch/$SRCARCH/include Module.symvers include scripts -type f) >> "$objtree/debian/hdrobjfiles" @@ -108404,7 +107583,7 @@ index 293828b..9fbe696 100755 # Find all available archs find_all_archs() diff --git a/security/Kconfig b/security/Kconfig -index beb86b5..505c33c 100644 +index beb86b5..00daaca 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -4,6 +4,969 @@ @@ -109038,7 +108217,7 @@ index beb86b5..505c33c 100644 + +config PAX_KERNEXEC_MODULE_TEXT + int "Minimum amount of memory reserved for module code" -+ default "4" if (!GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_SERVER) ++ default "8" if (!GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_SERVER) + default "12" if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_DESKTOP) + depends on PAX_KERNEXEC && X86_32 + help @@ -109634,10 +108813,10 @@ index 6d0cad1..8f957df 100644 /* record the root user tracking */ rb_link_node(&root_key_user.node, diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c -index e26f860..dcbe7ea 100644 +index eff88a5..51d35ef 100644 --- a/security/keys/keyctl.c +++ b/security/keys/keyctl.c -@@ -1002,7 +1002,7 @@ static int keyctl_change_reqkey_auth(struct key *key) +@@ -1004,7 +1004,7 @@ static int keyctl_change_reqkey_auth(struct key *key) /* * Copy the iovec data from userspace */ @@ -109646,7 +108825,7 @@ index e26f860..dcbe7ea 100644 unsigned ioc) { for (; ioc > 0; ioc--) { -@@ -1024,7 +1024,7 @@ static long copy_from_user_iovec(void *buffer, const struct iovec *iov, +@@ -1026,7 +1026,7 @@ static long copy_from_user_iovec(void *buffer, const struct iovec *iov, * If successful, 0 will be returned. */ long keyctl_instantiate_key_common(key_serial_t id, @@ -109655,7 +108834,7 @@ index e26f860..dcbe7ea 100644 unsigned ioc, size_t plen, key_serial_t ringid) -@@ -1119,7 +1119,7 @@ long keyctl_instantiate_key(key_serial_t id, +@@ -1121,7 +1121,7 @@ long keyctl_instantiate_key(key_serial_t id, [0].iov_len = plen }; @@ -109664,7 +108843,7 @@ index e26f860..dcbe7ea 100644 } return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid); -@@ -1152,7 +1152,7 @@ long keyctl_instantiate_key_iov(key_serial_t id, +@@ -1154,7 +1154,7 @@ long keyctl_instantiate_key_iov(key_serial_t id, if (ret == 0) goto no_payload_free; diff --git a/3.17.3/4425_grsec_remove_EI_PAX.patch b/3.17.4/4425_grsec_remove_EI_PAX.patch index fc51f79..fc51f79 100644 --- a/3.17.3/4425_grsec_remove_EI_PAX.patch +++ b/3.17.4/4425_grsec_remove_EI_PAX.patch diff --git a/3.17.3/4427_force_XATTR_PAX_tmpfs.patch b/3.17.4/4427_force_XATTR_PAX_tmpfs.patch index 21c0171..21c0171 100644 --- a/3.17.3/4427_force_XATTR_PAX_tmpfs.patch +++ b/3.17.4/4427_force_XATTR_PAX_tmpfs.patch diff --git a/3.17.3/4430_grsec-remove-localversion-grsec.patch b/3.17.4/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/3.17.3/4430_grsec-remove-localversion-grsec.patch +++ b/3.17.4/4430_grsec-remove-localversion-grsec.patch diff --git a/3.17.3/4435_grsec-mute-warnings.patch b/3.17.4/4435_grsec-mute-warnings.patch index 4a959cc..4a959cc 100644 --- a/3.17.3/4435_grsec-mute-warnings.patch +++ b/3.17.4/4435_grsec-mute-warnings.patch diff --git a/3.17.3/4440_grsec-remove-protected-paths.patch b/3.17.4/4440_grsec-remove-protected-paths.patch index 741546d..741546d 100644 --- a/3.17.3/4440_grsec-remove-protected-paths.patch +++ b/3.17.4/4440_grsec-remove-protected-paths.patch diff --git a/3.17.3/4450_grsec-kconfig-default-gids.patch b/3.17.4/4450_grsec-kconfig-default-gids.patch index 8a63d7f..8a63d7f 100644 --- a/3.17.3/4450_grsec-kconfig-default-gids.patch +++ b/3.17.4/4450_grsec-kconfig-default-gids.patch diff --git a/3.17.3/4465_selinux-avc_audit-log-curr_ip.patch b/3.17.4/4465_selinux-avc_audit-log-curr_ip.patch index 747ac53..747ac53 100644 --- a/3.17.3/4465_selinux-avc_audit-log-curr_ip.patch +++ b/3.17.4/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/3.17.3/4470_disable-compat_vdso.patch b/3.17.4/4470_disable-compat_vdso.patch index dec59f7..dec59f7 100644 --- a/3.17.3/4470_disable-compat_vdso.patch +++ b/3.17.4/4470_disable-compat_vdso.patch diff --git a/3.17.3/4475_emutramp_default_on.patch b/3.17.4/4475_emutramp_default_on.patch index cf88fd9..cf88fd9 100644 --- a/3.17.3/4475_emutramp_default_on.patch +++ b/3.17.4/4475_emutramp_default_on.patch diff --git a/3.2.64/0000_README b/3.2.64/0000_README index ebfeeef..c5a1f90 100644 --- a/3.2.64/0000_README +++ b/3.2.64/0000_README @@ -174,7 +174,7 @@ Patch: 1063_linux-3.2.64.patch From: http://www.kernel.org Desc: Linux 3.2.64 -Patch: 4420_grsecurity-3.0-3.2.64-201411150025.patch +Patch: 4420_grsecurity-3.0-3.2.64-201411220952.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.2.64/4420_grsecurity-3.0-3.2.64-201411150025.patch b/3.2.64/4420_grsecurity-3.0-3.2.64-201411220952.patch index c4ca76e..d9f5bed 100644 --- a/3.2.64/4420_grsecurity-3.0-3.2.64-201411150025.patch +++ b/3.2.64/4420_grsecurity-3.0-3.2.64-201411220952.patch @@ -3039,7 +3039,7 @@ index 0d8a7d6..d0c9ff5 100644 { int c, old; diff --git a/arch/frv/include/asm/cache.h b/arch/frv/include/asm/cache.h -index 2797163..c2a401d 100644 +index 2797163..c2a401df9 100644 --- a/arch/frv/include/asm/cache.h +++ b/arch/frv/include/asm/cache.h @@ -12,10 +12,11 @@ @@ -45528,6 +45528,21 @@ index 3ed983c..359f1b9 100644 break; err = 0; break; +diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c +index c974581..9556f92 100644 +--- a/drivers/net/ppp/pptp.c ++++ b/drivers/net/ppp/pptp.c +@@ -506,7 +506,9 @@ static int pptp_getname(struct socket *sock, struct sockaddr *uaddr, + int len = sizeof(struct sockaddr_pppox); + struct sockaddr_pppox sp; + +- sp.sa_family = AF_PPPOX; ++ memset(&sp.sa_addr, 0, sizeof(sp.sa_addr)); ++ ++ sp.sa_family = AF_PPPOX; + sp.sa_protocol = PX_PROTO_PPTP; + sp.sa_addr.pptp = pppox_sk(sock->sk)->proto.pptp.src_addr; + diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index 0a0a664..7e7deef 100644 --- a/drivers/net/slip/slhc.c @@ -109818,7 +109833,7 @@ index 38f6617..e70b72b 100755 exuberant() diff --git a/security/Kconfig b/security/Kconfig -index 51bd5a0..96aff0b 100644 +index 51bd5a0..1671979 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -4,6 +4,967 @@ @@ -110454,7 +110469,7 @@ index 51bd5a0..96aff0b 100644 + +config PAX_KERNEXEC_MODULE_TEXT + int "Minimum amount of memory reserved for module code" -+ default "4" if (!GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_SERVER) ++ default "8" if (!GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_SERVER) + default "12" if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_DESKTOP) + depends on PAX_KERNEXEC && X86_32 + help |