summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnthony G. Basile <blueness@gentoo.org>2016-11-09 20:16:01 -0500
committerAnthony G. Basile <blueness@gentoo.org>2016-11-09 20:16:01 -0500
commit1a79343c48a4931d4ccad75512471f4dbf962f7e (patch)
tree2c85c88376c23fe28b47aca6b8b33d6f308f7b5e
parentgrsecurity-3.1-4.7.10-201611011946 (diff)
downloadhardened-patchset-1a79343c48a4931d4ccad75512471f4dbf962f7e.tar.gz
hardened-patchset-1a79343c48a4931d4ccad75512471f4dbf962f7e.tar.bz2
hardened-patchset-1a79343c48a4931d4ccad75512471f4dbf962f7e.zip
grsecurity-3.1-4.8.6-20161109180020161109
-rw-r--r--4.8.6/0000_README (renamed from 4.7.10/0000_README)22
-rw-r--r--4.8.6/1001_linux-4.8.2.patch (renamed from 4.7.10/1007_linux-4.7.8.patch)677
-rw-r--r--4.8.6/1002_linux-4.8.3.patch (renamed from 4.7.10/1008_linux-4.7.9.patch)66
-rw-r--r--4.8.6/1003_linux-4.8.4.patch (renamed from 4.7.10/1009_linux-4.7.10.patch)782
-rw-r--r--4.8.6/1004_linux-4.8.5.patch5397
-rw-r--r--4.8.6/1005_linux-4.8.6.patch5137
-rw-r--r--4.8.6/4420_grsecurity-3.1-4.8.6-201611091800.patch (renamed from 4.7.10/4420_grsecurity-3.1-4.7.10-201611011946.patch)36811
-rw-r--r--4.8.6/4425_grsec_remove_EI_PAX.patch (renamed from 4.7.10/4425_grsec_remove_EI_PAX.patch)2
-rw-r--r--4.8.6/4427_force_XATTR_PAX_tmpfs.patch (renamed from 4.7.10/4427_force_XATTR_PAX_tmpfs.patch)8
-rw-r--r--4.8.6/4430_grsec-remove-localversion-grsec.patch (renamed from 4.7.10/4430_grsec-remove-localversion-grsec.patch)0
-rw-r--r--4.8.6/4435_grsec-mute-warnings.patch (renamed from 4.7.10/4435_grsec-mute-warnings.patch)0
-rw-r--r--4.8.6/4440_grsec-remove-protected-paths.patch (renamed from 4.7.10/4440_grsec-remove-protected-paths.patch)0
-rw-r--r--4.8.6/4450_grsec-kconfig-default-gids.patch (renamed from 4.7.10/4450_grsec-kconfig-default-gids.patch)8
-rw-r--r--4.8.6/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 4.7.10/4465_selinux-avc_audit-log-curr_ip.patch)0
-rw-r--r--4.8.6/4470_disable-compat_vdso.patch (renamed from 4.7.10/4470_disable-compat_vdso.patch)2
-rw-r--r--4.8.6/4475_emutramp_default_on.patch (renamed from 4.7.10/4475_emutramp_default_on.patch)4
16 files changed, 30611 insertions, 18305 deletions
diff --git a/4.7.10/0000_README b/4.8.6/0000_README
index c596497..11337e2 100644
--- a/4.7.10/0000_README
+++ b/4.8.6/0000_README
@@ -2,19 +2,27 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 1007_linux-4.7.8.patch
+Patch: 1001_linux-4.8.2.patch
From: http://www.kernel.org
-Desc: Linux 4.7.8
+Desc: Linux 4.8.2
-Patch: 1008_linux-4.7.9.patch
+Patch: 1002_linux-4.8.3.patch
From: http://www.kernel.org
-Desc: Linux 4.7.9
+Desc: Linux 4.8.3
-Patch: 1009_linux-4.7.10.patch
+Patch: 1003_linux-4.8.4.patch
From: http://www.kernel.org
-Desc: Linux 4.7.10
+Desc: Linux 4.8.4
-Patch: 4420_grsecurity-3.1-4.7.10-201611011946.patch
+Patch: 1004_linux-4.8.5.patch
+From: http://www.kernel.org
+Desc: Linux 4.8.5
+
+Patch: 1005_linux-4.8.6.patch
+From: http://www.kernel.org
+Desc: Linux 4.8.6
+
+Patch: 4420_grsecurity-3.1-4.8.6-201611091800.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/4.7.10/1007_linux-4.7.8.patch b/4.8.6/1001_linux-4.8.2.patch
index dd5c7d8..5e354b2 100644
--- a/4.7.10/1007_linux-4.7.8.patch
+++ b/4.8.6/1001_linux-4.8.2.patch
@@ -11,14 +11,14 @@ index c041658..02f5068 100644
+in-kernel irqchip. Creating a PMU with a userspace irqchip is currently not
+supported.
diff --git a/Makefile b/Makefile
-index 320a930..4e17baa 100644
+index 75db9f3..bf6e44a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
VERSION = 4
- PATCHLEVEL = 7
--SUBLEVEL = 7
-+SUBLEVEL = 8
+ PATCHLEVEL = 8
+-SUBLEVEL = 1
++SUBLEVEL = 2
EXTRAVERSION =
NAME = Psychotic Stoned Sheep
@@ -42,7 +42,7 @@ index 094e39c..6cd18d8 100644
+ };
};
diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
-index df96ccd..779f844 100644
+index 74a9b6c..9dc83b0 100644
--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
+++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
@@ -5,6 +5,7 @@
@@ -53,7 +53,7 @@ index df96ccd..779f844 100644
#include <dt-bindings/interrupt-controller/arm-gic.h>
/ {
model = "Qualcomm APQ8064";
-@@ -552,22 +553,50 @@
+@@ -559,22 +560,50 @@
compatible = "qcom,pm8921-gpio",
"qcom,ssbi-gpio";
reg = <0x150>;
@@ -120,7 +120,7 @@ index df96ccd..779f844 100644
gpio-controller;
#gpio-cells = <2>;
-@@ -580,9 +609,18 @@
+@@ -587,9 +616,18 @@
gpio-controller;
#gpio-cells = <2>;
interrupts =
@@ -142,6 +142,119 @@ index df96ccd..779f844 100644
};
rtc@11d {
+diff --git a/arch/arm/boot/dts/qcom-msm8660.dtsi b/arch/arm/boot/dts/qcom-msm8660.dtsi
+index acbe71f..8c65e0d 100644
+--- a/arch/arm/boot/dts/qcom-msm8660.dtsi
++++ b/arch/arm/boot/dts/qcom-msm8660.dtsi
+@@ -2,6 +2,7 @@
+
+ /include/ "skeleton.dtsi"
+
++#include <dt-bindings/interrupt-controller/irq.h>
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+ #include <dt-bindings/clock/qcom,gcc-msm8660.h>
+ #include <dt-bindings/soc/qcom,gsbi.h>
+@@ -159,21 +160,50 @@
+ "qcom,ssbi-gpio";
+ reg = <0x150>;
+ interrupt-parent = <&pmicintc>;
+- interrupts = <192 1>, <193 1>, <194 1>,
+- <195 1>, <196 1>, <197 1>,
+- <198 1>, <199 1>, <200 1>,
+- <201 1>, <202 1>, <203 1>,
+- <204 1>, <205 1>, <206 1>,
+- <207 1>, <208 1>, <209 1>,
+- <210 1>, <211 1>, <212 1>,
+- <213 1>, <214 1>, <215 1>,
+- <216 1>, <217 1>, <218 1>,
+- <219 1>, <220 1>, <221 1>,
+- <222 1>, <223 1>, <224 1>,
+- <225 1>, <226 1>, <227 1>,
+- <228 1>, <229 1>, <230 1>,
+- <231 1>, <232 1>, <233 1>,
+- <234 1>, <235 1>;
++ interrupts = <192 IRQ_TYPE_NONE>,
++ <193 IRQ_TYPE_NONE>,
++ <194 IRQ_TYPE_NONE>,
++ <195 IRQ_TYPE_NONE>,
++ <196 IRQ_TYPE_NONE>,
++ <197 IRQ_TYPE_NONE>,
++ <198 IRQ_TYPE_NONE>,
++ <199 IRQ_TYPE_NONE>,
++ <200 IRQ_TYPE_NONE>,
++ <201 IRQ_TYPE_NONE>,
++ <202 IRQ_TYPE_NONE>,
++ <203 IRQ_TYPE_NONE>,
++ <204 IRQ_TYPE_NONE>,
++ <205 IRQ_TYPE_NONE>,
++ <206 IRQ_TYPE_NONE>,
++ <207 IRQ_TYPE_NONE>,
++ <208 IRQ_TYPE_NONE>,
++ <209 IRQ_TYPE_NONE>,
++ <210 IRQ_TYPE_NONE>,
++ <211 IRQ_TYPE_NONE>,
++ <212 IRQ_TYPE_NONE>,
++ <213 IRQ_TYPE_NONE>,
++ <214 IRQ_TYPE_NONE>,
++ <215 IRQ_TYPE_NONE>,
++ <216 IRQ_TYPE_NONE>,
++ <217 IRQ_TYPE_NONE>,
++ <218 IRQ_TYPE_NONE>,
++ <219 IRQ_TYPE_NONE>,
++ <220 IRQ_TYPE_NONE>,
++ <221 IRQ_TYPE_NONE>,
++ <222 IRQ_TYPE_NONE>,
++ <223 IRQ_TYPE_NONE>,
++ <224 IRQ_TYPE_NONE>,
++ <225 IRQ_TYPE_NONE>,
++ <226 IRQ_TYPE_NONE>,
++ <227 IRQ_TYPE_NONE>,
++ <228 IRQ_TYPE_NONE>,
++ <229 IRQ_TYPE_NONE>,
++ <230 IRQ_TYPE_NONE>,
++ <231 IRQ_TYPE_NONE>,
++ <232 IRQ_TYPE_NONE>,
++ <233 IRQ_TYPE_NONE>,
++ <234 IRQ_TYPE_NONE>,
++ <235 IRQ_TYPE_NONE>;
+ gpio-controller;
+ #gpio-cells = <2>;
+
+@@ -187,9 +217,18 @@
+ #gpio-cells = <2>;
+ interrupt-parent = <&pmicintc>;
+ interrupts =
+- <128 1>, <129 1>, <130 1>, <131 1>,
+- <132 1>, <133 1>, <134 1>, <135 1>,
+- <136 1>, <137 1>, <138 1>, <139 1>;
++ <128 IRQ_TYPE_NONE>,
++ <129 IRQ_TYPE_NONE>,
++ <130 IRQ_TYPE_NONE>,
++ <131 IRQ_TYPE_NONE>,
++ <132 IRQ_TYPE_NONE>,
++ <133 IRQ_TYPE_NONE>,
++ <134 IRQ_TYPE_NONE>,
++ <135 IRQ_TYPE_NONE>,
++ <136 IRQ_TYPE_NONE>,
++ <137 IRQ_TYPE_NONE>,
++ <138 IRQ_TYPE_NONE>,
++ <139 IRQ_TYPE_NONE>;
+ };
+
+ pwrkey@1c {
+diff --git a/arch/arm/include/asm/delay.h b/arch/arm/include/asm/delay.h
+index b7a4281..b1ce037 100644
+--- a/arch/arm/include/asm/delay.h
++++ b/arch/arm/include/asm/delay.h
+@@ -10,7 +10,7 @@
+ #include <asm/param.h> /* HZ */
+
+ #define MAX_UDELAY_MS 2
+-#define UDELAY_MULT UL(2047 * HZ + 483648 * HZ / 1000000)
++#define UDELAY_MULT UL(2147 * HZ + 483648 * HZ / 1000000)
+ #define UDELAY_SHIFT 31
+
+ #ifndef __ASSEMBLY__
diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
index d9751a4..d34fd72 100644
--- a/arch/arm64/kernel/stacktrace.c
@@ -166,10 +279,10 @@ index d9751a4..d34fd72 100644
/*
* This is a case where function graph tracer has
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
-index 2a43012..f014df9 100644
+index e04f838..df06750 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
-@@ -149,6 +149,11 @@ static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
+@@ -142,6 +142,11 @@ static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
unsigned long irq_stack_ptr;
int skip;
@@ -181,7 +294,7 @@ index 2a43012..f014df9 100644
/*
* Switching between stacks is valid when tracing current and in
* non-preemptible context.
-@@ -158,11 +163,6 @@ static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
+@@ -151,11 +156,6 @@ static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
else
irq_stack_ptr = 0;
@@ -194,10 +307,10 @@ index 2a43012..f014df9 100644
frame.fp = (unsigned long)__builtin_frame_address(0);
frame.sp = current_stack_pointer;
diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
-index 2b42a74..efa592f 100644
+index e788515..43853ec 100644
--- a/arch/mips/kvm/emulate.c
+++ b/arch/mips/kvm/emulate.c
-@@ -807,6 +807,47 @@ enum emulation_result kvm_mips_emul_tlbr(struct kvm_vcpu *vcpu)
+@@ -846,6 +846,47 @@ enum emulation_result kvm_mips_emul_tlbr(struct kvm_vcpu *vcpu)
return EMULATE_FAIL;
}
@@ -245,7 +358,7 @@ index 2b42a74..efa592f 100644
/* Write Guest TLB Entry @ Index */
enum emulation_result kvm_mips_emul_tlbwi(struct kvm_vcpu *vcpu)
{
-@@ -826,11 +867,8 @@ enum emulation_result kvm_mips_emul_tlbwi(struct kvm_vcpu *vcpu)
+@@ -865,11 +906,8 @@ enum emulation_result kvm_mips_emul_tlbwi(struct kvm_vcpu *vcpu)
}
tlb = &vcpu->arch.guest_tlb[index];
@@ -259,7 +372,7 @@ index 2b42a74..efa592f 100644
tlb->tlb_mask = kvm_read_c0_guest_pagemask(cop0);
tlb->tlb_hi = kvm_read_c0_guest_entryhi(cop0);
-@@ -859,11 +897,7 @@ enum emulation_result kvm_mips_emul_tlbwr(struct kvm_vcpu *vcpu)
+@@ -898,11 +936,7 @@ enum emulation_result kvm_mips_emul_tlbwr(struct kvm_vcpu *vcpu)
tlb = &vcpu->arch.guest_tlb[index];
@@ -272,17 +385,17 @@ index 2b42a74..efa592f 100644
tlb->tlb_mask = kvm_read_c0_guest_pagemask(cop0);
tlb->tlb_hi = kvm_read_c0_guest_entryhi(cop0);
-@@ -982,6 +1016,7 @@ enum emulation_result kvm_mips_emulate_CP0(uint32_t inst, uint32_t *opc,
- int32_t rt, rd, copz, sel, co_bit, op;
- uint32_t pc = vcpu->arch.pc;
+@@ -1026,6 +1060,7 @@ enum emulation_result kvm_mips_emulate_CP0(union mips_instruction inst,
+ enum emulation_result er = EMULATE_DONE;
+ u32 rt, rd, sel;
unsigned long curr_pc;
+ int cpu, i;
/*
* Update PC and hold onto current PC in case there is
-@@ -1089,8 +1124,16 @@ enum emulation_result kvm_mips_emulate_CP0(uint32_t inst, uint32_t *opc,
- vcpu->arch.gprs[rt]
- & KVM_ENTRYHI_ASID);
+@@ -1135,8 +1170,16 @@ enum emulation_result kvm_mips_emulate_CP0(union mips_instruction inst,
+ & KVM_ENTRYHI_ASID,
+ nasid);
+ preempt_disable();
/* Blow away the shadow host TLBs */
@@ -297,23 +410,11 @@ index 2b42a74..efa592f 100644
}
kvm_write_c0_guest_entryhi(cop0,
vcpu->arch.gprs[rt]);
-diff --git a/arch/powerpc/include/asm/pci-bridge.h b/arch/powerpc/include/asm/pci-bridge.h
-index 467c0b0..9e9d38a 100644
---- a/arch/powerpc/include/asm/pci-bridge.h
-+++ b/arch/powerpc/include/asm/pci-bridge.h
-@@ -299,6 +299,7 @@ extern void pci_process_bridge_OF_ranges(struct pci_controller *hose,
- /* Allocate & free a PCI host bridge structure */
- extern struct pci_controller *pcibios_alloc_controller(struct device_node *dev);
- extern void pcibios_free_controller(struct pci_controller *phb);
-+extern void pcibios_free_controller_deferred(struct pci_host_bridge *bridge);
-
- #ifdef CONFIG_PCI
- extern int pcibios_vaddr_is_ioport(void __iomem *address);
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index a0948f4..145e5b7 100644
+index f69f40f..978dada 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
-@@ -718,6 +718,7 @@
+@@ -737,6 +737,7 @@
#define MMCR0_FCHV 0x00000001UL /* freeze conditions in hypervisor mode */
#define SPRN_MMCR1 798
#define SPRN_MMCR2 785
@@ -321,53 +422,6 @@ index a0948f4..145e5b7 100644
#define SPRN_MMCRA 0x312
#define MMCRA_SDSYNC 0x80000000UL /* SDAR synced with SIAR */
#define MMCRA_SDAR_DCACHE_MISS 0x40000000UL
-diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
-index 0f7a60f..14af45c 100644
---- a/arch/powerpc/kernel/pci-common.c
-+++ b/arch/powerpc/kernel/pci-common.c
-@@ -103,6 +103,42 @@ void pcibios_free_controller(struct pci_controller *phb)
- EXPORT_SYMBOL_GPL(pcibios_free_controller);
-
- /*
-+ * This function is used to call pcibios_free_controller()
-+ * in a deferred manner: a callback from the PCI subsystem.
-+ *
-+ * _*DO NOT*_ call pcibios_free_controller() explicitly if
-+ * this is used (or it may access an invalid *phb pointer).
-+ *
-+ * The callback occurs when all references to the root bus
-+ * are dropped (e.g., child buses/devices and their users).
-+ *
-+ * It's called as .release_fn() of 'struct pci_host_bridge'
-+ * which is associated with the 'struct pci_controller.bus'
-+ * (root bus) - it expects .release_data to hold a pointer
-+ * to 'struct pci_controller'.
-+ *
-+ * In order to use it, register .release_fn()/release_data
-+ * like this:
-+ *
-+ * pci_set_host_bridge_release(bridge,
-+ * pcibios_free_controller_deferred
-+ * (void *) phb);
-+ *
-+ * e.g. in the pcibios_root_bridge_prepare() callback from
-+ * pci_create_root_bus().
-+ */
-+void pcibios_free_controller_deferred(struct pci_host_bridge *bridge)
-+{
-+ struct pci_controller *phb = (struct pci_controller *)
-+ bridge->release_data;
-+
-+ pr_debug("domain %d, dynamic %d\n", phb->global_number, phb->is_dynamic);
-+
-+ pcibios_free_controller(phb);
-+}
-+EXPORT_SYMBOL_GPL(pcibios_free_controller_deferred);
-+
-+/*
- * The function is used to return the minimal alignment
- * for memory or I/O windows of the associated P2P bridge.
- * By default, 4KiB alignment for I/O windows and 1MiB for
diff --git a/arch/powerpc/kvm/book3s_emulate.c b/arch/powerpc/kvm/book3s_emulate.c
index 2afdb9c..729f8fa 100644
--- a/arch/powerpc/kvm/book3s_emulate.c
@@ -389,7 +443,7 @@ index 2afdb9c..729f8fa 100644
#endif
*spr_val = 0;
diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c
-index 4afae69..eb283c5 100644
+index 02b4672..df3f270 100644
--- a/arch/powerpc/kvm/booke.c
+++ b/arch/powerpc/kvm/booke.c
@@ -2038,7 +2038,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
@@ -401,44 +455,11 @@ index 4afae69..eb283c5 100644
KVMPPC_DEBUG_WATCH_WRITE |
KVMPPC_DEBUG_BREAKPOINT))
return -EINVAL;
-diff --git a/arch/powerpc/platforms/pseries/pci.c b/arch/powerpc/platforms/pseries/pci.c
-index fe16a50..09eba5a 100644
---- a/arch/powerpc/platforms/pseries/pci.c
-+++ b/arch/powerpc/platforms/pseries/pci.c
-@@ -119,6 +119,10 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
-
- bus = bridge->bus;
-
-+ /* Rely on the pcibios_free_controller_deferred() callback. */
-+ pci_set_host_bridge_release(bridge, pcibios_free_controller_deferred,
-+ (void *) pci_bus_to_host(bus));
-+
- dn = pcibios_get_phb_of_node(bus);
- if (!dn)
- return 0;
-diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
-index 906dbaa..547fd13 100644
---- a/arch/powerpc/platforms/pseries/pci_dlpar.c
-+++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
-@@ -106,8 +106,11 @@ int remove_phb_dynamic(struct pci_controller *phb)
- release_resource(res);
- }
-
-- /* Free pci_controller data structure */
-- pcibios_free_controller(phb);
-+ /*
-+ * The pci_controller data structure is freed by
-+ * the pcibios_free_controller_deferred() callback;
-+ * see pseries_root_bridge_prepare().
-+ */
-
- return 0;
- }
diff --git a/arch/x86/include/asm/fpu/xstate.h b/arch/x86/include/asm/fpu/xstate.h
-index 38951b0..993a072 100644
+index ae55a43..19f30a8 100644
--- a/arch/x86/include/asm/fpu/xstate.h
+++ b/arch/x86/include/asm/fpu/xstate.h
-@@ -24,11 +24,12 @@
+@@ -27,11 +27,12 @@
XFEATURE_MASK_YMM | \
XFEATURE_MASK_OPMASK | \
XFEATURE_MASK_ZMM_Hi256 | \
@@ -454,6 +475,21 @@ index 38951b0..993a072 100644
/* All currently supported features */
#define XCNTXT_MASK (XFEATURE_MASK_LAZY | XFEATURE_MASK_EAGER)
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index 6277194..9ae5ab8 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -56,8 +56,8 @@
+ #define INTEL_FAM6_ATOM_SILVERMONT1 0x37 /* BayTrail/BYT / Valleyview */
+ #define INTEL_FAM6_ATOM_SILVERMONT2 0x4D /* Avaton/Rangely */
+ #define INTEL_FAM6_ATOM_AIRMONT 0x4C /* CherryTrail / Braswell */
+-#define INTEL_FAM6_ATOM_MERRIFIELD1 0x4A /* Tangier */
+-#define INTEL_FAM6_ATOM_MERRIFIELD2 0x5A /* Annidale */
++#define INTEL_FAM6_ATOM_MERRIFIELD 0x4A /* Tangier */
++#define INTEL_FAM6_ATOM_MOOREFIELD 0x5A /* Annidale */
+ #define INTEL_FAM6_ATOM_GOLDMONT 0x5C
+ #define INTEL_FAM6_ATOM_DENVERTON 0x5F /* Goldmont Microserver */
+
diff --git a/arch/x86/include/asm/mpspec.h b/arch/x86/include/asm/mpspec.h
index b07233b..c2f94dc 100644
--- a/arch/x86/include/asm/mpspec.h
@@ -475,20 +511,20 @@ index b07233b..c2f94dc 100644
#ifdef CONFIG_X86_LOCAL_APIC
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
-index 9414f84..8e6e8bc 100644
+index 90d84c3..fbd1944 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
-@@ -180,7 +180,7 @@ static int acpi_register_lapic(int id, u8 enabled)
+@@ -182,7 +182,7 @@ static int acpi_register_lapic(int id, u32 acpiid, u8 enabled)
}
if (boot_cpu_physical_apicid != -1U)
- ver = apic_version[boot_cpu_physical_apicid];
+ ver = boot_cpu_apic_version;
- return generic_processor_info(id, ver);
- }
+ cpu = generic_processor_info(id, ver);
+ if (cpu >= 0)
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
-index b15e1c1..cc7bc8b 100644
+index f3e9b2d..076c315 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -64,6 +64,8 @@ unsigned disabled_cpus;
@@ -500,7 +536,7 @@ index b15e1c1..cc7bc8b 100644
/*
* The highest APIC ID seen during enumeration.
*/
-@@ -1790,8 +1792,7 @@ void __init init_apic_mappings(void)
+@@ -1816,8 +1818,7 @@ void __init init_apic_mappings(void)
* since smp_sanity_check is prepared for such a case
* and disable smp mode
*/
@@ -510,7 +546,7 @@ index b15e1c1..cc7bc8b 100644
}
}
-@@ -1806,13 +1807,10 @@ void __init register_lapic_address(unsigned long address)
+@@ -1832,13 +1833,10 @@ void __init register_lapic_address(unsigned long address)
}
if (boot_cpu_physical_apicid == -1U) {
boot_cpu_physical_apicid = read_apic_id();
@@ -525,7 +561,7 @@ index b15e1c1..cc7bc8b 100644
/*
* Local APIC interrupts
*/
-@@ -2102,11 +2100,10 @@ int generic_processor_info(int apicid, int version)
+@@ -2130,11 +2128,10 @@ int generic_processor_info(int apicid, int version)
cpu, apicid);
version = 0x10;
}
@@ -539,7 +575,7 @@ index b15e1c1..cc7bc8b 100644
}
physid_set(apicid, phys_cpu_present_map);
-@@ -2249,7 +2246,7 @@ int __init APIC_init_uniprocessor(void)
+@@ -2277,7 +2274,7 @@ int __init APIC_init_uniprocessor(void)
* Complain if the BIOS pretends there is one.
*/
if (!boot_cpu_has(X86_FEATURE_APIC) &&
@@ -549,10 +585,10 @@ index b15e1c1..cc7bc8b 100644
boot_cpu_physical_apicid);
return -1;
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index 446702e..fbfb244 100644
+index 7491f41..48e6d84 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
-@@ -1592,7 +1592,7 @@ void __init setup_ioapic_ids_from_mpc(void)
+@@ -1593,7 +1593,7 @@ void __init setup_ioapic_ids_from_mpc(void)
* no meaning without the serial APIC bus.
*/
if (!(boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)
@@ -561,7 +597,7 @@ index 446702e..fbfb244 100644
return;
setup_ioapic_ids_from_mpc_nocheck();
}
-@@ -2422,7 +2422,7 @@ static int io_apic_get_unique_id(int ioapic, int apic_id)
+@@ -2423,7 +2423,7 @@ static int io_apic_get_unique_id(int ioapic, int apic_id)
static u8 io_apic_unique_id(int idx, u8 id)
{
if ((boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) &&
@@ -571,10 +607,10 @@ index 446702e..fbfb244 100644
else
return id;
diff --git a/arch/x86/kernel/apic/probe_32.c b/arch/x86/kernel/apic/probe_32.c
-index f316e34..49da80cf 100644
+index 7c43e71..5630962 100644
--- a/arch/x86/kernel/apic/probe_32.c
+++ b/arch/x86/kernel/apic/probe_32.c
-@@ -153,7 +153,7 @@ early_param("apic", parse_apic);
+@@ -152,7 +152,7 @@ early_param("apic", parse_apic);
void __init default_setup_apic_routing(void)
{
@@ -584,7 +620,7 @@ index f316e34..49da80cf 100644
if (num_possible_cpus() > 8) {
switch (boot_cpu_data.x86_vendor) {
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
-index a5e400a..84eced5 100644
+index 6066d94..5d30c5e 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -661,11 +661,28 @@ void irq_complete_move(struct irq_cfg *cfg)
@@ -670,7 +706,7 @@ index 621b501..8a90f15 100644
static void early_panic(char *msg)
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
-index 6e789ca..5dc86d2 100644
+index 63236d8..a21068e 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -110,12 +110,13 @@ void __show_regs(struct pt_regs *regs, int all)
@@ -694,7 +730,7 @@ index 6e789ca..5dc86d2 100644
if (boot_cpu_has(X86_FEATURE_OSPKE))
printk(KERN_DEFAULT "PKRU: %08x\n", read_pkru());
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
-index 600edd2..67ed18e 100644
+index f79576a..a1606ea 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -173,8 +173,8 @@ unsigned long kernel_stack_pointer(struct pt_regs *regs)
@@ -709,10 +745,10 @@ index 600edd2..67ed18e 100644
return (unsigned long)regs;
}
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index fafe8b9..694c529 100644
+index 4296beb..82b1737 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
-@@ -676,7 +676,7 @@ wakeup_secondary_cpu_via_nmi(int apicid, unsigned long start_eip)
+@@ -690,7 +690,7 @@ wakeup_secondary_cpu_via_nmi(int apicid, unsigned long start_eip)
* Give the other CPU some time to accept the IPI.
*/
udelay(200);
@@ -721,7 +757,7 @@ index fafe8b9..694c529 100644
maxlvt = lapic_get_maxlvt();
if (maxlvt > 3) /* Due to the Pentium erratum 3AP. */
apic_write(APIC_ESR, 0);
-@@ -703,7 +703,7 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
+@@ -717,7 +717,7 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
/*
* Be paranoid about clearing APIC errors.
*/
@@ -730,7 +766,7 @@ index fafe8b9..694c529 100644
if (maxlvt > 3) /* Due to the Pentium erratum 3AP. */
apic_write(APIC_ESR, 0);
apic_read(APIC_ESR);
-@@ -742,7 +742,7 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
+@@ -756,7 +756,7 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
* Determine this based on the APIC version.
* If we don't have an integrated APIC, don't send the STARTUP IPIs.
*/
@@ -739,7 +775,7 @@ index fafe8b9..694c529 100644
num_starts = 2;
else
num_starts = 0;
-@@ -980,7 +980,7 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
+@@ -994,7 +994,7 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
/*
* Be paranoid about clearing APIC errors.
*/
@@ -748,7 +784,7 @@ index fafe8b9..694c529 100644
apic_write(APIC_ESR, 0);
apic_read(APIC_ESR);
}
-@@ -1235,7 +1235,7 @@ static int __init smp_sanity_check(unsigned max_cpus)
+@@ -1249,7 +1249,7 @@ static int __init smp_sanity_check(unsigned max_cpus)
/*
* If we couldn't find a local APIC, then get out of here now!
*/
@@ -757,7 +793,7 @@ index fafe8b9..694c529 100644
!boot_cpu_has(X86_FEATURE_APIC)) {
if (!disable_apic) {
pr_err("BIOS bug, local APIC #%d not detected!...\n",
-@@ -1393,9 +1393,21 @@ __init void prefill_possible_map(void)
+@@ -1406,9 +1406,21 @@ __init void prefill_possible_map(void)
{
int i, possible;
@@ -782,8 +818,95 @@ index fafe8b9..694c529 100644
i = setup_max_cpus ?: 1;
if (setup_possible_cpus == -1) {
+diff --git a/arch/x86/platform/atom/punit_atom_debug.c b/arch/x86/platform/atom/punit_atom_debug.c
+index 8ff7b93..d49d3be 100644
+--- a/arch/x86/platform/atom/punit_atom_debug.c
++++ b/arch/x86/platform/atom/punit_atom_debug.c
+@@ -155,7 +155,7 @@ static void punit_dbgfs_unregister(void)
+
+ static const struct x86_cpu_id intel_punit_cpu_ids[] = {
+ ICPU(INTEL_FAM6_ATOM_SILVERMONT1, punit_device_byt),
+- ICPU(INTEL_FAM6_ATOM_MERRIFIELD1, punit_device_tng),
++ ICPU(INTEL_FAM6_ATOM_MERRIFIELD, punit_device_tng),
+ ICPU(INTEL_FAM6_ATOM_AIRMONT, punit_device_cht),
+ {}
+ };
+diff --git a/arch/x86/platform/intel-mid/pwr.c b/arch/x86/platform/intel-mid/pwr.c
+index c901a34..6eca0f6 100644
+--- a/arch/x86/platform/intel-mid/pwr.c
++++ b/arch/x86/platform/intel-mid/pwr.c
+@@ -354,7 +354,7 @@ static int mid_pwr_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ return 0;
+ }
+
+-static int mid_set_initial_state(struct mid_pwr *pwr)
++static int mid_set_initial_state(struct mid_pwr *pwr, const u32 *states)
+ {
+ unsigned int i, j;
+ int ret;
+@@ -379,10 +379,10 @@ static int mid_set_initial_state(struct mid_pwr *pwr)
+ * NOTE: The actual device mapping is provided by a platform at run
+ * time using vendor capability of PCI configuration space.
+ */
+- mid_pwr_set_state(pwr, 0, 0xffffffff);
+- mid_pwr_set_state(pwr, 1, 0xffffffff);
+- mid_pwr_set_state(pwr, 2, 0xffffffff);
+- mid_pwr_set_state(pwr, 3, 0xffffffff);
++ mid_pwr_set_state(pwr, 0, states[0]);
++ mid_pwr_set_state(pwr, 1, states[1]);
++ mid_pwr_set_state(pwr, 2, states[2]);
++ mid_pwr_set_state(pwr, 3, states[3]);
+
+ /* Send command to SCU */
+ ret = mid_pwr_wait_for_cmd(pwr, CMD_SET_CFG);
+@@ -397,13 +397,41 @@ static int mid_set_initial_state(struct mid_pwr *pwr)
+ return 0;
+ }
+
+-static const struct mid_pwr_device_info mid_info = {
+- .set_initial_state = mid_set_initial_state,
++static int pnw_set_initial_state(struct mid_pwr *pwr)
++{
++ /* On Penwell SRAM must stay powered on */
++ const u32 states[] = {
++ 0xf00fffff, /* PM_SSC(0) */
++ 0xffffffff, /* PM_SSC(1) */
++ 0xffffffff, /* PM_SSC(2) */
++ 0xffffffff, /* PM_SSC(3) */
++ };
++ return mid_set_initial_state(pwr, states);
++}
++
++static int tng_set_initial_state(struct mid_pwr *pwr)
++{
++ const u32 states[] = {
++ 0xffffffff, /* PM_SSC(0) */
++ 0xffffffff, /* PM_SSC(1) */
++ 0xffffffff, /* PM_SSC(2) */
++ 0xffffffff, /* PM_SSC(3) */
++ };
++ return mid_set_initial_state(pwr, states);
++}
++
++static const struct mid_pwr_device_info pnw_info = {
++ .set_initial_state = pnw_set_initial_state,
++};
++
++static const struct mid_pwr_device_info tng_info = {
++ .set_initial_state = tng_set_initial_state,
+ };
+
++/* This table should be in sync with the one in drivers/pci/pci-mid.c */
+ static const struct pci_device_id mid_pwr_pci_ids[] = {
+- { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_PENWELL), (kernel_ulong_t)&mid_info },
+- { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_TANGIER), (kernel_ulong_t)&mid_info },
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_PENWELL), (kernel_ulong_t)&pnw_info },
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_TANGIER), (kernel_ulong_t)&tng_info },
+ {}
+ };
+
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
-index 719cf29..40c3aab9 100644
+index 0b4d04c..6228403 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -87,6 +87,12 @@ static void cpu_bringup(void)
@@ -799,21 +922,33 @@ index 719cf29..40c3aab9 100644
xen_setup_cpu_clockevents();
notify_cpu_starting(cpu);
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 811f9b9..d4d55f6 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -251,6 +251,7 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME },
+ { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME },
+ { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME },
++ { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME },
+
+ /* Broadcom BCM2035 */
+ { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
diff --git a/drivers/char/tpm/tpm-dev.c b/drivers/char/tpm/tpm-dev.c
-index de0337e..4f3137d 100644
+index f5d4521..912ad30 100644
--- a/drivers/char/tpm/tpm-dev.c
+++ b/drivers/char/tpm/tpm-dev.c
-@@ -139,7 +139,7 @@ static ssize_t tpm_write(struct file *file, const char __user *buf,
-
- /* atomic tpm command send and result receive */
+@@ -145,7 +145,7 @@ static ssize_t tpm_write(struct file *file, const char __user *buf,
+ return -EPIPE;
+ }
out_size = tpm_transmit(priv->chip, priv->data_buffer,
- sizeof(priv->data_buffer));
+ sizeof(priv->data_buffer), 0);
+
+ tpm_put_ops(priv->chip);
if (out_size < 0) {
- mutex_unlock(&priv->buffer_mutex);
- return out_size;
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
-index e2fa89c..9ba86eb3 100644
+index 1abe2d7..aef20ee 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -330,8 +330,8 @@ EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
@@ -838,7 +973,7 @@ index e2fa89c..9ba86eb3 100644
rc = chip->ops->send(chip, (u8 *) buf, count);
if (rc < 0) {
@@ -393,20 +394,21 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
- dev_err(chip->pdev,
+ dev_err(&chip->dev,
"tpm_transmit: tpm_recv: error %zd\n", rc);
out:
- mutex_unlock(&chip->tpm_mutex);
@@ -864,7 +999,7 @@ index e2fa89c..9ba86eb3 100644
if (len < 0)
return len;
else if (len < TPM_HEADER_SIZE)
-@@ -454,7 +456,8 @@ ssize_t tpm_getcap(struct device *dev, __be32 subcap_id, cap_t *cap,
+@@ -453,7 +455,8 @@ ssize_t tpm_getcap(struct tpm_chip *chip, __be32 subcap_id, cap_t *cap,
tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
tpm_cmd.params.getcap_in.subcap = subcap_id;
}
@@ -874,7 +1009,7 @@ index e2fa89c..9ba86eb3 100644
if (!rc)
*cap = tpm_cmd.params.getcap_out.cap;
return rc;
-@@ -470,7 +473,7 @@ void tpm_gen_interrupt(struct tpm_chip *chip)
+@@ -469,7 +472,7 @@ void tpm_gen_interrupt(struct tpm_chip *chip)
tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
@@ -883,7 +1018,7 @@ index e2fa89c..9ba86eb3 100644
"attempting to determine the timeouts");
}
EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
-@@ -491,7 +494,7 @@ static int tpm_startup(struct tpm_chip *chip, __be16 startup_type)
+@@ -490,7 +493,7 @@ static int tpm_startup(struct tpm_chip *chip, __be16 startup_type)
start_cmd.header.in = tpm_startup_header;
start_cmd.params.startup_in.startup_type = startup_type;
@@ -892,7 +1027,7 @@ index e2fa89c..9ba86eb3 100644
"attempting to start the TPM");
}
-@@ -522,7 +525,8 @@ int tpm_get_timeouts(struct tpm_chip *chip)
+@@ -521,7 +524,8 @@ int tpm_get_timeouts(struct tpm_chip *chip)
tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
@@ -902,7 +1037,7 @@ index e2fa89c..9ba86eb3 100644
if (rc == TPM_ERR_INVALID_POSTINIT) {
/* The TPM is not started, we are the first to talk to it.
-@@ -536,7 +540,7 @@ int tpm_get_timeouts(struct tpm_chip *chip)
+@@ -535,7 +539,7 @@ int tpm_get_timeouts(struct tpm_chip *chip)
tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
@@ -910,8 +1045,8 @@ index e2fa89c..9ba86eb3 100644
+ 0, NULL);
}
if (rc) {
- dev_err(chip->pdev,
-@@ -597,7 +601,7 @@ int tpm_get_timeouts(struct tpm_chip *chip)
+ dev_err(&chip->dev,
+@@ -596,7 +600,7 @@ int tpm_get_timeouts(struct tpm_chip *chip)
tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_DURATION;
@@ -920,7 +1055,7 @@ index e2fa89c..9ba86eb3 100644
"attempting to determine the durations");
if (rc)
return rc;
-@@ -653,7 +657,7 @@ static int tpm_continue_selftest(struct tpm_chip *chip)
+@@ -652,7 +656,7 @@ static int tpm_continue_selftest(struct tpm_chip *chip)
struct tpm_cmd_t cmd;
cmd.header.in = continue_selftest_header;
@@ -929,7 +1064,7 @@ index e2fa89c..9ba86eb3 100644
"continue selftest");
return rc;
}
-@@ -673,7 +677,7 @@ int tpm_pcr_read_dev(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
+@@ -672,7 +676,7 @@ int tpm_pcr_read_dev(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
cmd.header.in = pcrread_header;
cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);
@@ -938,7 +1073,7 @@ index e2fa89c..9ba86eb3 100644
"attempting to read a pcr value");
if (rc == 0)
-@@ -771,7 +775,7 @@ int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash)
+@@ -770,7 +774,7 @@ int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash)
cmd.header.in = pcrextend_header;
cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx);
memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE);
@@ -946,8 +1081,8 @@ index e2fa89c..9ba86eb3 100644
+ rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE, 0,
"attempting extend a PCR value");
- tpm_chip_put(chip);
-@@ -810,7 +814,7 @@ int tpm_do_selftest(struct tpm_chip *chip)
+ tpm_put_ops(chip);
+@@ -809,7 +813,7 @@ int tpm_do_selftest(struct tpm_chip *chip)
/* Attempt to read a PCR value */
cmd.header.in = pcrread_header;
cmd.params.pcrread_in.pcr_idx = cpu_to_be32(0);
@@ -956,16 +1091,16 @@ index e2fa89c..9ba86eb3 100644
/* Some buggy TPMs will not respond to tpm_tis_ready() for
* around 300ms while the self test is ongoing, keep trying
* until the self test duration expires. */
-@@ -851,7 +855,7 @@ int tpm_send(u32 chip_num, void *cmd, size_t buflen)
+@@ -879,7 +883,7 @@ int tpm_send(u32 chip_num, void *cmd, size_t buflen)
if (chip == NULL)
return -ENODEV;
- rc = tpm_transmit_cmd(chip, cmd, buflen, "attempting tpm_cmd");
+ rc = tpm_transmit_cmd(chip, cmd, buflen, 0, "attempting tpm_cmd");
- tpm_chip_put(chip);
+ tpm_put_ops(chip);
return rc;
-@@ -953,14 +957,15 @@ int tpm_pm_suspend(struct device *dev)
+@@ -981,14 +985,15 @@ int tpm_pm_suspend(struct device *dev)
cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(tpm_suspend_pcr);
memcpy(cmd.params.pcrextend_in.hash, dummy_hash,
TPM_DIGEST_SIZE);
@@ -983,7 +1118,7 @@ index e2fa89c..9ba86eb3 100644
/*
* If the TPM indicates that it is too busy to respond to
-@@ -1044,8 +1049,8 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max)
+@@ -1072,8 +1077,8 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max)
tpm_cmd.params.getrandom_in.num_bytes = cpu_to_be32(num_bytes);
err = tpm_transmit_cmd(chip, &tpm_cmd,
@@ -995,11 +1130,11 @@ index e2fa89c..9ba86eb3 100644
break;
diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
-index ee66fd4..f880856 100644
+index b46cf70..e1f7236 100644
--- a/drivers/char/tpm/tpm-sysfs.c
+++ b/drivers/char/tpm/tpm-sysfs.c
@@ -39,7 +39,7 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr,
- struct tpm_chip *chip = dev_get_drvdata(dev);
+ struct tpm_chip *chip = to_tpm_chip(dev);
tpm_cmd.header.in = tpm_readpubek_header;
- err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
@@ -1008,12 +1143,12 @@ index ee66fd4..f880856 100644
if (err)
goto out;
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
-index 28b477e..f475b74 100644
+index 3e32d5b..b0585e9 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
-@@ -494,11 +494,15 @@ extern struct class *tpm_class;
- extern dev_t tpm_devt;
+@@ -476,12 +476,16 @@ extern dev_t tpm_devt;
extern const struct file_operations tpm_fops;
+ extern struct idr dev_nums_idr;
+enum tpm_transmit_flags {
+ TPM_TRANSMIT_UNLOCKED = BIT(0),
@@ -1023,16 +1158,17 @@ index 28b477e..f475b74 100644
+ unsigned int flags);
+ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd, int len,
+ unsigned int flags, const char *desc);
- ssize_t tpm_getcap(struct device *, __be32, cap_t *, const char *);
+ ssize_t tpm_getcap(struct tpm_chip *chip, __be32 subcap_id, cap_t *cap,
+ const char *desc);
-ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
- size_t bufsiz);
-ssize_t tpm_transmit_cmd(struct tpm_chip *chip, void *cmd, int len,
- const char *desc);
extern int tpm_get_timeouts(struct tpm_chip *);
extern void tpm_gen_interrupt(struct tpm_chip *);
- extern int tpm_do_selftest(struct tpm_chip *);
+ int tpm1_auto_startup(struct tpm_chip *chip);
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
-index ca2d238..19f14dc 100644
+index 0c75c3f..ef5a58b 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -282,7 +282,7 @@ int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
@@ -1146,7 +1282,7 @@ index ca2d238..19f14dc 100644
+ rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, flags,
+ "flushing context");
if (rc)
- dev_warn(chip->pdev, "0x%08x was not flushed, rc=%d\n", handle,
+ dev_warn(&chip->dev, "0x%08x was not flushed, rc=%d\n", handle,
rc);
@@ -612,10 +630,18 @@ static void tpm2_flush_context(struct tpm_chip *chip, u32 handle)
tpm_buf_destroy(&buf);
@@ -1230,7 +1366,7 @@ index ca2d238..19f14dc 100644
if (!rc)
*value = be32_to_cpu(cmd.params.get_tpm_pt_out.value);
-@@ -735,7 +764,7 @@ int tpm2_startup(struct tpm_chip *chip, u16 startup_type)
+@@ -735,7 +764,7 @@ static int tpm2_startup(struct tpm_chip *chip, u16 startup_type)
cmd.header.in = tpm2_startup_header;
cmd.params.startup_in.startup_type = cpu_to_be16(startup_type);
@@ -1238,8 +1374,8 @@ index ca2d238..19f14dc 100644
+ return tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0,
"attempting to start the TPM");
}
- EXPORT_SYMBOL_GPL(tpm2_startup);
-@@ -764,7 +793,7 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)
+
+@@ -763,7 +792,7 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)
cmd.header.in = tpm2_shutdown_header;
cmd.params.startup_in.startup_type = cpu_to_be16(shutdown_type);
@@ -1248,7 +1384,7 @@ index ca2d238..19f14dc 100644
/* In places where shutdown command is sent there's no much we can do
* except print the error code on a system failure.
-@@ -830,7 +859,7 @@ static int tpm2_start_selftest(struct tpm_chip *chip, bool full)
+@@ -828,7 +857,7 @@ static int tpm2_start_selftest(struct tpm_chip *chip, bool full)
cmd.header.in = tpm2_selftest_header;
cmd.params.selftest_in.full_test = full;
@@ -1257,7 +1393,7 @@ index ca2d238..19f14dc 100644
"continue selftest");
/* At least some prototype chips seem to give RC_TESTING error
-@@ -882,7 +911,7 @@ int tpm2_do_selftest(struct tpm_chip *chip)
+@@ -880,7 +909,7 @@ static int tpm2_do_selftest(struct tpm_chip *chip)
cmd.params.pcrread_in.pcr_select[1] = 0x00;
cmd.params.pcrread_in.pcr_select[2] = 0x00;
@@ -1266,7 +1402,7 @@ index ca2d238..19f14dc 100644
if (rc < 0)
break;
-@@ -931,7 +960,7 @@ int tpm2_probe(struct tpm_chip *chip)
+@@ -928,7 +957,7 @@ int tpm2_probe(struct tpm_chip *chip)
cmd.params.get_tpm_pt_in.property_id = cpu_to_be32(0x100);
cmd.params.get_tpm_pt_in.property_cnt = cpu_to_be32(1);
@@ -1276,11 +1412,11 @@ index ca2d238..19f14dc 100644
return rc;
else if (rc < TPM_HEADER_SIZE)
diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
-index 0f7ec0d..ee300bd 100644
+index 018c3825..1801f38 100644
--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -142,6 +142,11 @@ static int crb_send(struct tpm_chip *chip, u8 *buf, size_t len)
- struct crb_priv *priv = chip->vendor.priv;
+ struct crb_priv *priv = dev_get_drvdata(&chip->dev);
int rc = 0;
+ /* Zero the cancel register so that the next command will not get
@@ -1301,10 +1437,10 @@ index 0f7ec0d..ee300bd 100644
static bool crb_req_canceled(struct tpm_chip *chip, u8 status)
diff --git a/drivers/cpuidle/cpuidle-arm.c b/drivers/cpuidle/cpuidle-arm.c
-index e342565e..1855b9e 100644
+index 4ba3d3f..f440d38 100644
--- a/drivers/cpuidle/cpuidle-arm.c
+++ b/drivers/cpuidle/cpuidle-arm.c
-@@ -135,6 +135,7 @@ static int __init arm_idle_init(void)
+@@ -121,6 +121,7 @@ static int __init arm_idle_init(void)
dev = kzalloc(sizeof(*dev), GFP_KERNEL);
if (!dev) {
pr_err("Failed to allocate cpuidle device\n");
@@ -1313,10 +1449,10 @@ index e342565e..1855b9e 100644
}
dev->cpu = cpu;
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
-index 1bcf601..26c084d 100644
+index 2d1fb64..580f4f2 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
-@@ -1535,6 +1535,7 @@ config MFD_WM8350
+@@ -1549,6 +1549,7 @@ config MFD_WM8350
config MFD_WM8350_I2C
bool "Wolfson Microelectronics WM8350 with I2C"
select MFD_WM8350
@@ -1372,51 +1508,97 @@ index dbd907d..691dab7 100644
}
int rtsx_usb_transfer_data(struct rtsx_ucr *ucr, unsigned int pipe,
-diff --git a/drivers/misc/cxl/vphb.c b/drivers/misc/cxl/vphb.c
-index cdc7723..bec6c22 100644
---- a/drivers/misc/cxl/vphb.c
-+++ b/drivers/misc/cxl/vphb.c
-@@ -243,6 +243,11 @@ int cxl_pci_vphb_add(struct cxl_afu *afu)
- if (phb->bus == NULL)
- return -ENXIO;
+diff --git a/drivers/pci/pci-mid.c b/drivers/pci/pci-mid.c
+index c878aa7..55f453d 100644
+--- a/drivers/pci/pci-mid.c
++++ b/drivers/pci/pci-mid.c
+@@ -60,8 +60,13 @@ static struct pci_platform_pm_ops mid_pci_platform_pm = {
+
+ #define ICPU(model) { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, }
+
++/*
++ * This table should be in sync with the one in
++ * arch/x86/platform/intel-mid/pwr.c.
++ */
+ static const struct x86_cpu_id lpss_cpu_ids[] = {
+- ICPU(INTEL_FAM6_ATOM_MERRIFIELD1),
++ ICPU(INTEL_FAM6_ATOM_PENWELL),
++ ICPU(INTEL_FAM6_ATOM_MERRIFIELD),
+ {}
+ };
+
+diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c
+index 8c7eb33..4d74ca9 100644
+--- a/drivers/phy/phy-sun4i-usb.c
++++ b/drivers/phy/phy-sun4i-usb.c
+@@ -40,6 +40,7 @@
+ #include <linux/power_supply.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/reset.h>
++#include <linux/spinlock.h>
+ #include <linux/usb/of.h>
+ #include <linux/workqueue.h>
+
+@@ -112,7 +113,7 @@ struct sun4i_usb_phy_data {
+ void __iomem *base;
+ const struct sun4i_usb_phy_cfg *cfg;
+ enum usb_dr_mode dr_mode;
+- struct mutex mutex;
++ spinlock_t reg_lock; /* guard access to phyctl reg */
+ struct sun4i_usb_phy {
+ struct phy *phy;
+ void __iomem *pmu;
+@@ -179,9 +180,10 @@ static void sun4i_usb_phy_write(struct sun4i_usb_phy *phy, u32 addr, u32 data,
+ struct sun4i_usb_phy_data *phy_data = to_sun4i_usb_phy_data(phy);
+ u32 temp, usbc_bit = BIT(phy->index * 2);
+ void __iomem *phyctl = phy_data->base + phy_data->cfg->phyctl_offset;
++ unsigned long flags;
+ int i;
+
+- mutex_lock(&phy_data->mutex);
++ spin_lock_irqsave(&phy_data->reg_lock, flags);
-+ /* Set release hook on root bus */
-+ pci_set_host_bridge_release(to_pci_host_bridge(phb->bus->bridge),
-+ pcibios_free_controller_deferred,
-+ (void *) phb);
+ if (phy_data->cfg->type == sun8i_a33_phy) {
+ /* A33 needs us to set phyctl to 0 explicitly */
+@@ -218,7 +220,8 @@ static void sun4i_usb_phy_write(struct sun4i_usb_phy *phy, u32 addr, u32 data,
+
+ data >>= 1;
+ }
+- mutex_unlock(&phy_data->mutex);
+
- /* Claim resources. This might need some rework as well depending
- * whether we are doing probe-only or not, like assigning unassigned
- * resources etc...
-@@ -269,7 +274,10 @@ void cxl_pci_vphb_remove(struct cxl_afu *afu)
- afu->phb = NULL;
-
- pci_remove_root_bus(phb->bus);
-- pcibios_free_controller(phb);
-+ /*
-+ * We don't free phb here - that's handled by
-+ * pcibios_free_controller_deferred()
-+ */
++ spin_unlock_irqrestore(&phy_data->reg_lock, flags);
}
- bool cxl_pci_is_vphb_device(struct pci_dev *dev)
-diff --git a/drivers/pci/host-bridge.c b/drivers/pci/host-bridge.c
-index 5f4a2e0..add6623 100644
---- a/drivers/pci/host-bridge.c
-+++ b/drivers/pci/host-bridge.c
-@@ -44,6 +44,7 @@ void pci_set_host_bridge_release(struct pci_host_bridge *bridge,
- bridge->release_fn = release_fn;
- bridge->release_data = release_data;
- }
-+EXPORT_SYMBOL_GPL(pci_set_host_bridge_release);
+ static void sun4i_usb_phy_passby(struct sun4i_usb_phy *phy, int enable)
+@@ -577,7 +580,7 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
+ if (!data)
+ return -ENOMEM;
+
+- mutex_init(&data->mutex);
++ spin_lock_init(&data->reg_lock);
+ INIT_DELAYED_WORK(&data->detect, sun4i_usb_phy0_id_vbus_det_scan);
+ dev_set_drvdata(dev, data);
+ data->cfg = of_device_get_match_data(dev);
+diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
+index fbab29d..243b233 100644
+--- a/drivers/powercap/intel_rapl.c
++++ b/drivers/powercap/intel_rapl.c
+@@ -1154,8 +1154,8 @@ static const struct x86_cpu_id rapl_ids[] __initconst = {
+
+ RAPL_CPU(INTEL_FAM6_ATOM_SILVERMONT1, rapl_defaults_byt),
+ RAPL_CPU(INTEL_FAM6_ATOM_AIRMONT, rapl_defaults_cht),
+- RAPL_CPU(INTEL_FAM6_ATOM_MERRIFIELD1, rapl_defaults_tng),
+- RAPL_CPU(INTEL_FAM6_ATOM_MERRIFIELD2, rapl_defaults_ann),
++ RAPL_CPU(INTEL_FAM6_ATOM_MERRIFIELD, rapl_defaults_tng),
++ RAPL_CPU(INTEL_FAM6_ATOM_MOOREFIELD, rapl_defaults_ann),
+ RAPL_CPU(INTEL_FAM6_ATOM_GOLDMONT, rapl_defaults_core),
+ RAPL_CPU(INTEL_FAM6_ATOM_DENVERTON, rapl_defaults_core),
- void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region,
- struct resource *res)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 05a5300..b16813c 100644
+index 122e64d..6854461 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
-@@ -363,7 +363,8 @@ static int dwc3_send_clear_stall_ep_cmd(struct dwc3_ep *dep)
+@@ -348,7 +348,8 @@ static int dwc3_send_clear_stall_ep_cmd(struct dwc3_ep *dep)
* IN transfers due to a mishandled error condition. Synopsys
* STAR 9000614252.
*/
@@ -1426,6 +1608,39 @@ index 05a5300..b16813c 100644
cmd |= DWC3_DEPCMD_CLEARPENDIN;
memset(&params, 0, sizeof(params));
+diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
+index ef2d8cd..8c5f011 100644
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -1070,17 +1070,17 @@ int usb_stor_probe2(struct us_data *us)
+ result = usb_stor_acquire_resources(us);
+ if (result)
+ goto BadDevice;
++ usb_autopm_get_interface_no_resume(us->pusb_intf);
+ snprintf(us->scsi_name, sizeof(us->scsi_name), "usb-storage %s",
+ dev_name(&us->pusb_intf->dev));
+ result = scsi_add_host(us_to_host(us), dev);
+ if (result) {
+ dev_warn(dev,
+ "Unable to add the scsi host\n");
+- goto BadDevice;
++ goto HostAddErr;
+ }
+
+ /* Submit the delayed_work for SCSI-device scanning */
+- usb_autopm_get_interface_no_resume(us->pusb_intf);
+ set_bit(US_FLIDX_SCAN_PENDING, &us->dflags);
+
+ if (delay_use > 0)
+@@ -1090,6 +1090,8 @@ int usb_stor_probe2(struct us_data *us)
+ return 0;
+
+ /* We come here if there are any problems */
++HostAddErr:
++ usb_autopm_put_interface_no_suspend(us->pusb_intf);
+ BadDevice:
+ usb_stor_dbg(us, "storage_probe() failed\n");
+ release_everything(us);
diff --git a/include/linux/mfd/88pm80x.h b/include/linux/mfd/88pm80x.h
index d409ceb..c118a7e 100644
--- a/include/linux/mfd/88pm80x.h
@@ -1449,7 +1664,7 @@ index d409ceb..c118a7e 100644
return 0;
}
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index b6c3945..1b72b17 100644
+index e07fb09..37dec7e 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -403,8 +403,11 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf)
@@ -1467,7 +1682,7 @@ index b6c3945..1b72b17 100644
return now;
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
-index 1bcbc12..b5b932c 100644
+index 4b9b4a4..ef1e4e7 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -190,7 +190,7 @@ int ima_appraise_measurement(enum ima_hooks func,
@@ -1489,10 +1704,10 @@ index 1bcbc12..b5b932c 100644
/* do not collect and update hash for digital signatures */
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
-index 68b26c3..60ac3ae 100644
+index 596ef61..423d111 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
-@@ -222,7 +222,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
+@@ -228,7 +228,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
if ((action & IMA_APPRAISE_SUBMASK) ||
strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) != 0)
/* read 'security.ima' */
@@ -1601,10 +1816,10 @@ index a027569..6e9c40e 100644
!kvm_arm_pmu_irq_initialized(vcpu))
return -ENXIO;
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
-index 69b61ab..7ea7911 100644
+index e83b7fe..b465ac6 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
-@@ -553,6 +553,9 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
+@@ -645,6 +645,9 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
/* Sync back the hardware VGIC state into our emulation after a guest's run. */
void kvm_vgic_sync_hwstate(struct kvm_vcpu *vcpu)
{
@@ -1614,7 +1829,7 @@ index 69b61ab..7ea7911 100644
vgic_process_maintenance_interrupt(vcpu);
vgic_fold_lr_state(vcpu);
vgic_prune_ap_list(vcpu);
-@@ -561,6 +564,9 @@ void kvm_vgic_sync_hwstate(struct kvm_vcpu *vcpu)
+@@ -653,6 +656,9 @@ void kvm_vgic_sync_hwstate(struct kvm_vcpu *vcpu)
/* Flush our emulation state into the GIC hardware before entering the guest. */
void kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
{
diff --git a/4.7.10/1008_linux-4.7.9.patch b/4.8.6/1002_linux-4.8.3.patch
index 5fd99d3..4b4c68a 100644
--- a/4.7.10/1008_linux-4.7.9.patch
+++ b/4.8.6/1002_linux-4.8.3.patch
@@ -1,15 +1,52 @@
diff --git a/Makefile b/Makefile
-index 4e17baa..cb3f64e 100644
+index bf6e44a..42eb45c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
VERSION = 4
- PATCHLEVEL = 7
--SUBLEVEL = 8
-+SUBLEVEL = 9
+ PATCHLEVEL = 8
+-SUBLEVEL = 2
++SUBLEVEL = 3
EXTRAVERSION =
NAME = Psychotic Stoned Sheep
+diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
+index ec6381e..258a3f9 100644
+--- a/drivers/scsi/hosts.c
++++ b/drivers/scsi/hosts.c
+@@ -246,10 +246,6 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
+
+ shost->dma_dev = dma_dev;
+
+- error = device_add(&shost->shost_gendev);
+- if (error)
+- goto out_destroy_freelist;
+-
+ /*
+ * Increase usage count temporarily here so that calling
+ * scsi_autopm_put_host() will trigger runtime idle if there is
+@@ -260,6 +256,10 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
+ pm_runtime_enable(&shost->shost_gendev);
+ device_enable_async_suspend(&shost->shost_gendev);
+
++ error = device_add(&shost->shost_gendev);
++ if (error)
++ goto out_destroy_freelist;
++
+ scsi_host_set_state(shost, SHOST_RUNNING);
+ get_device(shost->shost_gendev.parent);
+
+@@ -309,6 +309,10 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
+ out_del_gendev:
+ device_del(&shost->shost_gendev);
+ out_destroy_freelist:
++ device_disable_async_suspend(&shost->shost_gendev);
++ pm_runtime_disable(&shost->shost_gendev);
++ pm_runtime_set_suspended(&shost->shost_gendev);
++ pm_runtime_put_noidle(&shost->shost_gendev);
+ scsi_destroy_command_freelist(shost);
+ out_destroy_tags:
+ if (shost_use_blk_mq(shost))
diff --git a/fs/xfs/xfs_xattr.c b/fs/xfs/xfs_xattr.c
index ea62245..6290093 100644
--- a/fs/xfs/xfs_xattr.c
@@ -23,10 +60,10 @@ index ea62245..6290093 100644
}
offset = (char *)context->alist + context->count;
diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 317564b..7c3df8d 100644
+index ef815b9..277cd39 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
-@@ -2194,6 +2194,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma,
+@@ -2234,6 +2234,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma,
#define FOLL_TRIED 0x800 /* a retry, previous pass started an IO */
#define FOLL_MLOCK 0x1000 /* lock present pages */
#define FOLL_REMOTE 0x2000 /* we are working on non-current tsk/mm */
@@ -34,8 +71,21 @@ index 317564b..7c3df8d 100644
typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
void *data);
+diff --git a/include/media/rcar-fcp.h b/include/media/rcar-fcp.h
+index 4c7fc77..8723f05 100644
+--- a/include/media/rcar-fcp.h
++++ b/include/media/rcar-fcp.h
+@@ -29,7 +29,7 @@ static inline struct rcar_fcp_device *rcar_fcp_get(const struct device_node *np)
+ static inline void rcar_fcp_put(struct rcar_fcp_device *fcp) { }
+ static inline int rcar_fcp_enable(struct rcar_fcp_device *fcp)
+ {
+- return -ENOSYS;
++ return 0;
+ }
+ static inline void rcar_fcp_disable(struct rcar_fcp_device *fcp) { }
+ #endif
diff --git a/mm/gup.c b/mm/gup.c
-index c057784..2c764f0 100644
+index 96b2b2f..22cc22e 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -60,6 +60,16 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address,
@@ -64,7 +114,7 @@ index c057784..2c764f0 100644
pte_unmap_unlock(ptep, ptl);
return NULL;
}
-@@ -409,7 +419,7 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
+@@ -412,7 +422,7 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
* reCOWed by userspace write).
*/
if ((ret & VM_FAULT_WRITE) && !(vma->vm_flags & VM_WRITE))
diff --git a/4.7.10/1009_linux-4.7.10.patch b/4.8.6/1003_linux-4.8.4.patch
index 2e76abd..b326925 100644
--- a/4.7.10/1009_linux-4.7.10.patch
+++ b/4.8.6/1003_linux-4.8.4.patch
@@ -1,8 +1,8 @@
diff --git a/MAINTAINERS b/MAINTAINERS
-index 8c20323..67c42db 100644
+index f593300..babaf82 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -12620,11 +12620,10 @@ F: arch/x86/xen/*swiotlb*
+@@ -12951,11 +12951,10 @@ F: arch/x86/xen/*swiotlb*
F: drivers/xen/*swiotlb*
XFS FILESYSTEM
@@ -18,14 +18,14 @@ index 8c20323..67c42db 100644
S: Supported
F: Documentation/filesystems/xfs.txt
diff --git a/Makefile b/Makefile
-index cb3f64e..219ab6d 100644
+index 42eb45c..82a36ab 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
VERSION = 4
- PATCHLEVEL = 7
--SUBLEVEL = 9
-+SUBLEVEL = 10
+ PATCHLEVEL = 8
+-SUBLEVEL = 3
++SUBLEVEL = 4
EXTRAVERSION =
NAME = Psychotic Stoned Sheep
@@ -56,18 +56,18 @@ index 6c24faf..62b59409 100644
static void arcv2_irq_mask(struct irq_data *data)
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
-index 4a34978..73a277d 100644
+index cc2f6db..5e24d88 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
-@@ -3021,7 +3021,6 @@ static struct request *cfq_check_fifo(struct cfq_queue *cfqq)
- if (time_before(jiffies, rq->fifo_time))
+@@ -3042,7 +3042,6 @@ static struct request *cfq_check_fifo(struct cfq_queue *cfqq)
+ if (ktime_get_ns() < rq->fifo_time)
rq = NULL;
- cfq_log_cfqq(cfqq->cfqd, cfqq, "fifo=%p", rq);
return rq;
}
-@@ -3395,6 +3394,9 @@ static bool cfq_may_dispatch(struct cfq_data *cfqd, struct cfq_queue *cfqq)
+@@ -3420,6 +3419,9 @@ static bool cfq_may_dispatch(struct cfq_data *cfqd, struct cfq_queue *cfqq)
{
unsigned int max_dispatch;
@@ -77,7 +77,7 @@ index 4a34978..73a277d 100644
/*
* Drain async requests before we start sync IO
*/
-@@ -3486,15 +3488,20 @@ static bool cfq_dispatch_request(struct cfq_data *cfqd, struct cfq_queue *cfqq)
+@@ -3511,15 +3513,20 @@ static bool cfq_dispatch_request(struct cfq_data *cfqd, struct cfq_queue *cfqq)
BUG_ON(RB_EMPTY_ROOT(&cfqq->sort_list));
@@ -99,7 +99,7 @@ index 4a34978..73a277d 100644
/*
* insert request into driver dispatch list
-@@ -3962,7 +3969,7 @@ cfq_should_preempt(struct cfq_data *cfqd, struct cfq_queue *new_cfqq,
+@@ -3989,7 +3996,7 @@ cfq_should_preempt(struct cfq_data *cfqd, struct cfq_queue *new_cfqq,
* if the new request is sync, but the currently running queue is
* not, let the sync request have priority.
*/
@@ -165,6 +165,35 @@ index bac7099..12ad3e3 100644
static int ghash_init(struct shash_desc *desc)
{
struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index e1d5ea6..2accf78 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2689,6 +2689,9 @@ static void acpi_nfit_notify(struct acpi_device *adev, u32 event)
+
+ dev_dbg(dev, "%s: event: %d\n", __func__, event);
+
++ if (event != NFIT_NOTIFY_UPDATE)
++ return;
++
+ device_lock(dev);
+ if (!dev->driver) {
+ /* dev->driver may be null if we're being removed */
+diff --git a/drivers/acpi/nfit/nfit.h b/drivers/acpi/nfit/nfit.h
+index e894ded..51d23f1 100644
+--- a/drivers/acpi/nfit/nfit.h
++++ b/drivers/acpi/nfit/nfit.h
+@@ -78,6 +78,10 @@ enum {
+ NFIT_ARS_TIMEOUT = 90,
+ };
+
++enum nfit_root_notifiers {
++ NFIT_NOTIFY_UPDATE = 0x80,
++};
++
+ struct nfit_spa {
+ struct list_head list;
+ struct nd_region *nd_region;
diff --git a/drivers/base/dma-mapping.c b/drivers/base/dma-mapping.c
index d799662..261420d 100644
--- a/drivers/base/dma-mapping.c
@@ -339,11 +368,56 @@ index 6c999cb0..27a94a1 100644
.base = {
.cra_name = "ghash",
.cra_driver_name = "p8_ghash",
+diff --git a/drivers/gpu/drm/virtio/virtgpu_drm_bus.c b/drivers/gpu/drm/virtio/virtgpu_drm_bus.c
+index 7f0e93f87..88a3916 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_drm_bus.c
++++ b/drivers/gpu/drm/virtio/virtgpu_drm_bus.c
+@@ -27,6 +27,16 @@
+
+ #include "virtgpu_drv.h"
+
++int drm_virtio_set_busid(struct drm_device *dev, struct drm_master *master)
++{
++ struct pci_dev *pdev = dev->pdev;
++
++ if (pdev) {
++ return drm_pci_set_busid(dev, master);
++ }
++ return 0;
++}
++
+ static void virtio_pci_kick_out_firmware_fb(struct pci_dev *pci_dev)
+ {
+ struct apertures_struct *ap;
+diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c
+index c13f70c..5820b702 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_drv.c
++++ b/drivers/gpu/drm/virtio/virtgpu_drv.c
+@@ -117,6 +117,7 @@ static const struct file_operations virtio_gpu_driver_fops = {
+
+ static struct drm_driver driver = {
+ .driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME | DRIVER_RENDER | DRIVER_ATOMIC,
++ .set_busid = drm_virtio_set_busid,
+ .load = virtio_gpu_driver_load,
+ .unload = virtio_gpu_driver_unload,
+ .open = virtio_gpu_driver_open,
+diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
+index b18ef31..acf556a 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
++++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
+@@ -49,6 +49,7 @@
+ #define DRIVER_PATCHLEVEL 1
+
+ /* virtgpu_drm_bus.c */
++int drm_virtio_set_busid(struct drm_device *dev, struct drm_master *master);
+ int drm_virtio_init(struct drm_driver *driver, struct virtio_device *vdev);
+
+ struct virtio_gpu_object {
diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
-index 792f15e..29e3ce2 100644
+index 5da190e..bcf76c3 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
-@@ -889,8 +889,10 @@ void hfi1_send_rc_ack(struct hfi1_ctxtdata *rcd, struct rvt_qp *qp,
+@@ -932,8 +932,10 @@ void hfi1_send_rc_ack(struct hfi1_ctxtdata *rcd, struct rvt_qp *qp,
return;
queue_ack:
@@ -355,7 +429,7 @@ index 792f15e..29e3ce2 100644
qp->s_flags |= RVT_S_ACK_PENDING | RVT_S_RESP_PENDING;
qp->s_nak_state = qp->r_nak_state;
qp->s_ack_psn = qp->r_ack_psn;
-@@ -899,6 +901,7 @@ void hfi1_send_rc_ack(struct hfi1_ctxtdata *rcd, struct rvt_qp *qp,
+@@ -942,6 +944,7 @@ void hfi1_send_rc_ack(struct hfi1_ctxtdata *rcd, struct rvt_qp *qp,
/* Schedule the send tasklet. */
hfi1_schedule_send(qp);
@@ -415,10 +489,10 @@ index 1f33fea..e094df3 100644
mei_cl_bus_rescan(bus);
}
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
-index 501f15d..e7ba731 100644
+index d0b3a1b..dad15b6 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
-@@ -11415,6 +11415,12 @@ static pci_ers_result_t i40e_pci_error_detected(struct pci_dev *pdev,
+@@ -11360,6 +11360,12 @@ static pci_ers_result_t i40e_pci_error_detected(struct pci_dev *pdev,
dev_info(&pdev->dev, "%s: error %d\n", __func__, error);
@@ -504,10 +578,10 @@ index 090910e..82ef56e 100644
err = -ENOSYS;
goto out_unlock;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-index 121baba..9014bf4 100644
+index b8aec5e5..abaf003 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2473,7 +2473,7 @@ static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
+@@ -2533,7 +2533,7 @@ static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
WL_BSS_INFO_MAX);
if (err) {
brcmf_err("Failed to get bss info (%d)\n", err);
@@ -516,7 +590,7 @@ index 121baba..9014bf4 100644
}
si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
-@@ -2485,6 +2485,9 @@ static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
+@@ -2545,6 +2545,9 @@ static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
@@ -526,7 +600,7 @@ index 121baba..9014bf4 100644
}
static s32
-@@ -3824,11 +3827,11 @@ brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
+@@ -3884,11 +3887,11 @@ brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
if (!check_vif_up(ifp->vif))
return -EIO;
@@ -605,7 +679,7 @@ index 7640498..3d53d63 100644
pcmdmessagefld->messagedatabuffer, user_len);
spin_lock_irqsave(&acb->wqbuffer_lock, flags);
diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
-index fc523c3..6398f3d 100644
+index ab67ec4..79c9860 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -717,7 +717,6 @@ static int ibmvfc_reset_crq(struct ibmvfc_host *vhost)
@@ -630,10 +704,10 @@ index e199696..b022f5a 100644
goto err_clk;
}
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
-index d403603..427dd78 100644
+index bdfa659..858a546 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
-@@ -1415,12 +1415,8 @@ static void __do_stop_tx_rs485(struct uart_8250_port *p)
+@@ -1414,12 +1414,8 @@ static void __do_stop_tx_rs485(struct uart_8250_port *p)
if (!(p->port.rs485.flags & SER_RS485_RX_DURING_TX)) {
serial8250_clear_fifos(p);
@@ -646,7 +720,7 @@ index d403603..427dd78 100644
}
}
-@@ -1430,6 +1426,7 @@ static void serial8250_em485_handle_stop_tx(unsigned long arg)
+@@ -1429,6 +1425,7 @@ static void serial8250_em485_handle_stop_tx(unsigned long arg)
struct uart_8250_em485 *em485 = p->em485;
unsigned long flags;
@@ -654,7 +728,7 @@ index d403603..427dd78 100644
spin_lock_irqsave(&p->port.lock, flags);
if (em485 &&
em485->active_timer == &em485->stop_tx_timer) {
-@@ -1437,6 +1434,7 @@ static void serial8250_em485_handle_stop_tx(unsigned long arg)
+@@ -1436,6 +1433,7 @@ static void serial8250_em485_handle_stop_tx(unsigned long arg)
em485->active_timer = NULL;
}
spin_unlock_irqrestore(&p->port.lock, flags);
@@ -662,7 +736,7 @@ index d403603..427dd78 100644
}
static void __stop_tx_rs485(struct uart_8250_port *p)
-@@ -1476,7 +1474,7 @@ static inline void __stop_tx(struct uart_8250_port *p)
+@@ -1475,7 +1473,7 @@ static inline void __stop_tx(struct uart_8250_port *p)
unsigned char lsr = serial_in(p, UART_LSR);
/*
* To provide required timeing and allow FIFO transfer,
@@ -671,7 +745,7 @@ index d403603..427dd78 100644
* shift register are empty. It is for device driver to enable
* interrupt on TEMT.
*/
-@@ -1485,9 +1483,10 @@ static inline void __stop_tx(struct uart_8250_port *p)
+@@ -1484,9 +1482,10 @@ static inline void __stop_tx(struct uart_8250_port *p)
del_timer(&em485->start_tx_timer);
em485->active_timer = NULL;
@@ -683,6 +757,29 @@ index d403603..427dd78 100644
}
static void serial8250_stop_tx(struct uart_port *port)
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 2eaa18d..8bbde52 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -1929,6 +1929,9 @@ static void atmel_shutdown(struct uart_port *port)
+ {
+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+
++ /* Disable modem control lines interrupts */
++ atmel_disable_ms(port);
++
+ /* Disable interrupts at device level */
+ atmel_uart_writel(port, ATMEL_US_IDR, -1);
+
+@@ -1979,8 +1982,6 @@ static void atmel_shutdown(struct uart_port *port)
+ */
+ free_irq(port->irq, port);
+
+- atmel_port->ms_irq_enabled = false;
+-
+ atmel_flush_buffer(port);
+ }
+
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 0df2b1c..615c027 100644
--- a/drivers/tty/serial/imx.c
@@ -703,7 +800,7 @@ index 0df2b1c..615c027 100644
if (sport->dte_mode)
diff --git a/fs/attr.c b/fs/attr.c
-index 25b24d0..ccde270 100644
+index 42bb42b..3c42cab 100644
--- a/fs/attr.c
+++ b/fs/attr.c
@@ -202,6 +202,21 @@ int notify_change(struct dentry * dentry, struct iattr * attr, struct inode **de
@@ -728,22 +825,37 @@ index 25b24d0..ccde270 100644
if ((ia_valid & ATTR_MODE)) {
umode_t amode = attr->ia_mode;
/* Flag setting protected by i_mutex */
+diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
+index 431fd7e..e44271d 100644
+--- a/fs/autofs4/waitq.c
++++ b/fs/autofs4/waitq.c
+@@ -431,8 +431,8 @@ int autofs4_wait(struct autofs_sb_info *sbi,
+ memcpy(&wq->name, &qstr, sizeof(struct qstr));
+ wq->dev = autofs4_get_dev(sbi);
+ wq->ino = autofs4_get_ino(sbi);
+- wq->uid = current_uid();
+- wq->gid = current_gid();
++ wq->uid = current_real_cred()->uid;
++ wq->gid = current_real_cred()->gid;
+ wq->pid = pid;
+ wq->tgid = tgid;
+ wq->status = -EINTR; /* Status return if interrupted */
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
-index 658c39b..702e583 100644
+index 029db6e..60a850e 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
-@@ -690,7 +690,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
- ret = btrfs_map_bio(root, READ, comp_bio,
- mirror_num, 0);
+@@ -698,7 +698,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
+
+ ret = btrfs_map_bio(root, comp_bio, mirror_num, 0);
if (ret) {
- bio->bi_error = ret;
+ comp_bio->bi_error = ret;
bio_endio(comp_bio);
}
-@@ -719,7 +719,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
+@@ -728,7 +728,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
- ret = btrfs_map_bio(root, READ, comp_bio, mirror_num, 0);
+ ret = btrfs_map_bio(root, comp_bio, mirror_num, 0);
if (ret) {
- bio->bi_error = ret;
+ comp_bio->bi_error = ret;
@@ -751,10 +863,10 @@ index 658c39b..702e583 100644
}
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
-index 72f5048..699ee7c 100644
+index 33fe035..791e47c 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
-@@ -265,7 +265,8 @@ struct btrfs_super_block {
+@@ -251,7 +251,8 @@ struct btrfs_super_block {
#define BTRFS_FEATURE_COMPAT_SAFE_CLEAR 0ULL
#define BTRFS_FEATURE_COMPAT_RO_SUPP \
@@ -765,10 +877,10 @@ index 72f5048..699ee7c 100644
#define BTRFS_FEATURE_COMPAT_RO_SAFE_SET 0ULL
#define BTRFS_FEATURE_COMPAT_RO_SAFE_CLEAR 0ULL
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
-index 864cf3b..c14e8c7 100644
+index 54bc8c7..3dede6d 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
-@@ -2528,6 +2528,7 @@ int open_ctree(struct super_block *sb,
+@@ -2566,6 +2566,7 @@ int open_ctree(struct super_block *sb,
int num_backups_tried = 0;
int backup_index = 0;
int max_active;
@@ -776,10 +888,12 @@ index 864cf3b..c14e8c7 100644
tree_root = fs_info->tree_root = btrfs_alloc_root(fs_info, GFP_KERNEL);
chunk_root = fs_info->chunk_root = btrfs_alloc_root(fs_info, GFP_KERNEL);
-@@ -3129,6 +3130,14 @@ int open_ctree(struct super_block *sb,
+@@ -3129,6 +3130,26 @@ int open_ctree(struct super_block *sb,
+ if (sb->s_flags & MS_RDONLY)
+ return 0;
- if (btrfs_test_opt(tree_root, CLEAR_CACHE) &&
- btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE)) {
++ if (btrfs_test_opt(fs_info, CLEAR_CACHE) &&
++ btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE)) {
+ clear_free_space_tree = 1;
+ } else if (btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE) &&
+ !btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE_VALID)) {
@@ -788,14 +902,43 @@ index 864cf3b..c14e8c7 100644
+ }
+
+ if (clear_free_space_tree) {
- btrfs_info(fs_info, "clearing free space tree");
- ret = btrfs_clear_free_space_tree(fs_info);
- if (ret) {
++ btrfs_info(fs_info, "clearing free space tree");
++ ret = btrfs_clear_free_space_tree(fs_info);
++ if (ret) {
++ btrfs_warn(fs_info,
++ "failed to clear free space tree: %d", ret);
++ close_ctree(tree_root);
++ return ret;
++ }
++ }
++
+ if (btrfs_test_opt(tree_root->fs_info, FREE_SPACE_TREE) &&
+ !btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE)) {
+ btrfs_info(fs_info, "creating free space tree");
+@@ -3166,18 +3187,6 @@ int open_ctree(struct super_block *sb,
+
+ btrfs_qgroup_rescan_resume(fs_info);
+
+- if (btrfs_test_opt(tree_root->fs_info, CLEAR_CACHE) &&
+- btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE)) {
+- btrfs_info(fs_info, "clearing free space tree");
+- ret = btrfs_clear_free_space_tree(fs_info);
+- if (ret) {
+- btrfs_warn(fs_info,
+- "failed to clear free space tree: %d", ret);
+- close_ctree(tree_root);
+- return ret;
+- }
+- }
+-
+ if (!fs_info->uuid_root) {
+ btrfs_info(fs_info, "creating UUID tree");
+ ret = btrfs_create_uuid_tree(fs_info);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
-index 92fe3f8..28f60fc 100644
+index 44fe66b..c3ec30d 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
-@@ -5508,17 +5508,45 @@ void copy_extent_buffer(struct extent_buffer *dst, struct extent_buffer *src,
+@@ -5524,17 +5524,45 @@ void copy_extent_buffer(struct extent_buffer *dst, struct extent_buffer *src,
}
}
@@ -852,7 +995,7 @@ index 92fe3f8..28f60fc 100644
/*
* eb_bitmap_offset() - calculate the page and offset of the byte containing the
-@@ -5562,7 +5590,7 @@ static inline void eb_bitmap_offset(struct extent_buffer *eb,
+@@ -5578,7 +5606,7 @@ static inline void eb_bitmap_offset(struct extent_buffer *eb,
int extent_buffer_test_bit(struct extent_buffer *eb, unsigned long start,
unsigned long nr)
{
@@ -861,7 +1004,7 @@ index 92fe3f8..28f60fc 100644
struct page *page;
unsigned long i;
size_t offset;
-@@ -5584,13 +5612,13 @@ int extent_buffer_test_bit(struct extent_buffer *eb, unsigned long start,
+@@ -5600,13 +5628,13 @@ int extent_buffer_test_bit(struct extent_buffer *eb, unsigned long start,
void extent_buffer_bitmap_set(struct extent_buffer *eb, unsigned long start,
unsigned long pos, unsigned long len)
{
@@ -877,7 +1020,7 @@ index 92fe3f8..28f60fc 100644
eb_bitmap_offset(eb, start, pos, &i, &offset);
page = eb->pages[i];
-@@ -5601,7 +5629,7 @@ void extent_buffer_bitmap_set(struct extent_buffer *eb, unsigned long start,
+@@ -5617,7 +5645,7 @@ void extent_buffer_bitmap_set(struct extent_buffer *eb, unsigned long start,
kaddr[offset] |= mask_to_set;
len -= bits_to_set;
bits_to_set = BITS_PER_BYTE;
@@ -886,7 +1029,7 @@ index 92fe3f8..28f60fc 100644
if (++offset >= PAGE_SIZE && len > 0) {
offset = 0;
page = eb->pages[++i];
-@@ -5626,13 +5654,13 @@ void extent_buffer_bitmap_set(struct extent_buffer *eb, unsigned long start,
+@@ -5642,13 +5670,13 @@ void extent_buffer_bitmap_set(struct extent_buffer *eb, unsigned long start,
void extent_buffer_bitmap_clear(struct extent_buffer *eb, unsigned long start,
unsigned long pos, unsigned long len)
{
@@ -902,7 +1045,7 @@ index 92fe3f8..28f60fc 100644
eb_bitmap_offset(eb, start, pos, &i, &offset);
page = eb->pages[i];
-@@ -5643,7 +5671,7 @@ void extent_buffer_bitmap_clear(struct extent_buffer *eb, unsigned long start,
+@@ -5659,7 +5687,7 @@ void extent_buffer_bitmap_clear(struct extent_buffer *eb, unsigned long start,
kaddr[offset] &= ~mask_to_clear;
len -= bits_to_clear;
bits_to_clear = BITS_PER_BYTE;
@@ -912,10 +1055,10 @@ index 92fe3f8..28f60fc 100644
offset = 0;
page = eb->pages[++i];
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
-index c0c1c4f..d190107 100644
+index 28cd88f..1cf4e42 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
-@@ -58,6 +58,28 @@
+@@ -59,6 +59,28 @@
*/
#define EXTENT_PAGE_PRIVATE 1
@@ -945,7 +1088,7 @@ index c0c1c4f..d190107 100644
struct btrfs_root;
struct btrfs_io_bio;
diff --git a/fs/btrfs/free-space-tree.c b/fs/btrfs/free-space-tree.c
-index 53dbeaf..0e041bf 100644
+index 87e7e3d..ea605ff 100644
--- a/fs/btrfs/free-space-tree.c
+++ b/fs/btrfs/free-space-tree.c
@@ -151,7 +151,7 @@ static inline u32 free_space_bitmap_size(u64 size, u32 sectorsize)
@@ -1171,10 +1314,10 @@ index 592059f..309f4e9 100644
if (!real_fops) {
/* Huh? Module did not cleanup after itself at exit? */
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
-index 1ab012a..be14bea 100644
+index 963016c..609998d 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
-@@ -1657,16 +1657,12 @@ void dlm_lowcomms_stop(void)
+@@ -1656,16 +1656,12 @@ void dlm_lowcomms_stop(void)
mutex_lock(&connections_lock);
dlm_allow_conn = 0;
foreach_conn(stop_conn);
@@ -1208,7 +1351,7 @@ index d7ccb7f..7f69347 100644
ret = ext4_es_remove_extent(inode, offset_lblk,
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index ea628af..8fa01cb 100644
+index c6ea25a..f4cdc64 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -647,11 +647,19 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
@@ -1297,10 +1440,10 @@ index a920c5d..6fc14de 100644
lock_two_nondirectories(orig_inode, donor_inode);
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
-index 5bb46b6..593f32b 100644
+index 34c0142..7e2f8c3 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
-@@ -2043,33 +2043,31 @@ static int make_indexed_dir(handle_t *handle, struct ext4_filename *fname,
+@@ -2044,33 +2044,31 @@ static int make_indexed_dir(handle_t *handle, struct ext4_filename *fname,
frame->entries = entries;
frame->at = entries;
frame->bh = bh;
@@ -1340,11 +1483,30 @@ index 5bb46b6..593f32b 100644
return retval;
}
+diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c
+index 4d83d9e..04a7850 100644
+--- a/fs/ext4/symlink.c
++++ b/fs/ext4/symlink.c
+@@ -65,13 +65,12 @@ static const char *ext4_encrypted_get_link(struct dentry *dentry,
+ res = fscrypt_fname_alloc_buffer(inode, cstr.len, &pstr);
+ if (res)
+ goto errout;
++ paddr = pstr.name;
+
+ res = fscrypt_fname_disk_to_usr(inode, 0, 0, &cstr, &pstr);
+ if (res < 0)
+ goto errout;
+
+- paddr = pstr.name;
+-
+ /* Null-terminate the name */
+ if (res <= pstr.len)
+ paddr[res] = '\0';
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
-index cca7b04..31145d6 100644
+index c47b778..4ff9251 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
-@@ -1701,14 +1701,46 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
+@@ -1702,14 +1702,46 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
static int fuse_setattr(struct dentry *entry, struct iattr *attr)
{
struct inode *inode = d_inode(entry);
@@ -1395,7 +1557,7 @@ index cca7b04..31145d6 100644
}
static int fuse_getattr(struct vfsmount *mnt, struct dentry *entry,
-@@ -1800,6 +1832,23 @@ static ssize_t fuse_getxattr(struct dentry *entry, struct inode *inode,
+@@ -1801,6 +1833,23 @@ static ssize_t fuse_getxattr(struct dentry *entry, struct inode *inode,
return ret;
}
@@ -1419,7 +1581,7 @@ index cca7b04..31145d6 100644
static ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size)
{
struct inode *inode = d_inode(entry);
-@@ -1835,6 +1884,8 @@ static ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size)
+@@ -1836,6 +1885,8 @@ static ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size)
ret = fuse_simple_request(fc, &args);
if (!ret && !size)
ret = outarg.size;
@@ -1428,8 +1590,53 @@ index cca7b04..31145d6 100644
if (ret == -ENOSYS) {
fc->no_listxattr = 1;
ret = -EOPNOTSUPP;
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index b5bc3e2..3d8246a 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -159,6 +159,7 @@ static void wait_transaction_locked(journal_t *journal)
+ read_unlock(&journal->j_state_lock);
+ if (need_to_start)
+ jbd2_log_start_commit(journal, tid);
++ jbd2_might_wait_for_commit(journal);
+ schedule();
+ finish_wait(&journal->j_wait_transaction_locked, &wait);
+ }
+@@ -182,8 +183,6 @@ static int add_transaction_credits(journal_t *journal, int blocks,
+ int needed;
+ int total = blocks + rsv_blocks;
+
+- jbd2_might_wait_for_commit(journal);
+-
+ /*
+ * If the current transaction is locked down for commit, wait
+ * for the lock to be released.
+@@ -214,6 +213,7 @@ static int add_transaction_credits(journal_t *journal, int blocks,
+ if (atomic_read(&journal->j_reserved_credits) + total >
+ journal->j_max_transaction_buffers) {
+ read_unlock(&journal->j_state_lock);
++ jbd2_might_wait_for_commit(journal);
+ wait_event(journal->j_wait_reserved,
+ atomic_read(&journal->j_reserved_credits) + total <=
+ journal->j_max_transaction_buffers);
+@@ -238,6 +238,7 @@ static int add_transaction_credits(journal_t *journal, int blocks,
+ if (jbd2_log_space_left(journal) < jbd2_space_needed(journal)) {
+ atomic_sub(total, &t->t_outstanding_credits);
+ read_unlock(&journal->j_state_lock);
++ jbd2_might_wait_for_commit(journal);
+ write_lock(&journal->j_state_lock);
+ if (jbd2_log_space_left(journal) < jbd2_space_needed(journal))
+ __jbd2_log_wait_for_space(journal);
+@@ -255,6 +256,7 @@ static int add_transaction_credits(journal_t *journal, int blocks,
+ sub_reserved_credits(journal, rsv_blocks);
+ atomic_sub(total, &t->t_outstanding_credits);
+ read_unlock(&journal->j_state_lock);
++ jbd2_might_wait_for_commit(journal);
+ wait_event(journal->j_wait_reserved,
+ atomic_read(&journal->j_reserved_credits) + rsv_blocks
+ <= journal->j_max_transaction_buffers / 2);
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
-index c72c16c..b810826 100644
+index 7a4a85a..74d5ddd 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -190,7 +190,15 @@ static int remove_save_link_only(struct super_block *s,
@@ -1460,10 +1667,10 @@ index c72c16c..b810826 100644
reiserfs_warning(s, "reiserfs-2500",
"cannot turn on journaled "
diff --git a/fs/utimes.c b/fs/utimes.c
-index 85c40f4..ba54b9e 100644
+index 794f5f5..ba54b9e 100644
--- a/fs/utimes.c
+++ b/fs/utimes.c
-@@ -87,20 +87,7 @@ static int utimes_common(struct path *path, struct timespec *times)
+@@ -87,21 +87,7 @@ static int utimes_common(struct path *path, struct timespec *times)
*/
newattrs.ia_valid |= ATTR_TIMES_SET;
} else {
@@ -1472,10 +1679,11 @@ index 85c40f4..ba54b9e 100644
- * then we need to check permissions, because
- * inode_change_ok() won't do it.
- */
-- error = -EACCES;
+- error = -EPERM;
- if (IS_IMMUTABLE(inode))
- goto mnt_drop_write_and_out;
-
+- error = -EACCES;
- if (!inode_owner_or_capable(inode)) {
- error = inode_permission(inode, MAY_WRITE);
- if (error)
@@ -1485,7 +1693,7 @@ index 85c40f4..ba54b9e 100644
}
retry_deleg:
inode_lock(inode);
-@@ -112,7 +99,6 @@ static int utimes_common(struct path *path, struct timespec *times)
+@@ -113,7 +99,6 @@ static int utimes_common(struct path *path, struct timespec *times)
goto retry_deleg;
}
@@ -1551,10 +1759,10 @@ index 1438e23..4d3f0d1 100644
struct dentry *debugfs_create_file(const char *name, umode_t mode,
diff --git a/include/linux/fs.h b/include/linux/fs.h
-index dd28814..cf27c88 100644
+index 901e25d..7c39136 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
-@@ -228,6 +228,7 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
+@@ -224,6 +224,7 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
#define ATTR_KILL_PRIV (1 << 14)
#define ATTR_OPEN (1 << 15) /* Truncating from open(O_TRUNC) */
#define ATTR_TIMES_SET (1 << 16)
@@ -1562,8 +1770,37 @@ index dd28814..cf27c88 100644
/*
* Whiteout is represented by a char device. The following constants define the
+diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
+index 4c45105..52b97db 100644
+--- a/include/linux/radix-tree.h
++++ b/include/linux/radix-tree.h
+@@ -280,9 +280,9 @@ bool __radix_tree_delete_node(struct radix_tree_root *root,
+ struct radix_tree_node *node);
+ void *radix_tree_delete_item(struct radix_tree_root *, unsigned long, void *);
+ void *radix_tree_delete(struct radix_tree_root *, unsigned long);
+-struct radix_tree_node *radix_tree_replace_clear_tags(
+- struct radix_tree_root *root,
+- unsigned long index, void *entry);
++void radix_tree_clear_tags(struct radix_tree_root *root,
++ struct radix_tree_node *node,
++ void **slot);
+ unsigned int radix_tree_gang_lookup(struct radix_tree_root *root,
+ void **results, unsigned long first_index,
+ unsigned int max_items);
+diff --git a/include/linux/sem.h b/include/linux/sem.h
+index 976ce3a..d0efd6e 100644
+--- a/include/linux/sem.h
++++ b/include/linux/sem.h
+@@ -21,6 +21,7 @@ struct sem_array {
+ struct list_head list_id; /* undo requests on this array */
+ int sem_nsems; /* no. of semaphores in array */
+ int complex_count; /* pending complex operations */
++ bool complex_mode; /* no parallel simple ops */
+ };
+
+ #ifdef CONFIG_SYSVIPC
diff --git a/include/uapi/linux/btrfs.h b/include/uapi/linux/btrfs.h
-index 2bdd1e3..409be35 100644
+index ac5eacd..db4c253 100644
--- a/include/uapi/linux/btrfs.h
+++ b/include/uapi/linux/btrfs.h
@@ -239,7 +239,17 @@ struct btrfs_ioctl_fs_info_args {
@@ -1585,11 +1822,354 @@ index 2bdd1e3..409be35 100644
#define BTRFS_FEATURE_INCOMPAT_MIXED_BACKREF (1ULL << 0)
#define BTRFS_FEATURE_INCOMPAT_DEFAULT_SUBVOL (1ULL << 1)
+diff --git a/ipc/sem.c b/ipc/sem.c
+index 7c9d4f7..5e318c5 100644
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -162,14 +162,21 @@ static int sysvipc_sem_proc_show(struct seq_file *s, void *it);
+
+ /*
+ * Locking:
++ * a) global sem_lock() for read/write
+ * sem_undo.id_next,
+ * sem_array.complex_count,
+- * sem_array.pending{_alter,_cont},
+- * sem_array.sem_undo: global sem_lock() for read/write
+- * sem_undo.proc_next: only "current" is allowed to read/write that field.
++ * sem_array.complex_mode
++ * sem_array.pending{_alter,_const},
++ * sem_array.sem_undo
+ *
++ * b) global or semaphore sem_lock() for read/write:
+ * sem_array.sem_base[i].pending_{const,alter}:
+- * global or semaphore sem_lock() for read/write
++ * sem_array.complex_mode (for read)
++ *
++ * c) special:
++ * sem_undo_list.list_proc:
++ * * undo_list->lock for write
++ * * rcu for read
+ */
+
+ #define sc_semmsl sem_ctls[0]
+@@ -260,30 +267,61 @@ static void sem_rcu_free(struct rcu_head *head)
+ }
+
+ /*
+- * Wait until all currently ongoing simple ops have completed.
++ * Enter the mode suitable for non-simple operations:
+ * Caller must own sem_perm.lock.
+- * New simple ops cannot start, because simple ops first check
+- * that sem_perm.lock is free.
+- * that a) sem_perm.lock is free and b) complex_count is 0.
+ */
+-static void sem_wait_array(struct sem_array *sma)
++static void complexmode_enter(struct sem_array *sma)
+ {
+ int i;
+ struct sem *sem;
+
+- if (sma->complex_count) {
+- /* The thread that increased sma->complex_count waited on
+- * all sem->lock locks. Thus we don't need to wait again.
+- */
++ if (sma->complex_mode) {
++ /* We are already in complex_mode. Nothing to do */
+ return;
+ }
+
++ /* We need a full barrier after seting complex_mode:
++ * The write to complex_mode must be visible
++ * before we read the first sem->lock spinlock state.
++ */
++ smp_store_mb(sma->complex_mode, true);
++
+ for (i = 0; i < sma->sem_nsems; i++) {
+ sem = sma->sem_base + i;
+ spin_unlock_wait(&sem->lock);
+ }
++ /*
++ * spin_unlock_wait() is not a memory barriers, it is only a
++ * control barrier. The code must pair with spin_unlock(&sem->lock),
++ * thus just the control barrier is insufficient.
++ *
++ * smp_rmb() is sufficient, as writes cannot pass the control barrier.
++ */
++ smp_rmb();
++}
++
++/*
++ * Try to leave the mode that disallows simple operations:
++ * Caller must own sem_perm.lock.
++ */
++static void complexmode_tryleave(struct sem_array *sma)
++{
++ if (sma->complex_count) {
++ /* Complex ops are sleeping.
++ * We must stay in complex mode
++ */
++ return;
++ }
++ /*
++ * Immediately after setting complex_mode to false,
++ * a simple op can start. Thus: all memory writes
++ * performed by the current operation must be visible
++ * before we set complex_mode to false.
++ */
++ smp_store_release(&sma->complex_mode, false);
+ }
+
++#define SEM_GLOBAL_LOCK (-1)
+ /*
+ * If the request contains only one semaphore operation, and there are
+ * no complex transactions pending, lock only the semaphore involved.
+@@ -300,56 +338,42 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,
+ /* Complex operation - acquire a full lock */
+ ipc_lock_object(&sma->sem_perm);
+
+- /* And wait until all simple ops that are processed
+- * right now have dropped their locks.
+- */
+- sem_wait_array(sma);
+- return -1;
++ /* Prevent parallel simple ops */
++ complexmode_enter(sma);
++ return SEM_GLOBAL_LOCK;
+ }
+
+ /*
+ * Only one semaphore affected - try to optimize locking.
+- * The rules are:
+- * - optimized locking is possible if no complex operation
+- * is either enqueued or processed right now.
+- * - The test for enqueued complex ops is simple:
+- * sma->complex_count != 0
+- * - Testing for complex ops that are processed right now is
+- * a bit more difficult. Complex ops acquire the full lock
+- * and first wait that the running simple ops have completed.
+- * (see above)
+- * Thus: If we own a simple lock and the global lock is free
+- * and complex_count is now 0, then it will stay 0 and
+- * thus just locking sem->lock is sufficient.
++ * Optimized locking is possible if no complex operation
++ * is either enqueued or processed right now.
++ *
++ * Both facts are tracked by complex_mode.
+ */
+ sem = sma->sem_base + sops->sem_num;
+
+- if (sma->complex_count == 0) {
++ /*
++ * Initial check for complex_mode. Just an optimization,
++ * no locking, no memory barrier.
++ */
++ if (!sma->complex_mode) {
+ /*
+ * It appears that no complex operation is around.
+ * Acquire the per-semaphore lock.
+ */
+ spin_lock(&sem->lock);
+
+- /* Then check that the global lock is free */
+- if (!spin_is_locked(&sma->sem_perm.lock)) {
+- /*
+- * We need a memory barrier with acquire semantics,
+- * otherwise we can race with another thread that does:
+- * complex_count++;
+- * spin_unlock(sem_perm.lock);
+- */
+- smp_acquire__after_ctrl_dep();
++ /*
++ * See 51d7d5205d33
++ * ("powerpc: Add smp_mb() to arch_spin_is_locked()"):
++ * A full barrier is required: the write of sem->lock
++ * must be visible before the read is executed
++ */
++ smp_mb();
+
+- /*
+- * Now repeat the test of complex_count:
+- * It can't change anymore until we drop sem->lock.
+- * Thus: if is now 0, then it will stay 0.
+- */
+- if (sma->complex_count == 0) {
+- /* fast path successful! */
+- return sops->sem_num;
+- }
++ if (!smp_load_acquire(&sma->complex_mode)) {
++ /* fast path successful! */
++ return sops->sem_num;
+ }
+ spin_unlock(&sem->lock);
+ }
+@@ -369,15 +393,16 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,
+ /* Not a false alarm, thus complete the sequence for a
+ * full lock.
+ */
+- sem_wait_array(sma);
+- return -1;
++ complexmode_enter(sma);
++ return SEM_GLOBAL_LOCK;
+ }
+ }
+
+ static inline void sem_unlock(struct sem_array *sma, int locknum)
+ {
+- if (locknum == -1) {
++ if (locknum == SEM_GLOBAL_LOCK) {
+ unmerge_queues(sma);
++ complexmode_tryleave(sma);
+ ipc_unlock_object(&sma->sem_perm);
+ } else {
+ struct sem *sem = sma->sem_base + locknum;
+@@ -529,6 +554,7 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
+ }
+
+ sma->complex_count = 0;
++ sma->complex_mode = true; /* dropped by sem_unlock below */
+ INIT_LIST_HEAD(&sma->pending_alter);
+ INIT_LIST_HEAD(&sma->pending_const);
+ INIT_LIST_HEAD(&sma->list_id);
+@@ -2184,10 +2210,10 @@ static int sysvipc_sem_proc_show(struct seq_file *s, void *it)
+ /*
+ * The proc interface isn't aware of sem_lock(), it calls
+ * ipc_lock_object() directly (in sysvipc_find_ipc).
+- * In order to stay compatible with sem_lock(), we must wait until
+- * all simple semop() calls have left their critical regions.
++ * In order to stay compatible with sem_lock(), we must
++ * enter / leave complex_mode.
+ */
+- sem_wait_array(sma);
++ complexmode_enter(sma);
+
+ sem_otime = get_semotime(sma);
+
+@@ -2204,6 +2230,8 @@ static int sysvipc_sem_proc_show(struct seq_file *s, void *it)
+ sem_otime,
+ sma->sem_ctime);
+
++ complexmode_tryleave(sma);
++
+ return 0;
+ }
+ #endif
+diff --git a/lib/radix-tree.c b/lib/radix-tree.c
+index 91f0727..8e6d552 100644
+--- a/lib/radix-tree.c
++++ b/lib/radix-tree.c
+@@ -1583,15 +1583,10 @@ void *radix_tree_delete(struct radix_tree_root *root, unsigned long index)
+ }
+ EXPORT_SYMBOL(radix_tree_delete);
+
+-struct radix_tree_node *radix_tree_replace_clear_tags(
+- struct radix_tree_root *root,
+- unsigned long index, void *entry)
++void radix_tree_clear_tags(struct radix_tree_root *root,
++ struct radix_tree_node *node,
++ void **slot)
+ {
+- struct radix_tree_node *node;
+- void **slot;
+-
+- __radix_tree_lookup(root, index, &node, &slot);
+-
+ if (node) {
+ unsigned int tag, offset = get_slot_offset(node, slot);
+ for (tag = 0; tag < RADIX_TREE_MAX_TAGS; tag++)
+@@ -1600,9 +1595,6 @@ struct radix_tree_node *radix_tree_replace_clear_tags(
+ /* Clear root node tags */
+ root->gfp_mask &= __GFP_BITS_MASK;
+ }
+-
+- radix_tree_replace_slot(slot, entry);
+- return node;
+ }
+
+ /**
diff --git a/mm/filemap.c b/mm/filemap.c
-index 20f3b1f..b510542 100644
+index 2d0986a..ced9ef6 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
-@@ -1609,6 +1609,10 @@ static ssize_t do_generic_file_read(struct file *filp, loff_t *ppos,
+@@ -169,33 +169,35 @@ static int page_cache_tree_insert(struct address_space *mapping,
+ static void page_cache_tree_delete(struct address_space *mapping,
+ struct page *page, void *shadow)
+ {
+- struct radix_tree_node *node;
+ int i, nr = PageHuge(page) ? 1 : hpage_nr_pages(page);
+
+ VM_BUG_ON_PAGE(!PageLocked(page), page);
+ VM_BUG_ON_PAGE(PageTail(page), page);
+ VM_BUG_ON_PAGE(nr != 1 && shadow, page);
+
+- if (shadow) {
+- mapping->nrexceptional += nr;
+- /*
+- * Make sure the nrexceptional update is committed before
+- * the nrpages update so that final truncate racing
+- * with reclaim does not see both counters 0 at the
+- * same time and miss a shadow entry.
+- */
+- smp_wmb();
+- }
+- mapping->nrpages -= nr;
+-
+ for (i = 0; i < nr; i++) {
+- node = radix_tree_replace_clear_tags(&mapping->page_tree,
+- page->index + i, shadow);
++ struct radix_tree_node *node;
++ void **slot;
++
++ __radix_tree_lookup(&mapping->page_tree, page->index + i,
++ &node, &slot);
++
++ radix_tree_clear_tags(&mapping->page_tree, node, slot);
++
+ if (!node) {
+ VM_BUG_ON_PAGE(nr != 1, page);
+- return;
++ /*
++ * We need a node to properly account shadow
++ * entries. Don't plant any without. XXX
++ */
++ shadow = NULL;
+ }
+
++ radix_tree_replace_slot(slot, shadow);
++
++ if (!node)
++ break;
++
+ workingset_node_pages_dec(node);
+ if (shadow)
+ workingset_node_shadows_inc(node);
+@@ -219,6 +221,18 @@ static void page_cache_tree_delete(struct address_space *mapping,
+ &node->private_list);
+ }
+ }
++
++ if (shadow) {
++ mapping->nrexceptional += nr;
++ /*
++ * Make sure the nrexceptional update is committed before
++ * the nrpages update so that final truncate racing
++ * with reclaim does not see both counters 0 at the
++ * same time and miss a shadow entry.
++ */
++ smp_wmb();
++ }
++ mapping->nrpages -= nr;
+ }
+
+ /*
+@@ -619,7 +633,6 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
+ __delete_from_page_cache(old, NULL);
+ error = page_cache_tree_insert(mapping, new, NULL);
+ BUG_ON(error);
+- mapping->nrpages++;
+
+ /*
+ * hugetlb pages do not participate in page cache accounting.
+@@ -1674,6 +1687,10 @@ static ssize_t do_generic_file_read(struct file *filp, loff_t *ppos,
unsigned int prev_offset;
int error = 0;
@@ -1600,6 +2180,60 @@ index 20f3b1f..b510542 100644
index = *ppos >> PAGE_SHIFT;
prev_index = ra->prev_pos >> PAGE_SHIFT;
prev_offset = ra->prev_pos & (PAGE_SIZE-1);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 87e11d8..603bdd0 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1443,13 +1443,14 @@ static void dissolve_free_huge_page(struct page *page)
+ {
+ spin_lock(&hugetlb_lock);
+ if (PageHuge(page) && !page_count(page)) {
+- struct hstate *h = page_hstate(page);
+- int nid = page_to_nid(page);
+- list_del(&page->lru);
++ struct page *head = compound_head(page);
++ struct hstate *h = page_hstate(head);
++ int nid = page_to_nid(head);
++ list_del(&head->lru);
+ h->free_huge_pages--;
+ h->free_huge_pages_node[nid]--;
+ h->max_huge_pages--;
+- update_and_free_page(h, page);
++ update_and_free_page(h, head);
+ }
+ spin_unlock(&hugetlb_lock);
+ }
+@@ -1457,7 +1458,8 @@ static void dissolve_free_huge_page(struct page *page)
+ /*
+ * Dissolve free hugepages in a given pfn range. Used by memory hotplug to
+ * make specified memory blocks removable from the system.
+- * Note that start_pfn should aligned with (minimum) hugepage size.
++ * Note that this will dissolve a free gigantic hugepage completely, if any
++ * part of it lies within the given range.
+ */
+ void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
+ {
+@@ -1466,7 +1468,6 @@ void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
+ if (!hugepages_supported())
+ return;
+
+- VM_BUG_ON(!IS_ALIGNED(start_pfn, 1 << minimum_order));
+ for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order)
+ dissolve_free_huge_page(pfn_to_page(pfn));
+ }
+diff --git a/sound/soc/codecs/nau8825.c b/sound/soc/codecs/nau8825.c
+index 2e59a85..ff56637 100644
+--- a/sound/soc/codecs/nau8825.c
++++ b/sound/soc/codecs/nau8825.c
+@@ -1907,7 +1907,7 @@ static int nau8825_calc_fll_param(unsigned int fll_in, unsigned int fs,
+ /* Calculate the FLL 10-bit integer input and the FLL 16-bit fractional
+ * input based on FDCO, FREF and FLL ratio.
+ */
+- fvco = div_u64(fvco << 16, fref * fll_param->ratio);
++ fvco = div_u64(fvco_max << 16, fref * fll_param->ratio);
+ fll_param->fll_int = (fvco >> 16) & 0x3FF;
+ fll_param->fll_frac = fvco & 0xFFFF;
+ return 0;
diff --git a/sound/soc/intel/atom/sst/sst_pvt.c b/sound/soc/intel/atom/sst/sst_pvt.c
index adb32fe..b1e6b8f 100644
--- a/sound/soc/intel/atom/sst/sst_pvt.c
diff --git a/4.8.6/1004_linux-4.8.5.patch b/4.8.6/1004_linux-4.8.5.patch
new file mode 100644
index 0000000..b4a1ae0
--- /dev/null
+++ b/4.8.6/1004_linux-4.8.5.patch
@@ -0,0 +1,5397 @@
+diff --git a/Documentation/ABI/testing/sysfs-class-cxl b/Documentation/ABI/testing/sysfs-class-cxl
+index 4ba0a2a..640f65e 100644
+--- a/Documentation/ABI/testing/sysfs-class-cxl
++++ b/Documentation/ABI/testing/sysfs-class-cxl
+@@ -220,8 +220,11 @@ What: /sys/class/cxl/<card>/reset
+ Date: October 2014
+ Contact: linuxppc-dev@lists.ozlabs.org
+ Description: write only
+- Writing 1 will issue a PERST to card which may cause the card
+- to reload the FPGA depending on load_image_on_perst.
++ Writing 1 will issue a PERST to card provided there are no
++ contexts active on any one of the card AFUs. This may cause
++ the card to reload the FPGA depending on load_image_on_perst.
++ Writing -1 will do a force PERST irrespective of any active
++ contexts on the card AFUs.
+ Users: https://github.com/ibm-capi/libcxl
+
+ What: /sys/class/cxl/<card>/perst_reloads_same_image (not in a guest)
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index a4f4d69..46726d4 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -1457,7 +1457,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ i8042.nopnp [HW] Don't use ACPIPnP / PnPBIOS to discover KBD/AUX
+ controllers
+ i8042.notimeout [HW] Ignore timeout condition signalled by controller
+- i8042.reset [HW] Reset the controller during init and cleanup
++ i8042.reset [HW] Reset the controller during init, cleanup and
++ suspend-to-ram transitions, only during s2r
++ transitions, or never reset
++ Format: { 1 | Y | y | 0 | N | n }
++ 1, Y, y: always reset controller
++ 0, N, n: don't ever reset controller
++ Default: only on s2r transitions on x86; most other
++ architectures force reset to be always executed
+ i8042.unlock [HW] Unlock (ignore) the keylock
+ i8042.kbdreset [HW] Reset device connected to KBD port
+
+diff --git a/Makefile b/Makefile
+index 82a36ab..daa3a01 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 8
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = Psychotic Stoned Sheep
+
+diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
+index 6cb3736..d347bbc 100644
+--- a/arch/arc/kernel/signal.c
++++ b/arch/arc/kernel/signal.c
+@@ -107,13 +107,13 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
+ struct user_regs_struct uregs;
+
+ err = __copy_from_user(&set, &sf->uc.uc_sigmask, sizeof(set));
+- if (!err)
+- set_current_blocked(&set);
+-
+ err |= __copy_from_user(&uregs.scratch,
+ &(sf->uc.uc_mcontext.regs.scratch),
+ sizeof(sf->uc.uc_mcontext.regs.scratch));
++ if (err)
++ return err;
+
++ set_current_blocked(&set);
+ regs->bta = uregs.scratch.bta;
+ regs->lp_start = uregs.scratch.lp_start;
+ regs->lp_end = uregs.scratch.lp_end;
+@@ -138,7 +138,7 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
+ regs->r0 = uregs.scratch.r0;
+ regs->sp = uregs.scratch.sp;
+
+- return err;
++ return 0;
+ }
+
+ static inline int is_do_ss_needed(unsigned int magic)
+diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
+index 4cdeae3..948a9a8 100644
+--- a/arch/arm64/include/asm/kvm_emulate.h
++++ b/arch/arm64/include/asm/kvm_emulate.h
+@@ -167,11 +167,6 @@ static inline bool kvm_vcpu_dabt_isvalid(const struct kvm_vcpu *vcpu)
+ return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_ISV);
+ }
+
+-static inline bool kvm_vcpu_dabt_iswrite(const struct kvm_vcpu *vcpu)
+-{
+- return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_WNR);
+-}
+-
+ static inline bool kvm_vcpu_dabt_issext(const struct kvm_vcpu *vcpu)
+ {
+ return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_SSE);
+@@ -192,6 +187,12 @@ static inline bool kvm_vcpu_dabt_iss1tw(const struct kvm_vcpu *vcpu)
+ return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_S1PTW);
+ }
+
++static inline bool kvm_vcpu_dabt_iswrite(const struct kvm_vcpu *vcpu)
++{
++ return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_WNR) ||
++ kvm_vcpu_dabt_iss1tw(vcpu); /* AF/DBM update */
++}
++
+ static inline bool kvm_vcpu_dabt_is_cm(const struct kvm_vcpu *vcpu)
+ {
+ return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_CM);
+diff --git a/arch/arm64/include/asm/module.h b/arch/arm64/include/asm/module.h
+index e12af67..06ff7fd 100644
+--- a/arch/arm64/include/asm/module.h
++++ b/arch/arm64/include/asm/module.h
+@@ -17,6 +17,7 @@
+ #define __ASM_MODULE_H
+
+ #include <asm-generic/module.h>
++#include <asm/memory.h>
+
+ #define MODULE_ARCH_VERMAGIC "aarch64"
+
+@@ -32,6 +33,10 @@ u64 module_emit_plt_entry(struct module *mod, const Elf64_Rela *rela,
+ Elf64_Sym *sym);
+
+ #ifdef CONFIG_RANDOMIZE_BASE
++#ifdef CONFIG_MODVERSIONS
++#define ARCH_RELOCATES_KCRCTAB
++#define reloc_start (kimage_vaddr - KIMAGE_VADDR)
++#endif
+ extern u64 module_alloc_base;
+ #else
+ #define module_alloc_base ((u64)_etext - MODULES_VSIZE)
+diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
+index 2fee2f5..5394c84 100644
+--- a/arch/arm64/include/asm/percpu.h
++++ b/arch/arm64/include/asm/percpu.h
+@@ -44,48 +44,44 @@ static inline unsigned long __percpu_##op(void *ptr, \
+ \
+ switch (size) { \
+ case 1: \
+- do { \
+- asm ("//__per_cpu_" #op "_1\n" \
+- "ldxrb %w[ret], %[ptr]\n" \
++ asm ("//__per_cpu_" #op "_1\n" \
++ "1: ldxrb %w[ret], %[ptr]\n" \
+ #asm_op " %w[ret], %w[ret], %w[val]\n" \
+- "stxrb %w[loop], %w[ret], %[ptr]\n" \
+- : [loop] "=&r" (loop), [ret] "=&r" (ret), \
+- [ptr] "+Q"(*(u8 *)ptr) \
+- : [val] "Ir" (val)); \
+- } while (loop); \
++ " stxrb %w[loop], %w[ret], %[ptr]\n" \
++ " cbnz %w[loop], 1b" \
++ : [loop] "=&r" (loop), [ret] "=&r" (ret), \
++ [ptr] "+Q"(*(u8 *)ptr) \
++ : [val] "Ir" (val)); \
+ break; \
+ case 2: \
+- do { \
+- asm ("//__per_cpu_" #op "_2\n" \
+- "ldxrh %w[ret], %[ptr]\n" \
++ asm ("//__per_cpu_" #op "_2\n" \
++ "1: ldxrh %w[ret], %[ptr]\n" \
+ #asm_op " %w[ret], %w[ret], %w[val]\n" \
+- "stxrh %w[loop], %w[ret], %[ptr]\n" \
+- : [loop] "=&r" (loop), [ret] "=&r" (ret), \
+- [ptr] "+Q"(*(u16 *)ptr) \
+- : [val] "Ir" (val)); \
+- } while (loop); \
++ " stxrh %w[loop], %w[ret], %[ptr]\n" \
++ " cbnz %w[loop], 1b" \
++ : [loop] "=&r" (loop), [ret] "=&r" (ret), \
++ [ptr] "+Q"(*(u16 *)ptr) \
++ : [val] "Ir" (val)); \
+ break; \
+ case 4: \
+- do { \
+- asm ("//__per_cpu_" #op "_4\n" \
+- "ldxr %w[ret], %[ptr]\n" \
++ asm ("//__per_cpu_" #op "_4\n" \
++ "1: ldxr %w[ret], %[ptr]\n" \
+ #asm_op " %w[ret], %w[ret], %w[val]\n" \
+- "stxr %w[loop], %w[ret], %[ptr]\n" \
+- : [loop] "=&r" (loop), [ret] "=&r" (ret), \
+- [ptr] "+Q"(*(u32 *)ptr) \
+- : [val] "Ir" (val)); \
+- } while (loop); \
++ " stxr %w[loop], %w[ret], %[ptr]\n" \
++ " cbnz %w[loop], 1b" \
++ : [loop] "=&r" (loop), [ret] "=&r" (ret), \
++ [ptr] "+Q"(*(u32 *)ptr) \
++ : [val] "Ir" (val)); \
+ break; \
+ case 8: \
+- do { \
+- asm ("//__per_cpu_" #op "_8\n" \
+- "ldxr %[ret], %[ptr]\n" \
++ asm ("//__per_cpu_" #op "_8\n" \
++ "1: ldxr %[ret], %[ptr]\n" \
+ #asm_op " %[ret], %[ret], %[val]\n" \
+- "stxr %w[loop], %[ret], %[ptr]\n" \
+- : [loop] "=&r" (loop), [ret] "=&r" (ret), \
+- [ptr] "+Q"(*(u64 *)ptr) \
+- : [val] "Ir" (val)); \
+- } while (loop); \
++ " stxr %w[loop], %[ret], %[ptr]\n" \
++ " cbnz %w[loop], 1b" \
++ : [loop] "=&r" (loop), [ret] "=&r" (ret), \
++ [ptr] "+Q"(*(u64 *)ptr) \
++ : [val] "Ir" (val)); \
+ break; \
+ default: \
+ BUILD_BUG(); \
+@@ -150,44 +146,40 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
+
+ switch (size) {
+ case 1:
+- do {
+- asm ("//__percpu_xchg_1\n"
+- "ldxrb %w[ret], %[ptr]\n"
+- "stxrb %w[loop], %w[val], %[ptr]\n"
+- : [loop] "=&r"(loop), [ret] "=&r"(ret),
+- [ptr] "+Q"(*(u8 *)ptr)
+- : [val] "r" (val));
+- } while (loop);
++ asm ("//__percpu_xchg_1\n"
++ "1: ldxrb %w[ret], %[ptr]\n"
++ " stxrb %w[loop], %w[val], %[ptr]\n"
++ " cbnz %w[loop], 1b"
++ : [loop] "=&r"(loop), [ret] "=&r"(ret),
++ [ptr] "+Q"(*(u8 *)ptr)
++ : [val] "r" (val));
+ break;
+ case 2:
+- do {
+- asm ("//__percpu_xchg_2\n"
+- "ldxrh %w[ret], %[ptr]\n"
+- "stxrh %w[loop], %w[val], %[ptr]\n"
+- : [loop] "=&r"(loop), [ret] "=&r"(ret),
+- [ptr] "+Q"(*(u16 *)ptr)
+- : [val] "r" (val));
+- } while (loop);
++ asm ("//__percpu_xchg_2\n"
++ "1: ldxrh %w[ret], %[ptr]\n"
++ " stxrh %w[loop], %w[val], %[ptr]\n"
++ " cbnz %w[loop], 1b"
++ : [loop] "=&r"(loop), [ret] "=&r"(ret),
++ [ptr] "+Q"(*(u16 *)ptr)
++ : [val] "r" (val));
+ break;
+ case 4:
+- do {
+- asm ("//__percpu_xchg_4\n"
+- "ldxr %w[ret], %[ptr]\n"
+- "stxr %w[loop], %w[val], %[ptr]\n"
+- : [loop] "=&r"(loop), [ret] "=&r"(ret),
+- [ptr] "+Q"(*(u32 *)ptr)
+- : [val] "r" (val));
+- } while (loop);
++ asm ("//__percpu_xchg_4\n"
++ "1: ldxr %w[ret], %[ptr]\n"
++ " stxr %w[loop], %w[val], %[ptr]\n"
++ " cbnz %w[loop], 1b"
++ : [loop] "=&r"(loop), [ret] "=&r"(ret),
++ [ptr] "+Q"(*(u32 *)ptr)
++ : [val] "r" (val));
+ break;
+ case 8:
+- do {
+- asm ("//__percpu_xchg_8\n"
+- "ldxr %[ret], %[ptr]\n"
+- "stxr %w[loop], %[val], %[ptr]\n"
+- : [loop] "=&r"(loop), [ret] "=&r"(ret),
+- [ptr] "+Q"(*(u64 *)ptr)
+- : [val] "r" (val));
+- } while (loop);
++ asm ("//__percpu_xchg_8\n"
++ "1: ldxr %[ret], %[ptr]\n"
++ " stxr %w[loop], %[val], %[ptr]\n"
++ " cbnz %w[loop], 1b"
++ : [loop] "=&r"(loop), [ret] "=&r"(ret),
++ [ptr] "+Q"(*(u64 *)ptr)
++ : [val] "r" (val));
+ break;
+ default:
+ BUILD_BUG();
+diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
+index c47257c..db84983 100644
+--- a/arch/arm64/include/asm/uaccess.h
++++ b/arch/arm64/include/asm/uaccess.h
+@@ -21,6 +21,7 @@
+ /*
+ * User space memory access functions
+ */
++#include <linux/bitops.h>
+ #include <linux/kasan-checks.h>
+ #include <linux/string.h>
+ #include <linux/thread_info.h>
+@@ -102,6 +103,13 @@ static inline void set_fs(mm_segment_t fs)
+ flag; \
+ })
+
++/*
++ * When dealing with data aborts or instruction traps we may end up with
++ * a tagged userland pointer. Clear the tag to get a sane pointer to pass
++ * on to access_ok(), for instance.
++ */
++#define untagged_addr(addr) sign_extend64(addr, 55)
++
+ #define access_ok(type, addr, size) __range_ok(addr, size)
+ #define user_addr_max get_fs
+
+diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
+index 42ffdb5..b0988bb 100644
+--- a/arch/arm64/kernel/armv8_deprecated.c
++++ b/arch/arm64/kernel/armv8_deprecated.c
+@@ -280,35 +280,43 @@ static void __init register_insn_emulation_sysctl(struct ctl_table *table)
+ /*
+ * Error-checking SWP macros implemented using ldxr{b}/stxr{b}
+ */
+-#define __user_swpX_asm(data, addr, res, temp, B) \
++
++/* Arbitrary constant to ensure forward-progress of the LL/SC loop */
++#define __SWP_LL_SC_LOOPS 4
++
++#define __user_swpX_asm(data, addr, res, temp, temp2, B) \
+ __asm__ __volatile__( \
++ " mov %w3, %w7\n" \
+ ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, \
+ CONFIG_ARM64_PAN) \
+- "0: ldxr"B" %w2, [%3]\n" \
+- "1: stxr"B" %w0, %w1, [%3]\n" \
++ "0: ldxr"B" %w2, [%4]\n" \
++ "1: stxr"B" %w0, %w1, [%4]\n" \
+ " cbz %w0, 2f\n" \
+- " mov %w0, %w4\n" \
++ " sub %w3, %w3, #1\n" \
++ " cbnz %w3, 0b\n" \
++ " mov %w0, %w5\n" \
+ " b 3f\n" \
+ "2:\n" \
+ " mov %w1, %w2\n" \
+ "3:\n" \
+ " .pushsection .fixup,\"ax\"\n" \
+ " .align 2\n" \
+- "4: mov %w0, %w5\n" \
++ "4: mov %w0, %w6\n" \
+ " b 3b\n" \
+ " .popsection" \
+ _ASM_EXTABLE(0b, 4b) \
+ _ASM_EXTABLE(1b, 4b) \
+ ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, \
+ CONFIG_ARM64_PAN) \
+- : "=&r" (res), "+r" (data), "=&r" (temp) \
+- : "r" (addr), "i" (-EAGAIN), "i" (-EFAULT) \
++ : "=&r" (res), "+r" (data), "=&r" (temp), "=&r" (temp2) \
++ : "r" (addr), "i" (-EAGAIN), "i" (-EFAULT), \
++ "i" (__SWP_LL_SC_LOOPS) \
+ : "memory")
+
+-#define __user_swp_asm(data, addr, res, temp) \
+- __user_swpX_asm(data, addr, res, temp, "")
+-#define __user_swpb_asm(data, addr, res, temp) \
+- __user_swpX_asm(data, addr, res, temp, "b")
++#define __user_swp_asm(data, addr, res, temp, temp2) \
++ __user_swpX_asm(data, addr, res, temp, temp2, "")
++#define __user_swpb_asm(data, addr, res, temp, temp2) \
++ __user_swpX_asm(data, addr, res, temp, temp2, "b")
+
+ /*
+ * Bit 22 of the instruction encoding distinguishes between
+@@ -328,12 +336,12 @@ static int emulate_swpX(unsigned int address, unsigned int *data,
+ }
+
+ while (1) {
+- unsigned long temp;
++ unsigned long temp, temp2;
+
+ if (type == TYPE_SWPB)
+- __user_swpb_asm(*data, address, res, temp);
++ __user_swpb_asm(*data, address, res, temp, temp2);
+ else
+- __user_swp_asm(*data, address, res, temp);
++ __user_swp_asm(*data, address, res, temp, temp2);
+
+ if (likely(res != -EAGAIN) || signal_pending(current))
+ break;
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index 3e7b050..4d19508 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -578,8 +578,9 @@ CPU_LE( movk x0, #0x30d0, lsl #16 ) // Clear EE and E0E on LE systems
+ b.lt 4f // Skip if no PMU present
+ mrs x0, pmcr_el0 // Disable debug access traps
+ ubfx x0, x0, #11, #5 // to EL2 and allow access to
+- msr mdcr_el2, x0 // all PMU counters from EL1
+ 4:
++ csel x0, xzr, x0, lt // all PMU counters from EL1
++ msr mdcr_el2, x0 // (if they exist)
+
+ /* Stage-2 translation */
+ msr vttbr_el2, xzr
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index df06750..771a01a7f 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -434,18 +434,21 @@ void cpu_enable_cache_maint_trap(void *__unused)
+ }
+
+ #define __user_cache_maint(insn, address, res) \
+- asm volatile ( \
+- "1: " insn ", %1\n" \
+- " mov %w0, #0\n" \
+- "2:\n" \
+- " .pushsection .fixup,\"ax\"\n" \
+- " .align 2\n" \
+- "3: mov %w0, %w2\n" \
+- " b 2b\n" \
+- " .popsection\n" \
+- _ASM_EXTABLE(1b, 3b) \
+- : "=r" (res) \
+- : "r" (address), "i" (-EFAULT) )
++ if (untagged_addr(address) >= user_addr_max()) \
++ res = -EFAULT; \
++ else \
++ asm volatile ( \
++ "1: " insn ", %1\n" \
++ " mov %w0, #0\n" \
++ "2:\n" \
++ " .pushsection .fixup,\"ax\"\n" \
++ " .align 2\n" \
++ "3: mov %w0, %w2\n" \
++ " b 2b\n" \
++ " .popsection\n" \
++ _ASM_EXTABLE(1b, 3b) \
++ : "=r" (res) \
++ : "r" (address), "i" (-EFAULT) )
+
+ asmlinkage void __exception do_sysinstr(unsigned int esr, struct pt_regs *regs)
+ {
+diff --git a/arch/arm64/kvm/hyp/entry.S b/arch/arm64/kvm/hyp/entry.S
+index ce9e5e5..eaf08d3 100644
+--- a/arch/arm64/kvm/hyp/entry.S
++++ b/arch/arm64/kvm/hyp/entry.S
+@@ -98,6 +98,8 @@ ENTRY(__guest_exit)
+ // x4-x29,lr: vcpu regs
+ // vcpu x0-x3 on the stack
+
++ ALTERNATIVE(nop, SET_PSTATE_PAN(1), ARM64_HAS_PAN, CONFIG_ARM64_PAN)
++
+ add x2, x0, #VCPU_CONTEXT
+
+ stp x4, x5, [x2, #CPU_XREG_OFFSET(4)]
+diff --git a/arch/metag/include/asm/atomic.h b/arch/metag/include/asm/atomic.h
+index 470e365..8ff0a70 100644
+--- a/arch/metag/include/asm/atomic.h
++++ b/arch/metag/include/asm/atomic.h
+@@ -39,11 +39,10 @@
+ #define atomic_dec(v) atomic_sub(1, (v))
+
+ #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
++#define atomic_dec_if_positive(v) atomic_sub_if_positive(1, v)
+
+ #endif
+
+-#define atomic_dec_if_positive(v) atomic_sub_if_positive(1, v)
+-
+ #include <asm-generic/atomic64.h>
+
+ #endif /* __ASM_METAG_ATOMIC_H */
+diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h
+index f6fc6aa..b657861 100644
+--- a/arch/mips/include/asm/ptrace.h
++++ b/arch/mips/include/asm/ptrace.h
+@@ -152,7 +152,7 @@ static inline int is_syscall_success(struct pt_regs *regs)
+
+ static inline long regs_return_value(struct pt_regs *regs)
+ {
+- if (is_syscall_success(regs))
++ if (is_syscall_success(regs) || !user_mode(regs))
+ return regs->regs[2];
+ else
+ return -regs->regs[2];
+diff --git a/arch/mips/vdso/Makefile b/arch/mips/vdso/Makefile
+index 3b4538e..de9e8836 100644
+--- a/arch/mips/vdso/Makefile
++++ b/arch/mips/vdso/Makefile
+@@ -82,7 +82,7 @@ obj-vdso := $(obj-vdso-y:%.o=$(obj)/%.o)
+ $(obj-vdso): KBUILD_CFLAGS := $(cflags-vdso) $(native-abi)
+ $(obj-vdso): KBUILD_AFLAGS := $(aflags-vdso) $(native-abi)
+
+-$(obj)/vdso.lds: KBUILD_CPPFLAGS := $(native-abi)
++$(obj)/vdso.lds: KBUILD_CPPFLAGS := $(ccflags-vdso) $(native-abi)
+
+ $(obj)/vdso.so.dbg.raw: $(obj)/vdso.lds $(obj-vdso) FORCE
+ $(call if_changed,vdsold)
+diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
+index 291cee2..c2c43f7 100644
+--- a/arch/parisc/include/asm/pgtable.h
++++ b/arch/parisc/include/asm/pgtable.h
+@@ -83,10 +83,10 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+ printk("%s:%d: bad pgd %08lx.\n", __FILE__, __LINE__, (unsigned long)pgd_val(e))
+
+ /* This is the size of the initially mapped kernel memory */
+-#ifdef CONFIG_64BIT
+-#define KERNEL_INITIAL_ORDER 25 /* 1<<25 = 32MB */
++#if defined(CONFIG_64BIT)
++#define KERNEL_INITIAL_ORDER 26 /* 1<<26 = 64MB */
+ #else
+-#define KERNEL_INITIAL_ORDER 24 /* 1<<24 = 16MB */
++#define KERNEL_INITIAL_ORDER 25 /* 1<<25 = 32MB */
+ #endif
+ #define KERNEL_INITIAL_SIZE (1 << KERNEL_INITIAL_ORDER)
+
+diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c
+index f7ea626..81d6f63 100644
+--- a/arch/parisc/kernel/setup.c
++++ b/arch/parisc/kernel/setup.c
+@@ -38,6 +38,7 @@
+ #include <linux/export.h>
+
+ #include <asm/processor.h>
++#include <asm/sections.h>
+ #include <asm/pdc.h>
+ #include <asm/led.h>
+ #include <asm/machdep.h> /* for pa7300lc_init() proto */
+@@ -140,6 +141,13 @@ void __init setup_arch(char **cmdline_p)
+ #endif
+ printk(KERN_CONT ".\n");
+
++ /*
++ * Check if initial kernel page mappings are sufficient.
++ * panic early if not, else we may access kernel functions
++ * and variables which can't be reached.
++ */
++ if (__pa((unsigned long) &_end) >= KERNEL_INITIAL_SIZE)
++ panic("KERNEL_INITIAL_ORDER too small!");
+
+ pdc_console_init();
+
+diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
+index 4b0b963..9b63b87 100644
+--- a/arch/parisc/kernel/time.c
++++ b/arch/parisc/kernel/time.c
+@@ -226,12 +226,6 @@ void __init start_cpu_itimer(void)
+ unsigned int cpu = smp_processor_id();
+ unsigned long next_tick = mfctl(16) + clocktick;
+
+-#if defined(CONFIG_HAVE_UNSTABLE_SCHED_CLOCK) && defined(CONFIG_64BIT)
+- /* With multiple 64bit CPUs online, the cr16's are not syncronized. */
+- if (cpu != 0)
+- clear_sched_clock_stable();
+-#endif
+-
+ mtctl(next_tick, 16); /* kick off Interval Timer (CR16) */
+
+ per_cpu(cpu_data, cpu).it_value = next_tick;
+diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
+index f3ead0b..75304af 100644
+--- a/arch/parisc/kernel/vmlinux.lds.S
++++ b/arch/parisc/kernel/vmlinux.lds.S
+@@ -89,8 +89,9 @@ SECTIONS
+ /* Start of data section */
+ _sdata = .;
+
+- RO_DATA_SECTION(8)
+-
++ /* Architecturally we need to keep __gp below 0x1000000 and thus
++ * in front of RO_DATA_SECTION() which stores lots of tracepoint
++ * and ftrace symbols. */
+ #ifdef CONFIG_64BIT
+ . = ALIGN(16);
+ /* Linkage tables */
+@@ -105,6 +106,8 @@ SECTIONS
+ }
+ #endif
+
++ RO_DATA_SECTION(8)
++
+ /* unwind info */
+ .PARISC.unwind : {
+ __start___unwind = .;
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index 927d2ab..792cb17 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -637,7 +637,7 @@ config FORCE_MAX_ZONEORDER
+ int "Maximum zone order"
+ range 8 9 if PPC64 && PPC_64K_PAGES
+ default "9" if PPC64 && PPC_64K_PAGES
+- range 9 13 if PPC64 && !PPC_64K_PAGES
++ range 13 13 if PPC64 && !PPC_64K_PAGES
+ default "13" if PPC64 && !PPC_64K_PAGES
+ range 9 64 if PPC32 && PPC_16K_PAGES
+ default "9" if PPC32 && PPC_16K_PAGES
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index 5f36e8a..29aa8d1 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -994,6 +994,14 @@ static void eeh_handle_special_event(void)
+ /* Notify all devices to be down */
+ eeh_pe_state_clear(pe, EEH_PE_PRI_BUS);
+ bus = eeh_pe_bus_get(phb_pe);
++ if (!bus) {
++ pr_err("%s: Cannot find PCI bus for "
++ "PHB#%d-PE#%x\n",
++ __func__,
++ pe->phb->global_number,
++ pe->addr);
++ break;
++ }
+ eeh_pe_dev_traverse(pe,
+ eeh_report_failure, NULL);
+ pci_hp_remove_devices(bus);
+diff --git a/arch/powerpc/kernel/vdso64/datapage.S b/arch/powerpc/kernel/vdso64/datapage.S
+index 184a6ba..abf17fe 100644
+--- a/arch/powerpc/kernel/vdso64/datapage.S
++++ b/arch/powerpc/kernel/vdso64/datapage.S
+@@ -59,7 +59,7 @@ V_FUNCTION_BEGIN(__kernel_get_syscall_map)
+ bl V_LOCAL_FUNC(__get_datapage)
+ mtlr r12
+ addi r3,r3,CFG_SYSCALL_MAP64
+- cmpli cr0,r4,0
++ cmpldi cr0,r4,0
+ crclr cr0*4+so
+ beqlr
+ li r0,NR_syscalls
+diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
+index a76b4af..3820213 100644
+--- a/arch/powerpc/kernel/vdso64/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
+@@ -145,7 +145,7 @@ V_FUNCTION_BEGIN(__kernel_clock_getres)
+ bne cr0,99f
+
+ li r3,0
+- cmpli cr0,r4,0
++ cmpldi cr0,r4,0
+ crclr cr0*4+so
+ beqlr
+ lis r5,CLOCK_REALTIME_RES@h
+diff --git a/arch/powerpc/lib/copyuser_64.S b/arch/powerpc/lib/copyuser_64.S
+index f09899e..7b22624 100644
+--- a/arch/powerpc/lib/copyuser_64.S
++++ b/arch/powerpc/lib/copyuser_64.S
+@@ -359,6 +359,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
+ addi r3,r3,8
+ 171:
+ 177:
++179:
+ addi r3,r3,8
+ 370:
+ 372:
+@@ -373,7 +374,6 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
+ 173:
+ 174:
+ 175:
+-179:
+ 181:
+ 184:
+ 186:
+diff --git a/arch/powerpc/mm/copro_fault.c b/arch/powerpc/mm/copro_fault.c
+index bb03542..362954f 100644
+--- a/arch/powerpc/mm/copro_fault.c
++++ b/arch/powerpc/mm/copro_fault.c
+@@ -106,6 +106,8 @@ int copro_calculate_slb(struct mm_struct *mm, u64 ea, struct copro_slb *slb)
+ switch (REGION_ID(ea)) {
+ case USER_REGION_ID:
+ pr_devel("%s: 0x%llx -- USER_REGION_ID\n", __func__, ea);
++ if (mm == NULL)
++ return 1;
+ psize = get_slice_psize(mm, ea);
+ ssize = user_segment_size(ea);
+ vsid = get_vsid(mm->context.id, ea, ssize);
+diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
+index 0821556..28923b2 100644
+--- a/arch/powerpc/mm/hash_utils_64.c
++++ b/arch/powerpc/mm/hash_utils_64.c
+@@ -526,7 +526,7 @@ static bool might_have_hea(void)
+ */
+ #ifdef CONFIG_IBMEBUS
+ return !cpu_has_feature(CPU_FTR_ARCH_207S) &&
+- !firmware_has_feature(FW_FEATURE_SPLPAR);
++ firmware_has_feature(FW_FEATURE_SPLPAR);
+ #else
+ return false;
+ #endif
+diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
+index 86544ea..ba17fdd 100644
+--- a/arch/powerpc/platforms/powernv/eeh-powernv.c
++++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
+@@ -1091,6 +1091,11 @@ static int pnv_eeh_reset(struct eeh_pe *pe, int option)
+ }
+
+ bus = eeh_pe_bus_get(pe);
++ if (!bus) {
++ pr_err("%s: Cannot find PCI bus for PHB#%d-PE#%x\n",
++ __func__, pe->phb->global_number, pe->addr);
++ return -EIO;
++ }
+ if (pe->type & EEH_PE_VF)
+ return pnv_eeh_reset_vf_pe(pe, option);
+
+@@ -1306,7 +1311,7 @@ static void pnv_eeh_get_and_dump_hub_diag(struct pci_controller *hose)
+ return;
+ }
+
+- switch (data->type) {
++ switch (be16_to_cpu(data->type)) {
+ case OPAL_P7IOC_DIAG_TYPE_RGC:
+ pr_info("P7IOC diag-data for RGC\n\n");
+ pnv_eeh_dump_hub_diag_common(data);
+@@ -1538,7 +1543,7 @@ static int pnv_eeh_next_error(struct eeh_pe **pe)
+
+ /* Try best to clear it */
+ opal_pci_eeh_freeze_clear(phb->opal_id,
+- frozen_pe_no,
++ be64_to_cpu(frozen_pe_no),
+ OPAL_EEH_ACTION_CLEAR_FREEZE_ALL);
+ ret = EEH_NEXT_ERR_NONE;
+ } else if ((*pe)->state & EEH_PE_ISOLATED ||
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index a21d831..0fe3520 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -309,8 +309,8 @@ static void pnv_pci_dump_p7ioc_diag_data(struct pci_controller *hose,
+ be64_to_cpu(data->dma1ErrorLog1));
+
+ for (i = 0; i < OPAL_P7IOC_NUM_PEST_REGS; i++) {
+- if ((data->pestA[i] >> 63) == 0 &&
+- (data->pestB[i] >> 63) == 0)
++ if ((be64_to_cpu(data->pestA[i]) >> 63) == 0 &&
++ (be64_to_cpu(data->pestB[i]) >> 63) == 0)
+ continue;
+
+ pr_info("PE[%3d] A/B: %016llx %016llx\n",
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index 86707e6..aa35245 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -393,7 +393,7 @@ static void __pSeries_lpar_hugepage_invalidate(unsigned long *slot,
+ unsigned long *vpn, int count,
+ int psize, int ssize)
+ {
+- unsigned long param[8];
++ unsigned long param[PLPAR_HCALL9_BUFSIZE];
+ int i = 0, pix = 0, rc;
+ unsigned long flags = 0;
+ int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
+@@ -522,7 +522,7 @@ static void pSeries_lpar_flush_hash_range(unsigned long number, int local)
+ unsigned long flags = 0;
+ struct ppc64_tlb_batch *batch = this_cpu_ptr(&ppc64_tlb_batch);
+ int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
+- unsigned long param[9];
++ unsigned long param[PLPAR_HCALL9_BUFSIZE];
+ unsigned long hash, index, shift, hidx, slot;
+ real_pte_t pte;
+ int psize, ssize;
+diff --git a/arch/powerpc/sysdev/cpm1.c b/arch/powerpc/sysdev/cpm1.c
+index 81d4947..82e8e2b 100644
+--- a/arch/powerpc/sysdev/cpm1.c
++++ b/arch/powerpc/sysdev/cpm1.c
+@@ -233,8 +233,6 @@ void __init cpm_reset(void)
+ else
+ out_be32(&siu_conf->sc_sdcr, 1);
+ immr_unmap(siu_conf);
+-
+- cpm_muram_init();
+ }
+
+ static DEFINE_SPINLOCK(cmd_lock);
+diff --git a/arch/powerpc/sysdev/cpm2.c b/arch/powerpc/sysdev/cpm2.c
+index 8dc1e24..f78ff84 100644
+--- a/arch/powerpc/sysdev/cpm2.c
++++ b/arch/powerpc/sysdev/cpm2.c
+@@ -66,10 +66,6 @@ void __init cpm2_reset(void)
+ cpm2_immr = ioremap(get_immrbase(), CPM_MAP_SIZE);
+ #endif
+
+- /* Reclaim the DP memory for our use.
+- */
+- cpm_muram_init();
+-
+ /* Tell everyone where the comm processor resides.
+ */
+ cpmp = &cpm2_immr->im_cpm;
+diff --git a/arch/powerpc/sysdev/cpm_common.c b/arch/powerpc/sysdev/cpm_common.c
+index 947f420..51bf749 100644
+--- a/arch/powerpc/sysdev/cpm_common.c
++++ b/arch/powerpc/sysdev/cpm_common.c
+@@ -37,6 +37,21 @@
+ #include <linux/of_gpio.h>
+ #endif
+
++static int __init cpm_init(void)
++{
++ struct device_node *np;
++
++ np = of_find_compatible_node(NULL, NULL, "fsl,cpm1");
++ if (!np)
++ np = of_find_compatible_node(NULL, NULL, "fsl,cpm2");
++ if (!np)
++ return -ENODEV;
++ cpm_muram_init();
++ of_node_put(np);
++ return 0;
++}
++subsys_initcall(cpm_init);
++
+ #ifdef CONFIG_PPC_EARLY_DEBUG_CPM
+ static u32 __iomem *cpm_udbg_txdesc;
+ static u8 __iomem *cpm_udbg_txbuf;
+diff --git a/arch/powerpc/xmon/spr_access.S b/arch/powerpc/xmon/spr_access.S
+index 84ad742..7d8b0e8 100644
+--- a/arch/powerpc/xmon/spr_access.S
++++ b/arch/powerpc/xmon/spr_access.S
+@@ -2,12 +2,12 @@
+
+ /* unsigned long xmon_mfspr(sprn, default_value) */
+ _GLOBAL(xmon_mfspr)
+- ld r5, .Lmfspr_table@got(r2)
++ PPC_LL r5, .Lmfspr_table@got(r2)
+ b xmon_mxspr
+
+ /* void xmon_mtspr(sprn, new_value) */
+ _GLOBAL(xmon_mtspr)
+- ld r5, .Lmtspr_table@got(r2)
++ PPC_LL r5, .Lmtspr_table@got(r2)
+ b xmon_mxspr
+
+ /*
+diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
+index dfd0ca2..9746b78 100644
+--- a/arch/s390/kvm/intercept.c
++++ b/arch/s390/kvm/intercept.c
+@@ -118,8 +118,13 @@ static int handle_validity(struct kvm_vcpu *vcpu)
+
+ vcpu->stat.exit_validity++;
+ trace_kvm_s390_intercept_validity(vcpu, viwhy);
+- WARN_ONCE(true, "kvm: unhandled validity intercept 0x%x\n", viwhy);
+- return -EOPNOTSUPP;
++ KVM_EVENT(3, "validity intercept 0x%x for pid %u (kvm 0x%pK)", viwhy,
++ current->pid, vcpu->kvm);
++
++ /* do not warn on invalid runtime instrumentation mode */
++ WARN_ONCE(viwhy != 0x44, "kvm: unhandled validity intercept 0x%x\n",
++ viwhy);
++ return -EINVAL;
+ }
+
+ static int handle_instruction(struct kvm_vcpu *vcpu)
+diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
+index 8a90f15..625eb69 100644
+--- a/arch/x86/kernel/e820.c
++++ b/arch/x86/kernel/e820.c
+@@ -348,7 +348,7 @@ int __init sanitize_e820_map(struct e820entry *biosmap, int max_nr_map,
+ * continue building up new bios map based on this
+ * information
+ */
+- if (current_type != last_type) {
++ if (current_type != last_type || current_type == E820_PRAM) {
+ if (last_type != 0) {
+ new_bios[new_bios_entry].size =
+ change_point[chgidx]->addr - last_addr;
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 82b1737..9e152cd 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -1408,15 +1408,17 @@ __init void prefill_possible_map(void)
+
+ /* No boot processor was found in mptable or ACPI MADT */
+ if (!num_processors) {
+- int apicid = boot_cpu_physical_apicid;
+- int cpu = hard_smp_processor_id();
++ if (boot_cpu_has(X86_FEATURE_APIC)) {
++ int apicid = boot_cpu_physical_apicid;
++ int cpu = hard_smp_processor_id();
+
+- pr_warn("Boot CPU (id %d) not listed by BIOS\n", cpu);
++ pr_warn("Boot CPU (id %d) not listed by BIOS\n", cpu);
+
+- /* Make sure boot cpu is enumerated */
+- if (apic->cpu_present_to_apicid(0) == BAD_APICID &&
+- apic->apic_id_valid(apicid))
+- generic_processor_info(apicid, boot_cpu_apic_version);
++ /* Make sure boot cpu is enumerated */
++ if (apic->cpu_present_to_apicid(0) == BAD_APICID &&
++ apic->apic_id_valid(apicid))
++ generic_processor_info(apicid, boot_cpu_apic_version);
++ }
+
+ if (!num_processors)
+ num_processors = 1;
+diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
+index c7220ba..1a22de7 100644
+--- a/arch/x86/kvm/ioapic.c
++++ b/arch/x86/kvm/ioapic.c
+@@ -594,7 +594,7 @@ static void kvm_ioapic_reset(struct kvm_ioapic *ioapic)
+ ioapic->irr = 0;
+ ioapic->irr_delivered = 0;
+ ioapic->id = 0;
+- memset(ioapic->irq_eoi, 0x00, IOAPIC_NUM_PINS);
++ memset(ioapic->irq_eoi, 0x00, sizeof(ioapic->irq_eoi));
+ rtc_irq_eoi_tracking_reset(ioapic);
+ }
+
+diff --git a/arch/x86/platform/uv/bios_uv.c b/arch/x86/platform/uv/bios_uv.c
+index 23f2f3e..58e152b 100644
+--- a/arch/x86/platform/uv/bios_uv.c
++++ b/arch/x86/platform/uv/bios_uv.c
+@@ -40,7 +40,15 @@ s64 uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, u64 a4, u64 a5)
+ */
+ return BIOS_STATUS_UNIMPLEMENTED;
+
+- ret = efi_call_virt_pointer(tab, function, (u64)which, a1, a2, a3, a4, a5);
++ /*
++ * If EFI_OLD_MEMMAP is set, we need to fall back to using our old EFI
++ * callback method, which uses efi_call() directly, with the kernel page tables:
++ */
++ if (unlikely(test_bit(EFI_OLD_MEMMAP, &efi.flags)))
++ ret = efi_call((void *)__va(tab->function), (u64)which, a1, a2, a3, a4, a5);
++ else
++ ret = efi_call_virt_pointer(tab, function, (u64)which, a1, a2, a3, a4, a5);
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(uv_bios_call);
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index dd38e5c..b08ccbb 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -1340,10 +1340,8 @@ int blkcg_policy_register(struct blkcg_policy *pol)
+ struct blkcg_policy_data *cpd;
+
+ cpd = pol->cpd_alloc_fn(GFP_KERNEL);
+- if (!cpd) {
+- mutex_unlock(&blkcg_pol_mutex);
++ if (!cpd)
+ goto err_free_cpds;
+- }
+
+ blkcg->cpd[pol->plid] = cpd;
+ cpd->blkcg = blkcg;
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index 6482d47..d557229 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -97,7 +97,7 @@ int platform_get_irq(struct platform_device *dev, unsigned int num)
+ int ret;
+
+ ret = of_irq_get(dev->dev.of_node, num);
+- if (ret >= 0 || ret == -EPROBE_DEFER)
++ if (ret > 0 || ret == -EPROBE_DEFER)
+ return ret;
+ }
+
+@@ -175,7 +175,7 @@ int platform_get_irq_byname(struct platform_device *dev, const char *name)
+ int ret;
+
+ ret = of_irq_get_byname(dev->dev.of_node, name);
+- if (ret >= 0 || ret == -EPROBE_DEFER)
++ if (ret > 0 || ret == -EPROBE_DEFER)
+ return ret;
+ }
+
+diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
+index ba1c1ae..ce8ea10 100644
+--- a/drivers/clk/imx/clk-imx6q.c
++++ b/drivers/clk/imx/clk-imx6q.c
+@@ -318,11 +318,16 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ clk[IMX6QDL_CLK_IPG_PER_SEL] = imx_clk_mux("ipg_per_sel", base + 0x1c, 6, 1, ipg_per_sels, ARRAY_SIZE(ipg_per_sels));
+ clk[IMX6QDL_CLK_UART_SEL] = imx_clk_mux("uart_sel", base + 0x24, 6, 1, uart_sels, ARRAY_SIZE(uart_sels));
+ clk[IMX6QDL_CLK_GPU2D_CORE_SEL] = imx_clk_mux("gpu2d_core_sel", base + 0x18, 16, 2, gpu2d_core_sels_2, ARRAY_SIZE(gpu2d_core_sels_2));
++ } else if (clk_on_imx6dl()) {
++ clk[IMX6QDL_CLK_MLB_SEL] = imx_clk_mux("mlb_sel", base + 0x18, 16, 2, gpu2d_core_sels, ARRAY_SIZE(gpu2d_core_sels));
+ } else {
+ clk[IMX6QDL_CLK_GPU2D_CORE_SEL] = imx_clk_mux("gpu2d_core_sel", base + 0x18, 16, 2, gpu2d_core_sels, ARRAY_SIZE(gpu2d_core_sels));
+ }
+ clk[IMX6QDL_CLK_GPU3D_CORE_SEL] = imx_clk_mux("gpu3d_core_sel", base + 0x18, 4, 2, gpu3d_core_sels, ARRAY_SIZE(gpu3d_core_sels));
+- clk[IMX6QDL_CLK_GPU3D_SHADER_SEL] = imx_clk_mux("gpu3d_shader_sel", base + 0x18, 8, 2, gpu3d_shader_sels, ARRAY_SIZE(gpu3d_shader_sels));
++ if (clk_on_imx6dl())
++ clk[IMX6QDL_CLK_GPU2D_CORE_SEL] = imx_clk_mux("gpu2d_core_sel", base + 0x18, 8, 2, gpu3d_shader_sels, ARRAY_SIZE(gpu3d_shader_sels));
++ else
++ clk[IMX6QDL_CLK_GPU3D_SHADER_SEL] = imx_clk_mux("gpu3d_shader_sel", base + 0x18, 8, 2, gpu3d_shader_sels, ARRAY_SIZE(gpu3d_shader_sels));
+ clk[IMX6QDL_CLK_IPU1_SEL] = imx_clk_mux("ipu1_sel", base + 0x3c, 9, 2, ipu_sels, ARRAY_SIZE(ipu_sels));
+ clk[IMX6QDL_CLK_IPU2_SEL] = imx_clk_mux("ipu2_sel", base + 0x3c, 14, 2, ipu_sels, ARRAY_SIZE(ipu_sels));
+ clk[IMX6QDL_CLK_LDB_DI0_SEL] = imx_clk_mux_flags("ldb_di0_sel", base + 0x2c, 9, 3, ldb_di_sels, ARRAY_SIZE(ldb_di_sels), CLK_SET_RATE_PARENT);
+@@ -400,9 +405,15 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ clk[IMX6QDL_CLK_LDB_DI0_DIV_3_5] = imx_clk_fixed_factor("ldb_di0_div_3_5", "ldb_di0_sel", 2, 7);
+ clk[IMX6QDL_CLK_LDB_DI1_DIV_3_5] = imx_clk_fixed_factor("ldb_di1_div_3_5", "ldb_di1_sel", 2, 7);
+ }
+- clk[IMX6QDL_CLK_GPU2D_CORE_PODF] = imx_clk_divider("gpu2d_core_podf", "gpu2d_core_sel", base + 0x18, 23, 3);
++ if (clk_on_imx6dl())
++ clk[IMX6QDL_CLK_MLB_PODF] = imx_clk_divider("mlb_podf", "mlb_sel", base + 0x18, 23, 3);
++ else
++ clk[IMX6QDL_CLK_GPU2D_CORE_PODF] = imx_clk_divider("gpu2d_core_podf", "gpu2d_core_sel", base + 0x18, 23, 3);
+ clk[IMX6QDL_CLK_GPU3D_CORE_PODF] = imx_clk_divider("gpu3d_core_podf", "gpu3d_core_sel", base + 0x18, 26, 3);
+- clk[IMX6QDL_CLK_GPU3D_SHADER] = imx_clk_divider("gpu3d_shader", "gpu3d_shader_sel", base + 0x18, 29, 3);
++ if (clk_on_imx6dl())
++ clk[IMX6QDL_CLK_GPU2D_CORE_PODF] = imx_clk_divider("gpu2d_core_podf", "gpu2d_core_sel", base + 0x18, 29, 3);
++ else
++ clk[IMX6QDL_CLK_GPU3D_SHADER] = imx_clk_divider("gpu3d_shader", "gpu3d_shader_sel", base + 0x18, 29, 3);
+ clk[IMX6QDL_CLK_IPU1_PODF] = imx_clk_divider("ipu1_podf", "ipu1_sel", base + 0x3c, 11, 3);
+ clk[IMX6QDL_CLK_IPU2_PODF] = imx_clk_divider("ipu2_podf", "ipu2_sel", base + 0x3c, 16, 3);
+ clk[IMX6QDL_CLK_LDB_DI0_PODF] = imx_clk_divider_flags("ldb_di0_podf", "ldb_di0_div_3_5", base + 0x20, 10, 1, 0);
+@@ -473,14 +484,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ clk[IMX6QDL_CLK_ESAI_MEM] = imx_clk_gate2_shared("esai_mem", "ahb", base + 0x6c, 16, &share_count_esai);
+ clk[IMX6QDL_CLK_GPT_IPG] = imx_clk_gate2("gpt_ipg", "ipg", base + 0x6c, 20);
+ clk[IMX6QDL_CLK_GPT_IPG_PER] = imx_clk_gate2("gpt_ipg_per", "ipg_per", base + 0x6c, 22);
+- if (clk_on_imx6dl())
+- /*
+- * The multiplexer and divider of imx6q clock gpu3d_shader get
+- * redefined/reused as gpu2d_core_sel and gpu2d_core_podf on imx6dl.
+- */
+- clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu3d_shader", base + 0x6c, 24);
+- else
+- clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu2d_core_podf", base + 0x6c, 24);
++ clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu2d_core_podf", base + 0x6c, 24);
+ clk[IMX6QDL_CLK_GPU3D_CORE] = imx_clk_gate2("gpu3d_core", "gpu3d_core_podf", base + 0x6c, 26);
+ clk[IMX6QDL_CLK_HDMI_IAHB] = imx_clk_gate2("hdmi_iahb", "ahb", base + 0x70, 0);
+ clk[IMX6QDL_CLK_HDMI_ISFR] = imx_clk_gate2("hdmi_isfr", "video_27m", base + 0x70, 4);
+@@ -511,7 +515,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ * The multiplexer and divider of the imx6q clock gpu2d get
+ * redefined/reused as mlb_sys_sel and mlb_sys_clk_podf on imx6dl.
+ */
+- clk[IMX6QDL_CLK_MLB] = imx_clk_gate2("mlb", "gpu2d_core_podf", base + 0x74, 18);
++ clk[IMX6QDL_CLK_MLB] = imx_clk_gate2("mlb", "mlb_podf", base + 0x74, 18);
+ else
+ clk[IMX6QDL_CLK_MLB] = imx_clk_gate2("mlb", "axi", base + 0x74, 18);
+ clk[IMX6QDL_CLK_MMDC_CH0_AXI] = imx_clk_gate2("mmdc_ch0_axi", "mmdc_ch0_axi_podf", base + 0x74, 20);
+@@ -629,6 +633,24 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ if (IS_ENABLED(CONFIG_PCI_IMX6))
+ clk_set_parent(clk[IMX6QDL_CLK_LVDS1_SEL], clk[IMX6QDL_CLK_SATA_REF_100M]);
+
++ /*
++ * Initialize the GPU clock muxes, so that the maximum specified clock
++ * rates for the respective SoC are not exceeded.
++ */
++ if (clk_on_imx6dl()) {
++ clk_set_parent(clk[IMX6QDL_CLK_GPU3D_CORE_SEL],
++ clk[IMX6QDL_CLK_PLL2_PFD1_594M]);
++ clk_set_parent(clk[IMX6QDL_CLK_GPU2D_CORE_SEL],
++ clk[IMX6QDL_CLK_PLL2_PFD1_594M]);
++ } else if (clk_on_imx6q()) {
++ clk_set_parent(clk[IMX6QDL_CLK_GPU3D_CORE_SEL],
++ clk[IMX6QDL_CLK_MMDC_CH0_AXI]);
++ clk_set_parent(clk[IMX6QDL_CLK_GPU3D_SHADER_SEL],
++ clk[IMX6QDL_CLK_PLL2_PFD1_594M]);
++ clk_set_parent(clk[IMX6QDL_CLK_GPU2D_CORE_SEL],
++ clk[IMX6QDL_CLK_PLL3_USB_OTG]);
++ }
++
+ imx_register_uart_clocks(uart_clks);
+ }
+ CLK_OF_DECLARE(imx6q, "fsl,imx6q-ccm", imx6q_clocks_init);
+diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
+index 2ee40fd..e1aa531 100644
+--- a/drivers/cpufreq/cpufreq-dt-platdev.c
++++ b/drivers/cpufreq/cpufreq-dt-platdev.c
+@@ -68,6 +68,8 @@ static const struct of_device_id machines[] __initconst = {
+
+ { .compatible = "sigma,tango4" },
+
++ { .compatible = "ti,am33xx", },
++ { .compatible = "ti,dra7", },
+ { .compatible = "ti,omap2", },
+ { .compatible = "ti,omap3", },
+ { .compatible = "ti,omap4", },
+diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
+index 18da4f8..1347589 100644
+--- a/drivers/cpufreq/cpufreq_conservative.c
++++ b/drivers/cpufreq/cpufreq_conservative.c
+@@ -17,6 +17,7 @@
+ struct cs_policy_dbs_info {
+ struct policy_dbs_info policy_dbs;
+ unsigned int down_skip;
++ unsigned int requested_freq;
+ };
+
+ static inline struct cs_policy_dbs_info *to_dbs_info(struct policy_dbs_info *policy_dbs)
+@@ -61,6 +62,7 @@ static unsigned int cs_dbs_timer(struct cpufreq_policy *policy)
+ {
+ struct policy_dbs_info *policy_dbs = policy->governor_data;
+ struct cs_policy_dbs_info *dbs_info = to_dbs_info(policy_dbs);
++ unsigned int requested_freq = dbs_info->requested_freq;
+ struct dbs_data *dbs_data = policy_dbs->dbs_data;
+ struct cs_dbs_tuners *cs_tuners = dbs_data->tuners;
+ unsigned int load = dbs_update(policy);
+@@ -72,10 +74,16 @@ static unsigned int cs_dbs_timer(struct cpufreq_policy *policy)
+ if (cs_tuners->freq_step == 0)
+ goto out;
+
++ /*
++ * If requested_freq is out of range, it is likely that the limits
++ * changed in the meantime, so fall back to current frequency in that
++ * case.
++ */
++ if (requested_freq > policy->max || requested_freq < policy->min)
++ requested_freq = policy->cur;
++
+ /* Check for frequency increase */
+ if (load > dbs_data->up_threshold) {
+- unsigned int requested_freq = policy->cur;
+-
+ dbs_info->down_skip = 0;
+
+ /* if we are already at full speed then break out early */
+@@ -83,8 +91,11 @@ static unsigned int cs_dbs_timer(struct cpufreq_policy *policy)
+ goto out;
+
+ requested_freq += get_freq_target(cs_tuners, policy);
++ if (requested_freq > policy->max)
++ requested_freq = policy->max;
+
+ __cpufreq_driver_target(policy, requested_freq, CPUFREQ_RELATION_H);
++ dbs_info->requested_freq = requested_freq;
+ goto out;
+ }
+
+@@ -95,7 +106,7 @@ static unsigned int cs_dbs_timer(struct cpufreq_policy *policy)
+
+ /* Check for frequency decrease */
+ if (load < cs_tuners->down_threshold) {
+- unsigned int freq_target, requested_freq = policy->cur;
++ unsigned int freq_target;
+ /*
+ * if we cannot reduce the frequency anymore, break out early
+ */
+@@ -109,6 +120,7 @@ static unsigned int cs_dbs_timer(struct cpufreq_policy *policy)
+ requested_freq = policy->min;
+
+ __cpufreq_driver_target(policy, requested_freq, CPUFREQ_RELATION_L);
++ dbs_info->requested_freq = requested_freq;
+ }
+
+ out:
+@@ -287,6 +299,7 @@ static void cs_start(struct cpufreq_policy *policy)
+ struct cs_policy_dbs_info *dbs_info = to_dbs_info(policy->governor_data);
+
+ dbs_info->down_skip = 0;
++ dbs_info->requested_freq = policy->cur;
+ }
+
+ static struct dbs_governor cs_governor = {
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index be9eade..b46547e 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -556,12 +556,12 @@ static void intel_pstate_hwp_set(const struct cpumask *cpumask)
+ int min, hw_min, max, hw_max, cpu, range, adj_range;
+ u64 value, cap;
+
+- rdmsrl(MSR_HWP_CAPABILITIES, cap);
+- hw_min = HWP_LOWEST_PERF(cap);
+- hw_max = HWP_HIGHEST_PERF(cap);
+- range = hw_max - hw_min;
+-
+ for_each_cpu(cpu, cpumask) {
++ rdmsrl_on_cpu(cpu, MSR_HWP_CAPABILITIES, &cap);
++ hw_min = HWP_LOWEST_PERF(cap);
++ hw_max = HWP_HIGHEST_PERF(cap);
++ range = hw_max - hw_min;
++
+ rdmsrl_on_cpu(cpu, MSR_HWP_REQUEST, &value);
+ adj_range = limits->min_perf_pct * range / 100;
+ min = hw_min + adj_range;
+diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
+index 425501c..793518a 100644
+--- a/drivers/gpio/gpio-mpc8xxx.c
++++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -239,7 +239,7 @@ static int mpc8xxx_gpio_irq_map(struct irq_domain *h, unsigned int irq,
+ irq_hw_number_t hwirq)
+ {
+ irq_set_chip_data(irq, h->host_data);
+- irq_set_chip_and_handler(irq, &mpc8xxx_irq_chip, handle_level_irq);
++ irq_set_chip_and_handler(irq, &mpc8xxx_irq_chip, handle_edge_irq);
+
+ return 0;
+ }
+diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
+index f2b776e..5f88ccd 100644
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -821,7 +821,7 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
+ if (ret) {
+ pr_err("failed to init MR pool ret= %d\n", ret);
+ ib_destroy_qp(qp);
+- qp = ERR_PTR(ret);
++ return ERR_PTR(ret);
+ }
+ }
+
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 3322ed7..6b07d4b 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -1400,7 +1400,9 @@ static int srp_map_sg_entry(struct srp_map_state *state,
+
+ while (dma_len) {
+ unsigned offset = dma_addr & ~dev->mr_page_mask;
+- if (state->npages == dev->max_pages_per_mr || offset != 0) {
++
++ if (state->npages == dev->max_pages_per_mr ||
++ (state->npages > 0 && offset != 0)) {
+ ret = srp_map_finish_fmr(state, ch);
+ if (ret)
+ return ret;
+@@ -1417,12 +1419,12 @@ static int srp_map_sg_entry(struct srp_map_state *state,
+ }
+
+ /*
+- * If the last entry of the MR wasn't a full page, then we need to
++ * If the end of the MR is not on a page boundary then we need to
+ * close it out and start a new one -- we can only merge at page
+ * boundaries.
+ */
+ ret = 0;
+- if (len != dev->mr_page_size)
++ if ((dma_addr & ~dev->mr_page_mask) != 0)
+ ret = srp_map_finish_fmr(state, ch);
+ return ret;
+ }
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 08e252a..ff8c107 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1159,6 +1159,13 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"),
+ },
+ },
++ {
++ /* Fujitsu H760 also has a middle button */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H760"),
++ },
++ },
+ #endif
+ { }
+ };
+@@ -1503,10 +1510,10 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
+ },
+ },
+ {
+- /* Fujitsu LIFEBOOK E554 does not work with crc_enabled == 0 */
++ /* Fujitsu H760 does not work with crc_enabled == 0 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E554"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H760"),
+ },
+ },
+ {
+@@ -1517,6 +1524,20 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
+ },
+ },
+ {
++ /* Fujitsu LIFEBOOK E554 does not work with crc_enabled == 0 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E554"),
++ },
++ },
++ {
++ /* Fujitsu LIFEBOOK E556 does not work with crc_enabled == 0 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E556"),
++ },
++ },
++ {
+ /* Fujitsu LIFEBOOK U745 does not work with crc_enabled == 0 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+diff --git a/drivers/input/serio/i8042-io.h b/drivers/input/serio/i8042-io.h
+index a5eed2a..34da81c 100644
+--- a/drivers/input/serio/i8042-io.h
++++ b/drivers/input/serio/i8042-io.h
+@@ -81,7 +81,7 @@ static inline int i8042_platform_init(void)
+ return -EBUSY;
+ #endif
+
+- i8042_reset = 1;
++ i8042_reset = I8042_RESET_ALWAYS;
+ return 0;
+ }
+
+diff --git a/drivers/input/serio/i8042-ip22io.h b/drivers/input/serio/i8042-ip22io.h
+index ee1ad27..08a1c10 100644
+--- a/drivers/input/serio/i8042-ip22io.h
++++ b/drivers/input/serio/i8042-ip22io.h
+@@ -61,7 +61,7 @@ static inline int i8042_platform_init(void)
+ return -EBUSY;
+ #endif
+
+- i8042_reset = 1;
++ i8042_reset = I8042_RESET_ALWAYS;
+
+ return 0;
+ }
+diff --git a/drivers/input/serio/i8042-ppcio.h b/drivers/input/serio/i8042-ppcio.h
+index f708c75..1aabea4 100644
+--- a/drivers/input/serio/i8042-ppcio.h
++++ b/drivers/input/serio/i8042-ppcio.h
+@@ -44,7 +44,7 @@ static inline void i8042_write_command(int val)
+
+ static inline int i8042_platform_init(void)
+ {
+- i8042_reset = 1;
++ i8042_reset = I8042_RESET_ALWAYS;
+ return 0;
+ }
+
+diff --git a/drivers/input/serio/i8042-sparcio.h b/drivers/input/serio/i8042-sparcio.h
+index afcd1c1..6231d63 100644
+--- a/drivers/input/serio/i8042-sparcio.h
++++ b/drivers/input/serio/i8042-sparcio.h
+@@ -130,7 +130,7 @@ static int __init i8042_platform_init(void)
+ }
+ }
+
+- i8042_reset = 1;
++ i8042_reset = I8042_RESET_ALWAYS;
+
+ return 0;
+ }
+diff --git a/drivers/input/serio/i8042-unicore32io.h b/drivers/input/serio/i8042-unicore32io.h
+index 73f5cc1..4557475 100644
+--- a/drivers/input/serio/i8042-unicore32io.h
++++ b/drivers/input/serio/i8042-unicore32io.h
+@@ -61,7 +61,7 @@ static inline int i8042_platform_init(void)
+ if (!request_mem_region(I8042_REGION_START, I8042_REGION_SIZE, "i8042"))
+ return -EBUSY;
+
+- i8042_reset = 1;
++ i8042_reset = I8042_RESET_ALWAYS;
+ return 0;
+ }
+
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 68f5f4a..f4bfb4b 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -510,6 +510,90 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ { }
+ };
+
++/*
++ * On some Asus laptops, just running self tests cause problems.
++ */
++static const struct dmi_system_id i8042_dmi_noselftest_table[] = {
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "A455LD"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "K401LB"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "K501LB"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "K501LX"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "R409L"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "V502LX"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X302LA"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X450LCP"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X450LD"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X455LAB"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X455LDB"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X455LF"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Z450LA"),
++ },
++ },
++ { }
++};
+ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+ {
+ /* MSI Wind U-100 */
+@@ -1072,12 +1156,18 @@ static int __init i8042_platform_init(void)
+ return retval;
+
+ #if defined(__ia64__)
+- i8042_reset = true;
++ i8042_reset = I8042_RESET_ALWAYS;
+ #endif
+
+ #ifdef CONFIG_X86
+- if (dmi_check_system(i8042_dmi_reset_table))
+- i8042_reset = true;
++ /* Honor module parameter when value is not default */
++ if (i8042_reset == I8042_RESET_DEFAULT) {
++ if (dmi_check_system(i8042_dmi_reset_table))
++ i8042_reset = I8042_RESET_ALWAYS;
++
++ if (dmi_check_system(i8042_dmi_noselftest_table))
++ i8042_reset = I8042_RESET_NEVER;
++ }
+
+ if (dmi_check_system(i8042_dmi_noloop_table))
+ i8042_noloop = true;
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index 405252a..89abfdb 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -48,9 +48,39 @@ static bool i8042_unlock;
+ module_param_named(unlock, i8042_unlock, bool, 0);
+ MODULE_PARM_DESC(unlock, "Ignore keyboard lock.");
+
+-static bool i8042_reset;
+-module_param_named(reset, i8042_reset, bool, 0);
+-MODULE_PARM_DESC(reset, "Reset controller during init and cleanup.");
++enum i8042_controller_reset_mode {
++ I8042_RESET_NEVER,
++ I8042_RESET_ALWAYS,
++ I8042_RESET_ON_S2RAM,
++#define I8042_RESET_DEFAULT I8042_RESET_ON_S2RAM
++};
++static enum i8042_controller_reset_mode i8042_reset = I8042_RESET_DEFAULT;
++static int i8042_set_reset(const char *val, const struct kernel_param *kp)
++{
++ enum i8042_controller_reset_mode *arg = kp->arg;
++ int error;
++ bool reset;
++
++ if (val) {
++ error = kstrtobool(val, &reset);
++ if (error)
++ return error;
++ } else {
++ reset = true;
++ }
++
++ *arg = reset ? I8042_RESET_ALWAYS : I8042_RESET_NEVER;
++ return 0;
++}
++
++static const struct kernel_param_ops param_ops_reset_param = {
++ .flags = KERNEL_PARAM_OPS_FL_NOARG,
++ .set = i8042_set_reset,
++};
++#define param_check_reset_param(name, p) \
++ __param_check(name, p, enum i8042_controller_reset_mode)
++module_param_named(reset, i8042_reset, reset_param, 0);
++MODULE_PARM_DESC(reset, "Reset controller on resume, cleanup or both");
+
+ static bool i8042_direct;
+ module_param_named(direct, i8042_direct, bool, 0);
+@@ -1019,7 +1049,7 @@ static int i8042_controller_init(void)
+ * Reset the controller and reset CRT to the original value set by BIOS.
+ */
+
+-static void i8042_controller_reset(bool force_reset)
++static void i8042_controller_reset(bool s2r_wants_reset)
+ {
+ i8042_flush();
+
+@@ -1044,8 +1074,10 @@ static void i8042_controller_reset(bool force_reset)
+ * Reset the controller if requested.
+ */
+
+- if (i8042_reset || force_reset)
++ if (i8042_reset == I8042_RESET_ALWAYS ||
++ (i8042_reset == I8042_RESET_ON_S2RAM && s2r_wants_reset)) {
+ i8042_controller_selftest();
++ }
+
+ /*
+ * Restore the original control register setting.
+@@ -1110,7 +1142,7 @@ static void i8042_dritek_enable(void)
+ * before suspending.
+ */
+
+-static int i8042_controller_resume(bool force_reset)
++static int i8042_controller_resume(bool s2r_wants_reset)
+ {
+ int error;
+
+@@ -1118,7 +1150,8 @@ static int i8042_controller_resume(bool force_reset)
+ if (error)
+ return error;
+
+- if (i8042_reset || force_reset) {
++ if (i8042_reset == I8042_RESET_ALWAYS ||
++ (i8042_reset == I8042_RESET_ON_S2RAM && s2r_wants_reset)) {
+ error = i8042_controller_selftest();
+ if (error)
+ return error;
+@@ -1195,7 +1228,7 @@ static int i8042_pm_resume_noirq(struct device *dev)
+
+ static int i8042_pm_resume(struct device *dev)
+ {
+- bool force_reset;
++ bool want_reset;
+ int i;
+
+ for (i = 0; i < I8042_NUM_PORTS; i++) {
+@@ -1218,9 +1251,9 @@ static int i8042_pm_resume(struct device *dev)
+ * off control to the platform firmware, otherwise we can simply restore
+ * the mode.
+ */
+- force_reset = pm_resume_via_firmware();
++ want_reset = pm_resume_via_firmware();
+
+- return i8042_controller_resume(force_reset);
++ return i8042_controller_resume(want_reset);
+ }
+
+ static int i8042_pm_thaw(struct device *dev)
+@@ -1482,7 +1515,7 @@ static int __init i8042_probe(struct platform_device *dev)
+
+ i8042_platform_device = dev;
+
+- if (i8042_reset) {
++ if (i8042_reset == I8042_RESET_ALWAYS) {
+ error = i8042_controller_selftest();
+ if (error)
+ return error;
+diff --git a/drivers/irqchip/irq-eznps.c b/drivers/irqchip/irq-eznps.c
+index efbf0e4..ebc2b0b 100644
+--- a/drivers/irqchip/irq-eznps.c
++++ b/drivers/irqchip/irq-eznps.c
+@@ -85,7 +85,7 @@ static void nps400_irq_eoi_global(struct irq_data *irqd)
+ nps_ack_gic();
+ }
+
+-static void nps400_irq_eoi(struct irq_data *irqd)
++static void nps400_irq_ack(struct irq_data *irqd)
+ {
+ unsigned int __maybe_unused irq = irqd_to_hwirq(irqd);
+
+@@ -103,7 +103,7 @@ static struct irq_chip nps400_irq_chip_percpu = {
+ .name = "NPS400 IC",
+ .irq_mask = nps400_irq_mask,
+ .irq_unmask = nps400_irq_unmask,
+- .irq_eoi = nps400_irq_eoi,
++ .irq_ack = nps400_irq_ack,
+ };
+
+ static int nps400_irq_map(struct irq_domain *d, unsigned int virq,
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index da6c0ba..708a260 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -153,7 +153,7 @@ static void gic_enable_redist(bool enable)
+ return; /* No PM support in this redistributor */
+ }
+
+- while (count--) {
++ while (--count) {
+ val = readl_relaxed(rbase + GICR_WAKER);
+ if (enable ^ (bool)(val & GICR_WAKER_ChildrenAsleep))
+ break;
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 8742957..6fc8923 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -113,8 +113,7 @@ struct iv_tcw_private {
+ * and encrypts / decrypts at the same time.
+ */
+ enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID,
+- DM_CRYPT_SAME_CPU, DM_CRYPT_NO_OFFLOAD,
+- DM_CRYPT_EXIT_THREAD};
++ DM_CRYPT_SAME_CPU, DM_CRYPT_NO_OFFLOAD };
+
+ /*
+ * The fields in here must be read only after initialization.
+@@ -1207,18 +1206,20 @@ static int dmcrypt_write(void *data)
+ if (!RB_EMPTY_ROOT(&cc->write_tree))
+ goto pop_from_list;
+
+- if (unlikely(test_bit(DM_CRYPT_EXIT_THREAD, &cc->flags))) {
+- spin_unlock_irq(&cc->write_thread_wait.lock);
+- break;
+- }
+-
+- __set_current_state(TASK_INTERRUPTIBLE);
++ set_current_state(TASK_INTERRUPTIBLE);
+ __add_wait_queue(&cc->write_thread_wait, &wait);
+
+ spin_unlock_irq(&cc->write_thread_wait.lock);
+
++ if (unlikely(kthread_should_stop())) {
++ set_task_state(current, TASK_RUNNING);
++ remove_wait_queue(&cc->write_thread_wait, &wait);
++ break;
++ }
++
+ schedule();
+
++ set_task_state(current, TASK_RUNNING);
+ spin_lock_irq(&cc->write_thread_wait.lock);
+ __remove_wait_queue(&cc->write_thread_wait, &wait);
+ goto continue_locked;
+@@ -1533,13 +1534,8 @@ static void crypt_dtr(struct dm_target *ti)
+ if (!cc)
+ return;
+
+- if (cc->write_thread) {
+- spin_lock_irq(&cc->write_thread_wait.lock);
+- set_bit(DM_CRYPT_EXIT_THREAD, &cc->flags);
+- wake_up_locked(&cc->write_thread_wait);
+- spin_unlock_irq(&cc->write_thread_wait.lock);
++ if (cc->write_thread)
+ kthread_stop(cc->write_thread);
+- }
+
+ if (cc->io_queue)
+ destroy_workqueue(cc->io_queue);
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index ac734e5..15db5e9 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -1521,10 +1521,10 @@ static void activate_path(struct work_struct *work)
+ {
+ struct pgpath *pgpath =
+ container_of(work, struct pgpath, activate_path.work);
++ struct request_queue *q = bdev_get_queue(pgpath->path.dev->bdev);
+
+- if (pgpath->is_active)
+- scsi_dh_activate(bdev_get_queue(pgpath->path.dev->bdev),
+- pg_init_done, pgpath);
++ if (pgpath->is_active && !blk_queue_dying(q))
++ scsi_dh_activate(q, pg_init_done, pgpath);
+ else
+ pg_init_done(pgpath, SCSI_DH_DEV_OFFLINED);
+ }
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 1ca7463..5da86c8 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -73,15 +73,24 @@ static void dm_old_start_queue(struct request_queue *q)
+ spin_unlock_irqrestore(q->queue_lock, flags);
+ }
+
++static void dm_mq_start_queue(struct request_queue *q)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(q->queue_lock, flags);
++ queue_flag_clear(QUEUE_FLAG_STOPPED, q);
++ spin_unlock_irqrestore(q->queue_lock, flags);
++
++ blk_mq_start_stopped_hw_queues(q, true);
++ blk_mq_kick_requeue_list(q);
++}
++
+ void dm_start_queue(struct request_queue *q)
+ {
+ if (!q->mq_ops)
+ dm_old_start_queue(q);
+- else {
+- queue_flag_clear_unlocked(QUEUE_FLAG_STOPPED, q);
+- blk_mq_start_stopped_hw_queues(q, true);
+- blk_mq_kick_requeue_list(q);
+- }
++ else
++ dm_mq_start_queue(q);
+ }
+
+ static void dm_old_stop_queue(struct request_queue *q)
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index fa9b1cb..0f2928b 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1873,6 +1873,7 @@ EXPORT_SYMBOL_GPL(dm_device_name);
+
+ static void __dm_destroy(struct mapped_device *md, bool wait)
+ {
++ struct request_queue *q = dm_get_md_queue(md);
+ struct dm_table *map;
+ int srcu_idx;
+
+@@ -1883,6 +1884,10 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
+ set_bit(DMF_FREEING, &md->flags);
+ spin_unlock(&_minor_lock);
+
++ spin_lock_irq(q->queue_lock);
++ queue_flag_set(QUEUE_FLAG_DYING, q);
++ spin_unlock_irq(q->queue_lock);
++
+ if (dm_request_based(md) && md->kworker_task)
+ flush_kthread_worker(&md->kworker);
+
+@@ -2249,10 +2254,11 @@ static int __dm_resume(struct mapped_device *md, struct dm_table *map)
+
+ int dm_resume(struct mapped_device *md)
+ {
+- int r = -EINVAL;
++ int r;
+ struct dm_table *map = NULL;
+
+ retry:
++ r = -EINVAL;
+ mutex_lock_nested(&md->suspend_lock, SINGLE_DEPTH_NESTING);
+
+ if (!dm_suspended_md(md))
+@@ -2276,8 +2282,6 @@ int dm_resume(struct mapped_device *md)
+ goto out;
+
+ clear_bit(DMF_SUSPENDED, &md->flags);
+-
+- r = 0;
+ out:
+ mutex_unlock(&md->suspend_lock);
+
+diff --git a/drivers/media/dvb-frontends/mb86a20s.c b/drivers/media/dvb-frontends/mb86a20s.c
+index 4132532..fe79358 100644
+--- a/drivers/media/dvb-frontends/mb86a20s.c
++++ b/drivers/media/dvb-frontends/mb86a20s.c
+@@ -71,25 +71,27 @@ static struct regdata mb86a20s_init1[] = {
+ };
+
+ static struct regdata mb86a20s_init2[] = {
+- { 0x28, 0x22 }, { 0x29, 0x00 }, { 0x2a, 0x1f }, { 0x2b, 0xf0 },
++ { 0x50, 0xd1 }, { 0x51, 0x22 },
++ { 0x39, 0x01 },
++ { 0x71, 0x00 },
+ { 0x3b, 0x21 },
+- { 0x3c, 0x38 },
++ { 0x3c, 0x3a },
+ { 0x01, 0x0d },
+- { 0x04, 0x08 }, { 0x05, 0x03 },
++ { 0x04, 0x08 }, { 0x05, 0x05 },
+ { 0x04, 0x0e }, { 0x05, 0x00 },
+- { 0x04, 0x0f }, { 0x05, 0x37 },
+- { 0x04, 0x0b }, { 0x05, 0x78 },
++ { 0x04, 0x0f }, { 0x05, 0x14 },
++ { 0x04, 0x0b }, { 0x05, 0x8c },
+ { 0x04, 0x00 }, { 0x05, 0x00 },
+- { 0x04, 0x01 }, { 0x05, 0x1e },
+- { 0x04, 0x02 }, { 0x05, 0x07 },
+- { 0x04, 0x03 }, { 0x05, 0xd0 },
++ { 0x04, 0x01 }, { 0x05, 0x07 },
++ { 0x04, 0x02 }, { 0x05, 0x0f },
++ { 0x04, 0x03 }, { 0x05, 0xa0 },
+ { 0x04, 0x09 }, { 0x05, 0x00 },
+ { 0x04, 0x0a }, { 0x05, 0xff },
+- { 0x04, 0x27 }, { 0x05, 0x00 },
++ { 0x04, 0x27 }, { 0x05, 0x64 },
+ { 0x04, 0x28 }, { 0x05, 0x00 },
+- { 0x04, 0x1e }, { 0x05, 0x00 },
+- { 0x04, 0x29 }, { 0x05, 0x64 },
+- { 0x04, 0x32 }, { 0x05, 0x02 },
++ { 0x04, 0x1e }, { 0x05, 0xff },
++ { 0x04, 0x29 }, { 0x05, 0x0a },
++ { 0x04, 0x32 }, { 0x05, 0x0a },
+ { 0x04, 0x14 }, { 0x05, 0x02 },
+ { 0x04, 0x04 }, { 0x05, 0x00 },
+ { 0x04, 0x05 }, { 0x05, 0x22 },
+@@ -97,8 +99,6 @@ static struct regdata mb86a20s_init2[] = {
+ { 0x04, 0x07 }, { 0x05, 0xd8 },
+ { 0x04, 0x12 }, { 0x05, 0x00 },
+ { 0x04, 0x13 }, { 0x05, 0xff },
+- { 0x04, 0x15 }, { 0x05, 0x4e },
+- { 0x04, 0x16 }, { 0x05, 0x20 },
+
+ /*
+ * On this demod, when the bit count reaches the count below,
+@@ -152,42 +152,36 @@ static struct regdata mb86a20s_init2[] = {
+ { 0x50, 0x51 }, { 0x51, 0x04 }, /* MER symbol 4 */
+ { 0x45, 0x04 }, /* CN symbol 4 */
+ { 0x48, 0x04 }, /* CN manual mode */
+-
++ { 0x50, 0xd5 }, { 0x51, 0x01 },
+ { 0x50, 0xd6 }, { 0x51, 0x1f },
+ { 0x50, 0xd2 }, { 0x51, 0x03 },
+- { 0x50, 0xd7 }, { 0x51, 0xbf },
+- { 0x28, 0x74 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0xff },
+- { 0x28, 0x46 }, { 0x29, 0x00 }, { 0x2a, 0x1a }, { 0x2b, 0x0c },
+-
+- { 0x04, 0x40 }, { 0x05, 0x00 },
+- { 0x28, 0x00 }, { 0x2b, 0x08 },
+- { 0x28, 0x05 }, { 0x2b, 0x00 },
++ { 0x50, 0xd7 }, { 0x51, 0x3f },
+ { 0x1c, 0x01 },
+- { 0x28, 0x06 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x1f },
+- { 0x28, 0x07 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x18 },
+- { 0x28, 0x08 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x12 },
+- { 0x28, 0x09 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x30 },
+- { 0x28, 0x0a }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x37 },
+- { 0x28, 0x0b }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x02 },
+- { 0x28, 0x0c }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x09 },
+- { 0x28, 0x0d }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x06 },
+- { 0x28, 0x0e }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x7b },
+- { 0x28, 0x0f }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x76 },
+- { 0x28, 0x10 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x7d },
+- { 0x28, 0x11 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x08 },
+- { 0x28, 0x12 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x0b },
+- { 0x28, 0x13 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x00 },
+- { 0x28, 0x14 }, { 0x29, 0x00 }, { 0x2a, 0x01 }, { 0x2b, 0xf2 },
+- { 0x28, 0x15 }, { 0x29, 0x00 }, { 0x2a, 0x01 }, { 0x2b, 0xf3 },
+- { 0x28, 0x16 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x05 },
+- { 0x28, 0x17 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x16 },
+- { 0x28, 0x18 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x0f },
+- { 0x28, 0x19 }, { 0x29, 0x00 }, { 0x2a, 0x07 }, { 0x2b, 0xef },
+- { 0x28, 0x1a }, { 0x29, 0x00 }, { 0x2a, 0x07 }, { 0x2b, 0xd8 },
+- { 0x28, 0x1b }, { 0x29, 0x00 }, { 0x2a, 0x07 }, { 0x2b, 0xf1 },
+- { 0x28, 0x1c }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x3d },
+- { 0x28, 0x1d }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x94 },
+- { 0x28, 0x1e }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0xba },
++ { 0x28, 0x06 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x03 },
++ { 0x28, 0x07 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x0d },
++ { 0x28, 0x08 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x02 },
++ { 0x28, 0x09 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x01 },
++ { 0x28, 0x0a }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x21 },
++ { 0x28, 0x0b }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x29 },
++ { 0x28, 0x0c }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x16 },
++ { 0x28, 0x0d }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x31 },
++ { 0x28, 0x0e }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x0e },
++ { 0x28, 0x0f }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x4e },
++ { 0x28, 0x10 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x46 },
++ { 0x28, 0x11 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x0f },
++ { 0x28, 0x12 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x56 },
++ { 0x28, 0x13 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x35 },
++ { 0x28, 0x14 }, { 0x29, 0x00 }, { 0x2a, 0x01 }, { 0x2b, 0xbe },
++ { 0x28, 0x15 }, { 0x29, 0x00 }, { 0x2a, 0x01 }, { 0x2b, 0x84 },
++ { 0x28, 0x16 }, { 0x29, 0x00 }, { 0x2a, 0x03 }, { 0x2b, 0xee },
++ { 0x28, 0x17 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x98 },
++ { 0x28, 0x18 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x9f },
++ { 0x28, 0x19 }, { 0x29, 0x00 }, { 0x2a, 0x07 }, { 0x2b, 0xb2 },
++ { 0x28, 0x1a }, { 0x29, 0x00 }, { 0x2a, 0x06 }, { 0x2b, 0xc2 },
++ { 0x28, 0x1b }, { 0x29, 0x00 }, { 0x2a, 0x07 }, { 0x2b, 0x4a },
++ { 0x28, 0x1c }, { 0x29, 0x00 }, { 0x2a, 0x01 }, { 0x2b, 0xbc },
++ { 0x28, 0x1d }, { 0x29, 0x00 }, { 0x2a, 0x04 }, { 0x2b, 0xba },
++ { 0x28, 0x1e }, { 0x29, 0x00 }, { 0x2a, 0x06 }, { 0x2b, 0x14 },
+ { 0x50, 0x1e }, { 0x51, 0x5d },
+ { 0x50, 0x22 }, { 0x51, 0x00 },
+ { 0x50, 0x23 }, { 0x51, 0xc8 },
+@@ -196,9 +190,7 @@ static struct regdata mb86a20s_init2[] = {
+ { 0x50, 0x26 }, { 0x51, 0x00 },
+ { 0x50, 0x27 }, { 0x51, 0xc3 },
+ { 0x50, 0x39 }, { 0x51, 0x02 },
+- { 0xec, 0x0f },
+- { 0xeb, 0x1f },
+- { 0x28, 0x6a }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x00 },
++ { 0x50, 0xd5 }, { 0x51, 0x01 },
+ { 0xd0, 0x00 },
+ };
+
+@@ -318,7 +310,11 @@ static int mb86a20s_read_status(struct dvb_frontend *fe, enum fe_status *status)
+ if (val >= 7)
+ *status |= FE_HAS_SYNC;
+
+- if (val >= 8) /* Maybe 9? */
++ /*
++ * Actually, on state S8, it starts receiving TS, but the TS
++ * output is only on normal state after the transition to S9.
++ */
++ if (val >= 9)
+ *status |= FE_HAS_LOCK;
+
+ dev_dbg(&state->i2c->dev, "%s: Status = 0x%02x (state = %d)\n",
+@@ -2058,6 +2054,11 @@ static void mb86a20s_release(struct dvb_frontend *fe)
+ kfree(state);
+ }
+
++static int mb86a20s_get_frontend_algo(struct dvb_frontend *fe)
++{
++ return DVBFE_ALGO_HW;
++}
++
+ static struct dvb_frontend_ops mb86a20s_ops;
+
+ struct dvb_frontend *mb86a20s_attach(const struct mb86a20s_config *config,
+@@ -2130,6 +2131,7 @@ static struct dvb_frontend_ops mb86a20s_ops = {
+ .read_status = mb86a20s_read_status_and_stats,
+ .read_signal_strength = mb86a20s_read_signal_strength_from_cache,
+ .tune = mb86a20s_tune,
++ .get_frontend_algo = mb86a20s_get_frontend_algo,
+ };
+
+ MODULE_DESCRIPTION("DVB Frontend module for Fujitsu mb86A20s hardware");
+diff --git a/drivers/media/usb/cx231xx/cx231xx-avcore.c b/drivers/media/usb/cx231xx/cx231xx-avcore.c
+index 4919137..2f52d66 100644
+--- a/drivers/media/usb/cx231xx/cx231xx-avcore.c
++++ b/drivers/media/usb/cx231xx/cx231xx-avcore.c
+@@ -1264,7 +1264,10 @@ int cx231xx_set_agc_analog_digital_mux_select(struct cx231xx *dev,
+ dev->board.agc_analog_digital_select_gpio,
+ analog_or_digital);
+
+- return status;
++ if (status < 0)
++ return status;
++
++ return 0;
+ }
+
+ int cx231xx_enable_i2c_port_3(struct cx231xx *dev, bool is_port_3)
+diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c
+index c63248a..72c246b 100644
+--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
++++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
+@@ -486,7 +486,7 @@ struct cx231xx_board cx231xx_boards[] = {
+ .output_mode = OUT_MODE_VIP11,
+ .demod_xfer_mode = 0,
+ .ctl_pin_status_mask = 0xFFFFFFC4,
+- .agc_analog_digital_select_gpio = 0x00, /* According with PV cxPolaris.inf file */
++ .agc_analog_digital_select_gpio = 0x1c,
+ .tuner_sif_gpio = -1,
+ .tuner_scl_gpio = -1,
+ .tuner_sda_gpio = -1,
+diff --git a/drivers/media/usb/cx231xx/cx231xx-core.c b/drivers/media/usb/cx231xx/cx231xx-core.c
+index 630f4fc..ea9a99e 100644
+--- a/drivers/media/usb/cx231xx/cx231xx-core.c
++++ b/drivers/media/usb/cx231xx/cx231xx-core.c
+@@ -712,6 +712,7 @@ int cx231xx_set_mode(struct cx231xx *dev, enum cx231xx_mode set_mode)
+ break;
+ case CX231XX_BOARD_CNXT_RDE_253S:
+ case CX231XX_BOARD_CNXT_RDU_253S:
++ case CX231XX_BOARD_PV_PLAYTV_USB_HYBRID:
+ errCode = cx231xx_set_agc_analog_digital_mux_select(dev, 1);
+ break;
+ case CX231XX_BOARD_HAUPPAUGE_EXETER:
+@@ -738,7 +739,7 @@ int cx231xx_set_mode(struct cx231xx *dev, enum cx231xx_mode set_mode)
+ case CX231XX_BOARD_PV_PLAYTV_USB_HYBRID:
+ case CX231XX_BOARD_HAUPPAUGE_USB2_FM_PAL:
+ case CX231XX_BOARD_HAUPPAUGE_USB2_FM_NTSC:
+- errCode = cx231xx_set_agc_analog_digital_mux_select(dev, 0);
++ errCode = cx231xx_set_agc_analog_digital_mux_select(dev, 0);
+ break;
+ default:
+ break;
+@@ -1301,15 +1302,29 @@ int cx231xx_dev_init(struct cx231xx *dev)
+ dev->i2c_bus[2].i2c_reserve = 0;
+
+ /* register I2C buses */
+- cx231xx_i2c_register(&dev->i2c_bus[0]);
+- cx231xx_i2c_register(&dev->i2c_bus[1]);
+- cx231xx_i2c_register(&dev->i2c_bus[2]);
++ errCode = cx231xx_i2c_register(&dev->i2c_bus[0]);
++ if (errCode < 0)
++ return errCode;
++ errCode = cx231xx_i2c_register(&dev->i2c_bus[1]);
++ if (errCode < 0)
++ return errCode;
++ errCode = cx231xx_i2c_register(&dev->i2c_bus[2]);
++ if (errCode < 0)
++ return errCode;
+
+ errCode = cx231xx_i2c_mux_create(dev);
++ if (errCode < 0) {
++ dev_err(dev->dev,
++ "%s: Failed to create I2C mux\n", __func__);
++ return errCode;
++ }
++ errCode = cx231xx_i2c_mux_register(dev, 0);
++ if (errCode < 0)
++ return errCode;
++
++ errCode = cx231xx_i2c_mux_register(dev, 1);
+ if (errCode < 0)
+ return errCode;
+- cx231xx_i2c_mux_register(dev, 0);
+- cx231xx_i2c_mux_register(dev, 1);
+
+ /* scan the real bus segments in the order of physical port numbers */
+ cx231xx_do_i2c_scan(dev, I2C_0);
+diff --git a/drivers/memstick/host/rtsx_usb_ms.c b/drivers/memstick/host/rtsx_usb_ms.c
+index d34bc35..2e3cf01 100644
+--- a/drivers/memstick/host/rtsx_usb_ms.c
++++ b/drivers/memstick/host/rtsx_usb_ms.c
+@@ -524,6 +524,7 @@ static void rtsx_usb_ms_handle_req(struct work_struct *work)
+ int rc;
+
+ if (!host->req) {
++ pm_runtime_get_sync(ms_dev(host));
+ do {
+ rc = memstick_next_req(msh, &host->req);
+ dev_dbg(ms_dev(host), "next req %d\n", rc);
+@@ -544,6 +545,7 @@ static void rtsx_usb_ms_handle_req(struct work_struct *work)
+ host->req->error);
+ }
+ } while (!rc);
++ pm_runtime_put(ms_dev(host));
+ }
+
+ }
+@@ -570,6 +572,7 @@ static int rtsx_usb_ms_set_param(struct memstick_host *msh,
+ dev_dbg(ms_dev(host), "%s: param = %d, value = %d\n",
+ __func__, param, value);
+
++ pm_runtime_get_sync(ms_dev(host));
+ mutex_lock(&ucr->dev_mutex);
+
+ err = rtsx_usb_card_exclusive_check(ucr, RTSX_USB_MS_CARD);
+@@ -635,6 +638,7 @@ static int rtsx_usb_ms_set_param(struct memstick_host *msh,
+ }
+ out:
+ mutex_unlock(&ucr->dev_mutex);
++ pm_runtime_put(ms_dev(host));
+
+ /* power-on delay */
+ if (param == MEMSTICK_POWER && value == MEMSTICK_POWER_ON)
+@@ -681,6 +685,7 @@ static int rtsx_usb_detect_ms_card(void *__host)
+ int err;
+
+ for (;;) {
++ pm_runtime_get_sync(ms_dev(host));
+ mutex_lock(&ucr->dev_mutex);
+
+ /* Check pending MS card changes */
+@@ -703,6 +708,7 @@ static int rtsx_usb_detect_ms_card(void *__host)
+ }
+
+ poll_again:
++ pm_runtime_put(ms_dev(host));
+ if (host->eject)
+ break;
+
+diff --git a/drivers/misc/cxl/api.c b/drivers/misc/cxl/api.c
+index f3d34b9..af23d7d 100644
+--- a/drivers/misc/cxl/api.c
++++ b/drivers/misc/cxl/api.c
+@@ -229,6 +229,14 @@ int cxl_start_context(struct cxl_context *ctx, u64 wed,
+ if (ctx->status == STARTED)
+ goto out; /* already started */
+
++ /*
++ * Increment the mapped context count for adapter. This also checks
++ * if adapter_context_lock is taken.
++ */
++ rc = cxl_adapter_context_get(ctx->afu->adapter);
++ if (rc)
++ goto out;
++
+ if (task) {
+ ctx->pid = get_task_pid(task, PIDTYPE_PID);
+ ctx->glpid = get_task_pid(task->group_leader, PIDTYPE_PID);
+@@ -240,6 +248,7 @@ int cxl_start_context(struct cxl_context *ctx, u64 wed,
+
+ if ((rc = cxl_ops->attach_process(ctx, kernel, wed, 0))) {
+ put_pid(ctx->pid);
++ cxl_adapter_context_put(ctx->afu->adapter);
+ cxl_ctx_put();
+ goto out;
+ }
+diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
+index c466ee2..5e506c1 100644
+--- a/drivers/misc/cxl/context.c
++++ b/drivers/misc/cxl/context.c
+@@ -238,6 +238,9 @@ int __detach_context(struct cxl_context *ctx)
+ put_pid(ctx->glpid);
+
+ cxl_ctx_put();
++
++ /* Decrease the attached context count on the adapter */
++ cxl_adapter_context_put(ctx->afu->adapter);
+ return 0;
+ }
+
+diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h
+index 344a0ff..19aa2ac 100644
+--- a/drivers/misc/cxl/cxl.h
++++ b/drivers/misc/cxl/cxl.h
+@@ -615,6 +615,14 @@ struct cxl {
+ bool perst_select_user;
+ bool perst_same_image;
+ bool psl_timebase_synced;
++
++ /*
++ * number of contexts mapped on to this card. Possible values are:
++ * >0: Number of contexts mapped and new one can be mapped.
++ * 0: No active contexts and new ones can be mapped.
++ * -1: No contexts mapped and new ones cannot be mapped.
++ */
++ atomic_t contexts_num;
+ };
+
+ int cxl_pci_alloc_one_irq(struct cxl *adapter);
+@@ -940,4 +948,20 @@ bool cxl_pci_is_vphb_device(struct pci_dev *dev);
+
+ /* decode AFU error bits in the PSL register PSL_SERR_An */
+ void cxl_afu_decode_psl_serr(struct cxl_afu *afu, u64 serr);
++
++/*
++ * Increments the number of attached contexts on an adapter.
++ * In case an adapter_context_lock is taken the return -EBUSY.
++ */
++int cxl_adapter_context_get(struct cxl *adapter);
++
++/* Decrements the number of attached contexts on an adapter */
++void cxl_adapter_context_put(struct cxl *adapter);
++
++/* If no active contexts then prevents contexts from being attached */
++int cxl_adapter_context_lock(struct cxl *adapter);
++
++/* Unlock the contexts-lock if taken. Warn and force unlock otherwise */
++void cxl_adapter_context_unlock(struct cxl *adapter);
++
+ #endif
+diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
+index 5fb9894..d0b421f 100644
+--- a/drivers/misc/cxl/file.c
++++ b/drivers/misc/cxl/file.c
+@@ -205,11 +205,22 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
+ ctx->pid = get_task_pid(current, PIDTYPE_PID);
+ ctx->glpid = get_task_pid(current->group_leader, PIDTYPE_PID);
+
++ /*
++ * Increment the mapped context count for adapter. This also checks
++ * if adapter_context_lock is taken.
++ */
++ rc = cxl_adapter_context_get(ctx->afu->adapter);
++ if (rc) {
++ afu_release_irqs(ctx, ctx);
++ goto out;
++ }
++
+ trace_cxl_attach(ctx, work.work_element_descriptor, work.num_interrupts, amr);
+
+ if ((rc = cxl_ops->attach_process(ctx, false, work.work_element_descriptor,
+ amr))) {
+ afu_release_irqs(ctx, ctx);
++ cxl_adapter_context_put(ctx->afu->adapter);
+ goto out;
+ }
+
+diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c
+index 9aa58a7..3e102cd 100644
+--- a/drivers/misc/cxl/guest.c
++++ b/drivers/misc/cxl/guest.c
+@@ -1152,6 +1152,9 @@ struct cxl *cxl_guest_init_adapter(struct device_node *np, struct platform_devic
+ if ((rc = cxl_sysfs_adapter_add(adapter)))
+ goto err_put1;
+
++ /* release the context lock as the adapter is configured */
++ cxl_adapter_context_unlock(adapter);
++
+ return adapter;
+
+ err_put1:
+diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
+index d9be23b2..62e0dfb 100644
+--- a/drivers/misc/cxl/main.c
++++ b/drivers/misc/cxl/main.c
+@@ -243,8 +243,10 @@ struct cxl *cxl_alloc_adapter(void)
+ if (dev_set_name(&adapter->dev, "card%i", adapter->adapter_num))
+ goto err2;
+
+- return adapter;
++ /* start with context lock taken */
++ atomic_set(&adapter->contexts_num, -1);
+
++ return adapter;
+ err2:
+ cxl_remove_adapter_nr(adapter);
+ err1:
+@@ -286,6 +288,44 @@ int cxl_afu_select_best_mode(struct cxl_afu *afu)
+ return 0;
+ }
+
++int cxl_adapter_context_get(struct cxl *adapter)
++{
++ int rc;
++
++ rc = atomic_inc_unless_negative(&adapter->contexts_num);
++ return rc >= 0 ? 0 : -EBUSY;
++}
++
++void cxl_adapter_context_put(struct cxl *adapter)
++{
++ atomic_dec_if_positive(&adapter->contexts_num);
++}
++
++int cxl_adapter_context_lock(struct cxl *adapter)
++{
++ int rc;
++ /* no active contexts -> contexts_num == 0 */
++ rc = atomic_cmpxchg(&adapter->contexts_num, 0, -1);
++ return rc ? -EBUSY : 0;
++}
++
++void cxl_adapter_context_unlock(struct cxl *adapter)
++{
++ int val = atomic_cmpxchg(&adapter->contexts_num, -1, 0);
++
++ /*
++ * contexts lock taken -> contexts_num == -1
++ * If not true then show a warning and force reset the lock.
++ * This will happen when context_unlock was requested without
++ * doing a context_lock.
++ */
++ if (val != -1) {
++ atomic_set(&adapter->contexts_num, 0);
++ WARN(1, "Adapter context unlocked with %d active contexts",
++ val);
++ }
++}
++
+ static int __init init_cxl(void)
+ {
+ int rc = 0;
+diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
+index 6f0c4ac..8ad4e4f 100644
+--- a/drivers/misc/cxl/pci.c
++++ b/drivers/misc/cxl/pci.c
+@@ -1484,6 +1484,8 @@ static int cxl_configure_adapter(struct cxl *adapter, struct pci_dev *dev)
+ if ((rc = cxl_native_register_psl_err_irq(adapter)))
+ goto err;
+
++ /* Release the context lock as adapter is configured */
++ cxl_adapter_context_unlock(adapter);
+ return 0;
+
+ err:
+diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
+index b043c20..a8b6d6a 100644
+--- a/drivers/misc/cxl/sysfs.c
++++ b/drivers/misc/cxl/sysfs.c
+@@ -75,12 +75,31 @@ static ssize_t reset_adapter_store(struct device *device,
+ int val;
+
+ rc = sscanf(buf, "%i", &val);
+- if ((rc != 1) || (val != 1))
++ if ((rc != 1) || (val != 1 && val != -1))
+ return -EINVAL;
+
+- if ((rc = cxl_ops->adapter_reset(adapter)))
+- return rc;
+- return count;
++ /*
++ * See if we can lock the context mapping that's only allowed
++ * when there are no contexts attached to the adapter. Once
++ * taken this will also prevent any context from getting activated.
++ */
++ if (val == 1) {
++ rc = cxl_adapter_context_lock(adapter);
++ if (rc)
++ goto out;
++
++ rc = cxl_ops->adapter_reset(adapter);
++ /* In case reset failed release context lock */
++ if (rc)
++ cxl_adapter_context_unlock(adapter);
++
++ } else if (val == -1) {
++ /* Perform a forced adapter reset */
++ rc = cxl_ops->adapter_reset(adapter);
++ }
++
++out:
++ return rc ? rc : count;
+ }
+
+ static ssize_t load_image_on_perst_show(struct device *device,
+diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
+index fd9271b..cd01e34 100644
+--- a/drivers/misc/mei/amthif.c
++++ b/drivers/misc/mei/amthif.c
+@@ -139,7 +139,7 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
+ return -ERESTARTSYS;
+
+ if (!mei_cl_is_connected(cl)) {
+- rets = -EBUSY;
++ rets = -ENODEV;
+ goto out;
+ }
+
+diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
+index e094df3..5b5b2e0 100644
+--- a/drivers/misc/mei/bus.c
++++ b/drivers/misc/mei/bus.c
+@@ -142,7 +142,7 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length)
+ mutex_lock(&bus->device_lock);
+
+ if (!mei_cl_is_connected(cl)) {
+- rets = -EBUSY;
++ rets = -ENODEV;
+ goto out;
+ }
+ }
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index 0dcb854..7ad15d6 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -125,6 +125,9 @@
+ #define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */
+ #define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */
+
++#define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */
++#define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */
++
+ /*
+ * MEI HW Section
+ */
+diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
+index 52635b0..080208d 100644
+--- a/drivers/misc/mei/main.c
++++ b/drivers/misc/mei/main.c
+@@ -202,7 +202,7 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
+
+ mutex_lock(&dev->device_lock);
+ if (!mei_cl_is_connected(cl)) {
+- rets = -EBUSY;
++ rets = -ENODEV;
+ goto out;
+ }
+ }
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index 71cea9b..5eb9b75 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -91,6 +91,9 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},
+
++ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, mei_me_pch8_cfg)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, mei_me_pch8_cfg)},
++
+ /* required last entry */
+ {0, }
+ };
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index 2206d44..17891f1 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -1778,7 +1778,7 @@ static void mmc_blk_packed_hdr_wrq_prep(struct mmc_queue_req *mqrq,
+ struct mmc_blk_data *md = mq->data;
+ struct mmc_packed *packed = mqrq->packed;
+ bool do_rel_wr, do_data_tag;
+- u32 *packed_cmd_hdr;
++ __le32 *packed_cmd_hdr;
+ u8 hdr_blocks;
+ u8 i = 1;
+
+@@ -2303,7 +2303,8 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card,
+ set_capacity(md->disk, size);
+
+ if (mmc_host_cmd23(card->host)) {
+- if (mmc_card_mmc(card) ||
++ if ((mmc_card_mmc(card) &&
++ card->csd.mmca_vsn >= CSD_SPEC_VER_3) ||
+ (mmc_card_sd(card) &&
+ card->scr.cmds & SD_SCR_CMD23_SUPPORT))
+ md->flags |= MMC_BLK_CMD23;
+diff --git a/drivers/mmc/card/queue.h b/drivers/mmc/card/queue.h
+index fee5e12..7f16709 100644
+--- a/drivers/mmc/card/queue.h
++++ b/drivers/mmc/card/queue.h
+@@ -31,7 +31,7 @@ enum mmc_packed_type {
+
+ struct mmc_packed {
+ struct list_head list;
+- u32 cmd_hdr[1024];
++ __le32 cmd_hdr[1024];
+ unsigned int blocks;
+ u8 nr_entries;
+ u8 retries;
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index f2d185c..c57eb32 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1259,6 +1259,16 @@ static int mmc_select_hs400es(struct mmc_card *card)
+ goto out_err;
+ }
+
++ if (card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS400_1_2V)
++ err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120);
++
++ if (err && card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS400_1_8V)
++ err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180);
++
++ /* If fails try again during next card power cycle */
++ if (err)
++ goto out_err;
++
+ err = mmc_select_bus_width(card);
+ if (err < 0)
+ goto out_err;
+diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c
+index 6c71fc9..da9f71b 100644
+--- a/drivers/mmc/host/rtsx_usb_sdmmc.c
++++ b/drivers/mmc/host/rtsx_usb_sdmmc.c
+@@ -1138,11 +1138,6 @@ static void sdmmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ dev_dbg(sdmmc_dev(host), "%s\n", __func__);
+ mutex_lock(&ucr->dev_mutex);
+
+- if (rtsx_usb_card_exclusive_check(ucr, RTSX_USB_SD_CARD)) {
+- mutex_unlock(&ucr->dev_mutex);
+- return;
+- }
+-
+ sd_set_power_mode(host, ios->power_mode);
+ sd_set_bus_width(host, ios->bus_width);
+ sd_set_timing(host, ios->timing, &host->ddr_mode);
+@@ -1314,6 +1309,7 @@ static void rtsx_usb_update_led(struct work_struct *work)
+ container_of(work, struct rtsx_usb_sdmmc, led_work);
+ struct rtsx_ucr *ucr = host->ucr;
+
++ pm_runtime_get_sync(sdmmc_dev(host));
+ mutex_lock(&ucr->dev_mutex);
+
+ if (host->led.brightness == LED_OFF)
+@@ -1322,6 +1318,7 @@ static void rtsx_usb_update_led(struct work_struct *work)
+ rtsx_usb_turn_on_led(ucr);
+
+ mutex_unlock(&ucr->dev_mutex);
++ pm_runtime_put(sdmmc_dev(host));
+ }
+ #endif
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index cd65d47..a8a022a 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -687,7 +687,7 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd)
+ * host->clock is in Hz. target_timeout is in us.
+ * Hence, us = 1000000 * cycles / Hz. Round up.
+ */
+- val = 1000000 * data->timeout_clks;
++ val = 1000000ULL * data->timeout_clks;
+ if (do_div(val, host->clock))
+ target_timeout++;
+ target_timeout += val;
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index f453326..b419c7c 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -644,7 +644,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ int shutdown)
+ {
+ int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
+- int vol_id = -1, lnum = -1;
++ int erase = 0, keep = 0, vol_id = -1, lnum = -1;
+ #ifdef CONFIG_MTD_UBI_FASTMAP
+ int anchor = wrk->anchor;
+ #endif
+@@ -780,6 +780,16 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ e1->pnum);
+ scrubbing = 1;
+ goto out_not_moved;
++ } else if (ubi->fast_attach && err == UBI_IO_BAD_HDR_EBADMSG) {
++ /*
++ * While a full scan would detect interrupted erasures
++ * at attach time we can face them here when attached from
++ * Fastmap.
++ */
++ dbg_wl("PEB %d has ECC errors, maybe from an interrupted erasure",
++ e1->pnum);
++ erase = 1;
++ goto out_not_moved;
+ }
+
+ ubi_err(ubi, "error %d while reading VID header from PEB %d",
+@@ -815,6 +825,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ * Target PEB had bit-flips or write error - torture it.
+ */
+ torture = 1;
++ keep = 1;
+ goto out_not_moved;
+ }
+
+@@ -901,7 +912,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ ubi->erroneous_peb_count += 1;
+ } else if (scrubbing)
+ wl_tree_add(e1, &ubi->scrub);
+- else
++ else if (keep)
+ wl_tree_add(e1, &ubi->used);
+ if (dst_leb_clean) {
+ wl_tree_add(e2, &ubi->free);
+@@ -922,6 +933,12 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ goto out_ro;
+ }
+
++ if (erase) {
++ err = do_sync_erase(ubi, e1, vol_id, lnum, 1);
++ if (err)
++ goto out_ro;
++ }
++
+ mutex_unlock(&ubi->move_mutex);
+ return 0;
+
+diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
+index 9fb8d74..da9998e 100644
+--- a/drivers/net/wireless/ath/ath10k/ce.c
++++ b/drivers/net/wireless/ath/ath10k/ce.c
+@@ -433,6 +433,13 @@ void ath10k_ce_rx_update_write_idx(struct ath10k_ce_pipe *pipe, u32 nentries)
+ unsigned int nentries_mask = dest_ring->nentries_mask;
+ unsigned int write_index = dest_ring->write_index;
+ u32 ctrl_addr = pipe->ctrl_addr;
++ u32 cur_write_idx = ath10k_ce_dest_ring_write_index_get(ar, ctrl_addr);
++
++ /* Prevent CE ring stuck issue that will occur when ring is full.
++ * Make sure that write index is 1 less than read index.
++ */
++ if ((cur_write_idx + nentries) == dest_ring->sw_index)
++ nentries -= 1;
+
+ write_index = CE_RING_IDX_ADD(nentries_mask, write_index, nentries);
+ ath10k_ce_dest_ring_write_index_set(ar, ctrl_addr, write_index);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/regd.c b/drivers/net/wireless/realtek/rtlwifi/regd.c
+index 3524441..6ee6bf8 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/regd.c
++++ b/drivers/net/wireless/realtek/rtlwifi/regd.c
+@@ -345,9 +345,9 @@ static const struct ieee80211_regdomain *_rtl_regdomain_select(
+ return &rtl_regdom_no_midband;
+ case COUNTRY_CODE_IC:
+ return &rtl_regdom_11;
+- case COUNTRY_CODE_ETSI:
+ case COUNTRY_CODE_TELEC_NETGEAR:
+ return &rtl_regdom_60_64;
++ case COUNTRY_CODE_ETSI:
+ case COUNTRY_CODE_SPAIN:
+ case COUNTRY_CODE_FRANCE:
+ case COUNTRY_CODE_ISRAEL:
+@@ -406,6 +406,8 @@ static u8 channel_plan_to_country_code(u8 channelplan)
+ return COUNTRY_CODE_WORLD_WIDE_13;
+ case 0x22:
+ return COUNTRY_CODE_IC;
++ case 0x25:
++ return COUNTRY_CODE_ETSI;
+ case 0x32:
+ return COUNTRY_CODE_TELEC_NETGEAR;
+ case 0x41:
+diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
+index 6de0757..84d650d 100644
+--- a/drivers/pci/host/pci-tegra.c
++++ b/drivers/pci/host/pci-tegra.c
+@@ -856,7 +856,7 @@ static int tegra_pcie_phy_disable(struct tegra_pcie *pcie)
+ /* override IDDQ */
+ value = pads_readl(pcie, PADS_CTL);
+ value |= PADS_CTL_IDDQ_1L;
+- pads_writel(pcie, PADS_CTL, value);
++ pads_writel(pcie, value, PADS_CTL);
+
+ /* reset PLL */
+ value = pads_readl(pcie, soc->pads_pll_ctl);
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 44e0ff3..4bf1a88 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3198,6 +3198,7 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
+
+ static void quirk_no_pm_reset(struct pci_dev *dev)
+ {
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index d22a9fe..71bbeb9 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -1808,6 +1808,8 @@ static int byt_pinctrl_probe(struct platform_device *pdev)
+ return PTR_ERR(vg->pctl_dev);
+ }
+
++ raw_spin_lock_init(&vg->lock);
++
+ ret = byt_gpio_probe(vg);
+ if (ret) {
+ pinctrl_unregister(vg->pctl_dev);
+@@ -1815,7 +1817,6 @@ static int byt_pinctrl_probe(struct platform_device *pdev)
+ }
+
+ platform_set_drvdata(pdev, vg);
+- raw_spin_lock_init(&vg->lock);
+ pm_runtime_enable(&pdev->dev);
+
+ return 0;
+diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
+index 257cab1..2b5b20bf 100644
+--- a/drivers/pinctrl/intel/pinctrl-intel.c
++++ b/drivers/pinctrl/intel/pinctrl-intel.c
+@@ -19,6 +19,7 @@
+ #include <linux/pinctrl/pinconf.h>
+ #include <linux/pinctrl/pinconf-generic.h>
+
++#include "../core.h"
+ #include "pinctrl-intel.h"
+
+ /* Offset from regs */
+@@ -1079,6 +1080,26 @@ int intel_pinctrl_remove(struct platform_device *pdev)
+ EXPORT_SYMBOL_GPL(intel_pinctrl_remove);
+
+ #ifdef CONFIG_PM_SLEEP
++static bool intel_pinctrl_should_save(struct intel_pinctrl *pctrl, unsigned pin)
++{
++ const struct pin_desc *pd = pin_desc_get(pctrl->pctldev, pin);
++
++ if (!pd || !intel_pad_usable(pctrl, pin))
++ return false;
++
++ /*
++ * Only restore the pin if it is actually in use by the kernel (or
++ * by userspace). It is possible that some pins are used by the
++ * BIOS during resume and those are not always locked down so leave
++ * them alone.
++ */
++ if (pd->mux_owner || pd->gpio_owner ||
++ gpiochip_line_is_irq(&pctrl->chip, pin))
++ return true;
++
++ return false;
++}
++
+ int intel_pinctrl_suspend(struct device *dev)
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+@@ -1092,7 +1113,7 @@ int intel_pinctrl_suspend(struct device *dev)
+ const struct pinctrl_pin_desc *desc = &pctrl->soc->pins[i];
+ u32 val;
+
+- if (!intel_pad_usable(pctrl, desc->number))
++ if (!intel_pinctrl_should_save(pctrl, desc->number))
+ continue;
+
+ val = readl(intel_get_padcfg(pctrl, desc->number, PADCFG0));
+@@ -1153,7 +1174,7 @@ int intel_pinctrl_resume(struct device *dev)
+ void __iomem *padcfg;
+ u32 val;
+
+- if (!intel_pad_usable(pctrl, desc->number))
++ if (!intel_pinctrl_should_save(pctrl, desc->number))
+ continue;
+
+ padcfg = intel_get_padcfg(pctrl, desc->number, PADCFG0);
+diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
+index fb991ec..696116e 100644
+--- a/drivers/regulator/tps65910-regulator.c
++++ b/drivers/regulator/tps65910-regulator.c
+@@ -1111,6 +1111,12 @@ static int tps65910_probe(struct platform_device *pdev)
+ pmic->num_regulators = ARRAY_SIZE(tps65910_regs);
+ pmic->ext_sleep_control = tps65910_ext_sleep_control;
+ info = tps65910_regs;
++ /* Work around silicon erratum SWCZ010: output programmed
++ * voltage level can go higher than expected or crash
++ * Workaround: use no synchronization of DCDC clocks
++ */
++ tps65910_reg_clear_bits(pmic->mfd, TPS65910_DCDCCTRL,
++ DCDCCTRL_DCDCCKSYNC_MASK);
+ break;
+ case TPS65911:
+ pmic->get_ctrl_reg = &tps65911_get_ctrl_register;
+diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
+index 5d7fbe4..5810019 100644
+--- a/drivers/s390/scsi/zfcp_dbf.c
++++ b/drivers/s390/scsi/zfcp_dbf.c
+@@ -3,7 +3,7 @@
+ *
+ * Debug traces for zfcp.
+ *
+- * Copyright IBM Corp. 2002, 2013
++ * Copyright IBM Corp. 2002, 2016
+ */
+
+ #define KMSG_COMPONENT "zfcp"
+@@ -65,7 +65,7 @@ void zfcp_dbf_pl_write(struct zfcp_dbf *dbf, void *data, u16 length, char *area,
+ * @tag: tag indicating which kind of unsolicited status has been received
+ * @req: request for which a response was received
+ */
+-void zfcp_dbf_hba_fsf_res(char *tag, struct zfcp_fsf_req *req)
++void zfcp_dbf_hba_fsf_res(char *tag, int level, struct zfcp_fsf_req *req)
+ {
+ struct zfcp_dbf *dbf = req->adapter->dbf;
+ struct fsf_qtcb_prefix *q_pref = &req->qtcb->prefix;
+@@ -85,6 +85,8 @@ void zfcp_dbf_hba_fsf_res(char *tag, struct zfcp_fsf_req *req)
+ rec->u.res.req_issued = req->issued;
+ rec->u.res.prot_status = q_pref->prot_status;
+ rec->u.res.fsf_status = q_head->fsf_status;
++ rec->u.res.port_handle = q_head->port_handle;
++ rec->u.res.lun_handle = q_head->lun_handle;
+
+ memcpy(rec->u.res.prot_status_qual, &q_pref->prot_status_qual,
+ FSF_PROT_STATUS_QUAL_SIZE);
+@@ -97,7 +99,7 @@ void zfcp_dbf_hba_fsf_res(char *tag, struct zfcp_fsf_req *req)
+ rec->pl_len, "fsf_res", req->req_id);
+ }
+
+- debug_event(dbf->hba, 1, rec, sizeof(*rec));
++ debug_event(dbf->hba, level, rec, sizeof(*rec));
+ spin_unlock_irqrestore(&dbf->hba_lock, flags);
+ }
+
+@@ -241,7 +243,8 @@ static void zfcp_dbf_set_common(struct zfcp_dbf_rec *rec,
+ if (sdev) {
+ rec->lun_status = atomic_read(&sdev_to_zfcp(sdev)->status);
+ rec->lun = zfcp_scsi_dev_lun(sdev);
+- }
++ } else
++ rec->lun = ZFCP_DBF_INVALID_LUN;
+ }
+
+ /**
+@@ -320,13 +323,48 @@ void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
+ spin_unlock_irqrestore(&dbf->rec_lock, flags);
+ }
+
++/**
++ * zfcp_dbf_rec_run_wka - trace wka port event with info like running recovery
++ * @tag: identifier for event
++ * @wka_port: well known address port
++ * @req_id: request ID to correlate with potential HBA trace record
++ */
++void zfcp_dbf_rec_run_wka(char *tag, struct zfcp_fc_wka_port *wka_port,
++ u64 req_id)
++{
++ struct zfcp_dbf *dbf = wka_port->adapter->dbf;
++ struct zfcp_dbf_rec *rec = &dbf->rec_buf;
++ unsigned long flags;
++
++ spin_lock_irqsave(&dbf->rec_lock, flags);
++ memset(rec, 0, sizeof(*rec));
++
++ rec->id = ZFCP_DBF_REC_RUN;
++ memcpy(rec->tag, tag, ZFCP_DBF_TAG_LEN);
++ rec->port_status = wka_port->status;
++ rec->d_id = wka_port->d_id;
++ rec->lun = ZFCP_DBF_INVALID_LUN;
++
++ rec->u.run.fsf_req_id = req_id;
++ rec->u.run.rec_status = ~0;
++ rec->u.run.rec_step = ~0;
++ rec->u.run.rec_action = ~0;
++ rec->u.run.rec_count = ~0;
++
++ debug_event(dbf->rec, 1, rec, sizeof(*rec));
++ spin_unlock_irqrestore(&dbf->rec_lock, flags);
++}
++
+ static inline
+-void zfcp_dbf_san(char *tag, struct zfcp_dbf *dbf, void *data, u8 id, u16 len,
+- u64 req_id, u32 d_id)
++void zfcp_dbf_san(char *tag, struct zfcp_dbf *dbf,
++ char *paytag, struct scatterlist *sg, u8 id, u16 len,
++ u64 req_id, u32 d_id, u16 cap_len)
+ {
+ struct zfcp_dbf_san *rec = &dbf->san_buf;
+ u16 rec_len;
+ unsigned long flags;
++ struct zfcp_dbf_pay *payload = &dbf->pay_buf;
++ u16 pay_sum = 0;
+
+ spin_lock_irqsave(&dbf->san_lock, flags);
+ memset(rec, 0, sizeof(*rec));
+@@ -334,10 +372,41 @@ void zfcp_dbf_san(char *tag, struct zfcp_dbf *dbf, void *data, u8 id, u16 len,
+ rec->id = id;
+ rec->fsf_req_id = req_id;
+ rec->d_id = d_id;
+- rec_len = min(len, (u16)ZFCP_DBF_SAN_MAX_PAYLOAD);
+- memcpy(rec->payload, data, rec_len);
+ memcpy(rec->tag, tag, ZFCP_DBF_TAG_LEN);
++ rec->pl_len = len; /* full length even if we cap pay below */
++ if (!sg)
++ goto out;
++ rec_len = min_t(unsigned int, sg->length, ZFCP_DBF_SAN_MAX_PAYLOAD);
++ memcpy(rec->payload, sg_virt(sg), rec_len); /* part of 1st sg entry */
++ if (len <= rec_len)
++ goto out; /* skip pay record if full content in rec->payload */
++
++ /* if (len > rec_len):
++ * dump data up to cap_len ignoring small duplicate in rec->payload
++ */
++ spin_lock(&dbf->pay_lock);
++ memset(payload, 0, sizeof(*payload));
++ memcpy(payload->area, paytag, ZFCP_DBF_TAG_LEN);
++ payload->fsf_req_id = req_id;
++ payload->counter = 0;
++ for (; sg && pay_sum < cap_len; sg = sg_next(sg)) {
++ u16 pay_len, offset = 0;
++
++ while (offset < sg->length && pay_sum < cap_len) {
++ pay_len = min((u16)ZFCP_DBF_PAY_MAX_REC,
++ (u16)(sg->length - offset));
++ /* cap_len <= pay_sum < cap_len+ZFCP_DBF_PAY_MAX_REC */
++ memcpy(payload->data, sg_virt(sg) + offset, pay_len);
++ debug_event(dbf->pay, 1, payload,
++ zfcp_dbf_plen(pay_len));
++ payload->counter++;
++ offset += pay_len;
++ pay_sum += pay_len;
++ }
++ }
++ spin_unlock(&dbf->pay_lock);
+
++out:
+ debug_event(dbf->san, 1, rec, sizeof(*rec));
+ spin_unlock_irqrestore(&dbf->san_lock, flags);
+ }
+@@ -354,9 +423,62 @@ void zfcp_dbf_san_req(char *tag, struct zfcp_fsf_req *fsf, u32 d_id)
+ struct zfcp_fsf_ct_els *ct_els = fsf->data;
+ u16 length;
+
+- length = (u16)(ct_els->req->length + FC_CT_HDR_LEN);
+- zfcp_dbf_san(tag, dbf, sg_virt(ct_els->req), ZFCP_DBF_SAN_REQ, length,
+- fsf->req_id, d_id);
++ length = (u16)zfcp_qdio_real_bytes(ct_els->req);
++ zfcp_dbf_san(tag, dbf, "san_req", ct_els->req, ZFCP_DBF_SAN_REQ,
++ length, fsf->req_id, d_id, length);
++}
++
++static u16 zfcp_dbf_san_res_cap_len_if_gpn_ft(char *tag,
++ struct zfcp_fsf_req *fsf,
++ u16 len)
++{
++ struct zfcp_fsf_ct_els *ct_els = fsf->data;
++ struct fc_ct_hdr *reqh = sg_virt(ct_els->req);
++ struct fc_ns_gid_ft *reqn = (struct fc_ns_gid_ft *)(reqh + 1);
++ struct scatterlist *resp_entry = ct_els->resp;
++ struct fc_gpn_ft_resp *acc;
++ int max_entries, x, last = 0;
++
++ if (!(memcmp(tag, "fsscth2", 7) == 0
++ && ct_els->d_id == FC_FID_DIR_SERV
++ && reqh->ct_rev == FC_CT_REV
++ && reqh->ct_in_id[0] == 0
++ && reqh->ct_in_id[1] == 0
++ && reqh->ct_in_id[2] == 0
++ && reqh->ct_fs_type == FC_FST_DIR
++ && reqh->ct_fs_subtype == FC_NS_SUBTYPE
++ && reqh->ct_options == 0
++ && reqh->_ct_resvd1 == 0
++ && reqh->ct_cmd == FC_NS_GPN_FT
++ /* reqh->ct_mr_size can vary so do not match but read below */
++ && reqh->_ct_resvd2 == 0
++ && reqh->ct_reason == 0
++ && reqh->ct_explan == 0
++ && reqh->ct_vendor == 0
++ && reqn->fn_resvd == 0
++ && reqn->fn_domain_id_scope == 0
++ && reqn->fn_area_id_scope == 0
++ && reqn->fn_fc4_type == FC_TYPE_FCP))
++ return len; /* not GPN_FT response so do not cap */
++
++ acc = sg_virt(resp_entry);
++ max_entries = (reqh->ct_mr_size * 4 / sizeof(struct fc_gpn_ft_resp))
++ + 1 /* zfcp_fc_scan_ports: bytes correct, entries off-by-one
++ * to account for header as 1st pseudo "entry" */;
++
++ /* the basic CT_IU preamble is the same size as one entry in the GPN_FT
++ * response, allowing us to skip special handling for it - just skip it
++ */
++ for (x = 1; x < max_entries && !last; x++) {
++ if (x % (ZFCP_FC_GPN_FT_ENT_PAGE + 1))
++ acc++;
++ else
++ acc = sg_virt(++resp_entry);
++
++ last = acc->fp_flags & FC_NS_FID_LAST;
++ }
++ len = min(len, (u16)(x * sizeof(struct fc_gpn_ft_resp)));
++ return len; /* cap after last entry */
+ }
+
+ /**
+@@ -370,9 +492,10 @@ void zfcp_dbf_san_res(char *tag, struct zfcp_fsf_req *fsf)
+ struct zfcp_fsf_ct_els *ct_els = fsf->data;
+ u16 length;
+
+- length = (u16)(ct_els->resp->length + FC_CT_HDR_LEN);
+- zfcp_dbf_san(tag, dbf, sg_virt(ct_els->resp), ZFCP_DBF_SAN_RES, length,
+- fsf->req_id, 0);
++ length = (u16)zfcp_qdio_real_bytes(ct_els->resp);
++ zfcp_dbf_san(tag, dbf, "san_res", ct_els->resp, ZFCP_DBF_SAN_RES,
++ length, fsf->req_id, ct_els->d_id,
++ zfcp_dbf_san_res_cap_len_if_gpn_ft(tag, fsf, length));
+ }
+
+ /**
+@@ -386,11 +509,13 @@ void zfcp_dbf_san_in_els(char *tag, struct zfcp_fsf_req *fsf)
+ struct fsf_status_read_buffer *srb =
+ (struct fsf_status_read_buffer *) fsf->data;
+ u16 length;
++ struct scatterlist sg;
+
+ length = (u16)(srb->length -
+ offsetof(struct fsf_status_read_buffer, payload));
+- zfcp_dbf_san(tag, dbf, srb->payload.data, ZFCP_DBF_SAN_ELS, length,
+- fsf->req_id, ntoh24(srb->d_id));
++ sg_init_one(&sg, srb->payload.data, length);
++ zfcp_dbf_san(tag, dbf, "san_els", &sg, ZFCP_DBF_SAN_ELS, length,
++ fsf->req_id, ntoh24(srb->d_id), length);
+ }
+
+ /**
+@@ -399,7 +524,8 @@ void zfcp_dbf_san_in_els(char *tag, struct zfcp_fsf_req *fsf)
+ * @sc: pointer to struct scsi_cmnd
+ * @fsf: pointer to struct zfcp_fsf_req
+ */
+-void zfcp_dbf_scsi(char *tag, struct scsi_cmnd *sc, struct zfcp_fsf_req *fsf)
++void zfcp_dbf_scsi(char *tag, int level, struct scsi_cmnd *sc,
++ struct zfcp_fsf_req *fsf)
+ {
+ struct zfcp_adapter *adapter =
+ (struct zfcp_adapter *) sc->device->host->hostdata[0];
+@@ -442,7 +568,7 @@ void zfcp_dbf_scsi(char *tag, struct scsi_cmnd *sc, struct zfcp_fsf_req *fsf)
+ }
+ }
+
+- debug_event(dbf->scsi, 1, rec, sizeof(*rec));
++ debug_event(dbf->scsi, level, rec, sizeof(*rec));
+ spin_unlock_irqrestore(&dbf->scsi_lock, flags);
+ }
+
+diff --git a/drivers/s390/scsi/zfcp_dbf.h b/drivers/s390/scsi/zfcp_dbf.h
+index 0be3d48..36d0758 100644
+--- a/drivers/s390/scsi/zfcp_dbf.h
++++ b/drivers/s390/scsi/zfcp_dbf.h
+@@ -2,7 +2,7 @@
+ * zfcp device driver
+ * debug feature declarations
+ *
+- * Copyright IBM Corp. 2008, 2010
++ * Copyright IBM Corp. 2008, 2015
+ */
+
+ #ifndef ZFCP_DBF_H
+@@ -17,6 +17,11 @@
+
+ #define ZFCP_DBF_INVALID_LUN 0xFFFFFFFFFFFFFFFFull
+
++enum zfcp_dbf_pseudo_erp_act_type {
++ ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD = 0xff,
++ ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL = 0xfe,
++};
++
+ /**
+ * struct zfcp_dbf_rec_trigger - trace record for triggered recovery action
+ * @ready: number of ready recovery actions
+@@ -110,6 +115,7 @@ struct zfcp_dbf_san {
+ u32 d_id;
+ #define ZFCP_DBF_SAN_MAX_PAYLOAD (FC_CT_HDR_LEN + 32)
+ char payload[ZFCP_DBF_SAN_MAX_PAYLOAD];
++ u16 pl_len;
+ } __packed;
+
+ /**
+@@ -126,6 +132,8 @@ struct zfcp_dbf_hba_res {
+ u8 prot_status_qual[FSF_PROT_STATUS_QUAL_SIZE];
+ u32 fsf_status;
+ u8 fsf_status_qual[FSF_STATUS_QUALIFIER_SIZE];
++ u32 port_handle;
++ u32 lun_handle;
+ } __packed;
+
+ /**
+@@ -279,7 +287,7 @@ static inline
+ void zfcp_dbf_hba_fsf_resp(char *tag, int level, struct zfcp_fsf_req *req)
+ {
+ if (debug_level_enabled(req->adapter->dbf->hba, level))
+- zfcp_dbf_hba_fsf_res(tag, req);
++ zfcp_dbf_hba_fsf_res(tag, level, req);
+ }
+
+ /**
+@@ -318,7 +326,7 @@ void _zfcp_dbf_scsi(char *tag, int level, struct scsi_cmnd *scmd,
+ scmd->device->host->hostdata[0];
+
+ if (debug_level_enabled(adapter->dbf->scsi, level))
+- zfcp_dbf_scsi(tag, scmd, req);
++ zfcp_dbf_scsi(tag, level, scmd, req);
+ }
+
+ /**
+diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
+index 3fb4109..a59d678 100644
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -3,7 +3,7 @@
+ *
+ * Error Recovery Procedures (ERP).
+ *
+- * Copyright IBM Corp. 2002, 2010
++ * Copyright IBM Corp. 2002, 2015
+ */
+
+ #define KMSG_COMPONENT "zfcp"
+@@ -1217,8 +1217,14 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
+ break;
+
+ case ZFCP_ERP_ACTION_REOPEN_PORT:
+- if (result == ZFCP_ERP_SUCCEEDED)
+- zfcp_scsi_schedule_rport_register(port);
++ /* This switch case might also happen after a forced reopen
++ * was successfully done and thus overwritten with a new
++ * non-forced reopen at `ersfs_2'. In this case, we must not
++ * do the clean-up of the non-forced version.
++ */
++ if (act->step != ZFCP_ERP_STEP_UNINITIALIZED)
++ if (result == ZFCP_ERP_SUCCEEDED)
++ zfcp_scsi_schedule_rport_register(port);
+ /* fall through */
+ case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
+ put_device(&port->dev);
+diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
+index 5b50065..c8fed9f 100644
+--- a/drivers/s390/scsi/zfcp_ext.h
++++ b/drivers/s390/scsi/zfcp_ext.h
+@@ -3,7 +3,7 @@
+ *
+ * External function declarations.
+ *
+- * Copyright IBM Corp. 2002, 2010
++ * Copyright IBM Corp. 2002, 2015
+ */
+
+ #ifndef ZFCP_EXT_H
+@@ -35,8 +35,9 @@ extern void zfcp_dbf_adapter_unregister(struct zfcp_adapter *);
+ extern void zfcp_dbf_rec_trig(char *, struct zfcp_adapter *,
+ struct zfcp_port *, struct scsi_device *, u8, u8);
+ extern void zfcp_dbf_rec_run(char *, struct zfcp_erp_action *);
++extern void zfcp_dbf_rec_run_wka(char *, struct zfcp_fc_wka_port *, u64);
+ extern void zfcp_dbf_hba_fsf_uss(char *, struct zfcp_fsf_req *);
+-extern void zfcp_dbf_hba_fsf_res(char *, struct zfcp_fsf_req *);
++extern void zfcp_dbf_hba_fsf_res(char *, int, struct zfcp_fsf_req *);
+ extern void zfcp_dbf_hba_bit_err(char *, struct zfcp_fsf_req *);
+ extern void zfcp_dbf_hba_berr(struct zfcp_dbf *, struct zfcp_fsf_req *);
+ extern void zfcp_dbf_hba_def_err(struct zfcp_adapter *, u64, u16, void **);
+@@ -44,7 +45,8 @@ extern void zfcp_dbf_hba_basic(char *, struct zfcp_adapter *);
+ extern void zfcp_dbf_san_req(char *, struct zfcp_fsf_req *, u32);
+ extern void zfcp_dbf_san_res(char *, struct zfcp_fsf_req *);
+ extern void zfcp_dbf_san_in_els(char *, struct zfcp_fsf_req *);
+-extern void zfcp_dbf_scsi(char *, struct scsi_cmnd *, struct zfcp_fsf_req *);
++extern void zfcp_dbf_scsi(char *, int, struct scsi_cmnd *,
++ struct zfcp_fsf_req *);
+
+ /* zfcp_erp.c */
+ extern void zfcp_erp_set_adapter_status(struct zfcp_adapter *, u32);
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index 522a633..75f820ca 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -3,7 +3,7 @@
+ *
+ * Implementation of FSF commands.
+ *
+- * Copyright IBM Corp. 2002, 2013
++ * Copyright IBM Corp. 2002, 2015
+ */
+
+ #define KMSG_COMPONENT "zfcp"
+@@ -508,7 +508,10 @@ static int zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *req)
+ fc_host_port_type(shost) = FC_PORTTYPE_PTP;
+ break;
+ case FSF_TOPO_FABRIC:
+- fc_host_port_type(shost) = FC_PORTTYPE_NPORT;
++ if (bottom->connection_features & FSF_FEATURE_NPIV_MODE)
++ fc_host_port_type(shost) = FC_PORTTYPE_NPIV;
++ else
++ fc_host_port_type(shost) = FC_PORTTYPE_NPORT;
+ break;
+ case FSF_TOPO_AL:
+ fc_host_port_type(shost) = FC_PORTTYPE_NLPORT;
+@@ -613,7 +616,6 @@ static void zfcp_fsf_exchange_port_evaluate(struct zfcp_fsf_req *req)
+
+ if (adapter->connection_features & FSF_FEATURE_NPIV_MODE) {
+ fc_host_permanent_port_name(shost) = bottom->wwpn;
+- fc_host_port_type(shost) = FC_PORTTYPE_NPIV;
+ } else
+ fc_host_permanent_port_name(shost) = fc_host_port_name(shost);
+ fc_host_maxframe_size(shost) = bottom->maximum_frame_size;
+@@ -982,8 +984,12 @@ static int zfcp_fsf_setup_ct_els_sbals(struct zfcp_fsf_req *req,
+ if (zfcp_adapter_multi_buffer_active(adapter)) {
+ if (zfcp_qdio_sbals_from_sg(qdio, &req->qdio_req, sg_req))
+ return -EIO;
++ qtcb->bottom.support.req_buf_length =
++ zfcp_qdio_real_bytes(sg_req);
+ if (zfcp_qdio_sbals_from_sg(qdio, &req->qdio_req, sg_resp))
+ return -EIO;
++ qtcb->bottom.support.resp_buf_length =
++ zfcp_qdio_real_bytes(sg_resp);
+
+ zfcp_qdio_set_data_div(qdio, &req->qdio_req,
+ zfcp_qdio_sbale_count(sg_req));
+@@ -1073,6 +1079,7 @@ int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *wka_port,
+
+ req->handler = zfcp_fsf_send_ct_handler;
+ req->qtcb->header.port_handle = wka_port->handle;
++ ct->d_id = wka_port->d_id;
+ req->data = ct;
+
+ zfcp_dbf_san_req("fssct_1", req, wka_port->d_id);
+@@ -1169,6 +1176,7 @@ int zfcp_fsf_send_els(struct zfcp_adapter *adapter, u32 d_id,
+
+ hton24(req->qtcb->bottom.support.d_id, d_id);
+ req->handler = zfcp_fsf_send_els_handler;
++ els->d_id = d_id;
+ req->data = els;
+
+ zfcp_dbf_san_req("fssels1", req, d_id);
+@@ -1575,7 +1583,7 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req)
+ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ {
+ struct zfcp_qdio *qdio = wka_port->adapter->qdio;
+- struct zfcp_fsf_req *req;
++ struct zfcp_fsf_req *req = NULL;
+ int retval = -EIO;
+
+ spin_lock_irq(&qdio->req_q_lock);
+@@ -1604,6 +1612,8 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ zfcp_fsf_req_free(req);
+ out:
+ spin_unlock_irq(&qdio->req_q_lock);
++ if (req && !IS_ERR(req))
++ zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
+ return retval;
+ }
+
+@@ -1628,7 +1638,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req)
+ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ {
+ struct zfcp_qdio *qdio = wka_port->adapter->qdio;
+- struct zfcp_fsf_req *req;
++ struct zfcp_fsf_req *req = NULL;
+ int retval = -EIO;
+
+ spin_lock_irq(&qdio->req_q_lock);
+@@ -1657,6 +1667,8 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ zfcp_fsf_req_free(req);
+ out:
+ spin_unlock_irq(&qdio->req_q_lock);
++ if (req && !IS_ERR(req))
++ zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id);
+ return retval;
+ }
+
+diff --git a/drivers/s390/scsi/zfcp_fsf.h b/drivers/s390/scsi/zfcp_fsf.h
+index 57ae3ae..be1c04b 100644
+--- a/drivers/s390/scsi/zfcp_fsf.h
++++ b/drivers/s390/scsi/zfcp_fsf.h
+@@ -3,7 +3,7 @@
+ *
+ * Interface to the FSF support functions.
+ *
+- * Copyright IBM Corp. 2002, 2010
++ * Copyright IBM Corp. 2002, 2015
+ */
+
+ #ifndef FSF_H
+@@ -436,6 +436,7 @@ struct zfcp_blk_drv_data {
+ * @handler_data: data passed to handler function
+ * @port: Optional pointer to port for zfcp internal ELS (only test link ADISC)
+ * @status: used to pass error status to calling function
++ * @d_id: Destination ID of either open WKA port for CT or of D_ID for ELS
+ */
+ struct zfcp_fsf_ct_els {
+ struct scatterlist *req;
+@@ -444,6 +445,7 @@ struct zfcp_fsf_ct_els {
+ void *handler_data;
+ struct zfcp_port *port;
+ int status;
++ u32 d_id;
+ };
+
+ #endif /* FSF_H */
+diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
+index b3c6ff4..9069f98 100644
+--- a/drivers/s390/scsi/zfcp_scsi.c
++++ b/drivers/s390/scsi/zfcp_scsi.c
+@@ -3,7 +3,7 @@
+ *
+ * Interface to Linux SCSI midlayer.
+ *
+- * Copyright IBM Corp. 2002, 2013
++ * Copyright IBM Corp. 2002, 2015
+ */
+
+ #define KMSG_COMPONENT "zfcp"
+@@ -556,6 +556,9 @@ static void zfcp_scsi_rport_register(struct zfcp_port *port)
+ ids.port_id = port->d_id;
+ ids.roles = FC_RPORT_ROLE_FCP_TARGET;
+
++ zfcp_dbf_rec_trig("scpaddy", port->adapter, port, NULL,
++ ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD,
++ ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD);
+ rport = fc_remote_port_add(port->adapter->scsi_host, 0, &ids);
+ if (!rport) {
+ dev_err(&port->adapter->ccw_device->dev,
+@@ -577,6 +580,9 @@ static void zfcp_scsi_rport_block(struct zfcp_port *port)
+ struct fc_rport *rport = port->rport;
+
+ if (rport) {
++ zfcp_dbf_rec_trig("scpdely", port->adapter, port, NULL,
++ ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL,
++ ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL);
+ fc_remote_port_delete(rport);
+ port->rport = NULL;
+ }
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index e0a78f5..bac8cdf 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -1472,12 +1472,12 @@ static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
+ out_err:
+ kfree(lun_data);
+ out:
+- scsi_device_put(sdev);
+ if (scsi_device_created(sdev))
+ /*
+ * the sdev we used didn't appear in the report luns scan
+ */
+ __scsi_remove_device(sdev);
++ scsi_device_put(sdev);
+ return ret;
+ }
+
+diff --git a/drivers/soc/fsl/qe/gpio.c b/drivers/soc/fsl/qe/gpio.c
+index 333eb22..0aaf429 100644
+--- a/drivers/soc/fsl/qe/gpio.c
++++ b/drivers/soc/fsl/qe/gpio.c
+@@ -41,7 +41,8 @@ struct qe_gpio_chip {
+
+ static void qe_gpio_save_regs(struct of_mm_gpio_chip *mm_gc)
+ {
+- struct qe_gpio_chip *qe_gc = gpiochip_get_data(&mm_gc->gc);
++ struct qe_gpio_chip *qe_gc =
++ container_of(mm_gc, struct qe_gpio_chip, mm_gc);
+ struct qe_pio_regs __iomem *regs = mm_gc->regs;
+
+ qe_gc->cpdata = in_be32(&regs->cpdata);
+diff --git a/drivers/soc/fsl/qe/qe_common.c b/drivers/soc/fsl/qe/qe_common.c
+index 41eff80..104e68d 100644
+--- a/drivers/soc/fsl/qe/qe_common.c
++++ b/drivers/soc/fsl/qe/qe_common.c
+@@ -70,6 +70,11 @@ int cpm_muram_init(void)
+ }
+
+ muram_pool = gen_pool_create(0, -1);
++ if (!muram_pool) {
++ pr_err("Cannot allocate memory pool for CPM/QE muram");
++ ret = -ENOMEM;
++ goto out_muram;
++ }
+ muram_pbase = of_translate_address(np, zero);
+ if (muram_pbase == (phys_addr_t)OF_BAD_ADDR) {
+ pr_err("Cannot translate zero through CPM muram node");
+@@ -116,6 +121,9 @@ static unsigned long cpm_muram_alloc_common(unsigned long size,
+ struct muram_block *entry;
+ unsigned long start;
+
++ if (!muram_pool && cpm_muram_init())
++ goto out2;
++
+ start = gen_pool_alloc_algo(muram_pool, size, algo, data);
+ if (!start)
+ goto out2;
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 6094a6b..e825d58 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -754,15 +754,7 @@ EXPORT_SYMBOL(target_complete_cmd);
+
+ void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length)
+ {
+- if (scsi_status != SAM_STAT_GOOD) {
+- return;
+- }
+-
+- /*
+- * Calculate new residual count based upon length of SCSI data
+- * transferred.
+- */
+- if (length < cmd->data_length) {
++ if (scsi_status == SAM_STAT_GOOD && length < cmd->data_length) {
+ if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
+ cmd->residual_count += cmd->data_length - length;
+ } else {
+@@ -771,12 +763,6 @@ void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int len
+ }
+
+ cmd->data_length = length;
+- } else if (length > cmd->data_length) {
+- cmd->se_cmd_flags |= SCF_OVERFLOW_BIT;
+- cmd->residual_count = length - cmd->data_length;
+- } else {
+- cmd->se_cmd_flags &= ~(SCF_OVERFLOW_BIT | SCF_UNDERFLOW_BIT);
+- cmd->residual_count = 0;
+ }
+
+ target_complete_cmd(cmd, scsi_status);
+@@ -1706,6 +1692,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
+ case TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED:
+ case TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED:
+ case TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED:
++ case TCM_COPY_TARGET_DEVICE_NOT_REACHABLE:
+ break;
+ case TCM_OUT_OF_RESOURCES:
+ sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+@@ -2547,8 +2534,10 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref)
+ * fabric acknowledgement that requires two target_put_sess_cmd()
+ * invocations before se_cmd descriptor release.
+ */
+- if (ack_kref)
++ if (ack_kref) {
+ kref_get(&se_cmd->cmd_kref);
++ se_cmd->se_cmd_flags |= SCF_ACK_KREF;
++ }
+
+ spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
+ if (se_sess->sess_tearing_down) {
+@@ -2871,6 +2860,12 @@ static const struct sense_info sense_info_table[] = {
+ .ascq = 0x03, /* LOGICAL BLOCK REFERENCE TAG CHECK FAILED */
+ .add_sector_info = true,
+ },
++ [TCM_COPY_TARGET_DEVICE_NOT_REACHABLE] = {
++ .key = COPY_ABORTED,
++ .asc = 0x0d,
++ .ascq = 0x02, /* COPY TARGET DEVICE NOT REACHABLE */
++
++ },
+ [TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE] = {
+ /*
+ * Returning ILLEGAL REQUEST would cause immediate IO errors on
+diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
+index 75cd854..094a144 100644
+--- a/drivers/target/target_core_xcopy.c
++++ b/drivers/target/target_core_xcopy.c
+@@ -104,7 +104,7 @@ static int target_xcopy_locate_se_dev_e4(struct se_cmd *se_cmd, struct xcopy_op
+ }
+ mutex_unlock(&g_device_mutex);
+
+- pr_err("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
++ pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
+ return -EINVAL;
+ }
+
+@@ -185,7 +185,7 @@ static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op
+
+ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
+ struct xcopy_op *xop, unsigned char *p,
+- unsigned short tdll)
++ unsigned short tdll, sense_reason_t *sense_ret)
+ {
+ struct se_device *local_dev = se_cmd->se_dev;
+ unsigned char *desc = p;
+@@ -193,6 +193,8 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
+ unsigned short start = 0;
+ bool src = true;
+
++ *sense_ret = TCM_INVALID_PARAMETER_LIST;
++
+ if (offset != 0) {
+ pr_err("XCOPY target descriptor list length is not"
+ " multiple of %d\n", XCOPY_TARGET_DESC_LEN);
+@@ -243,9 +245,16 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
+ rc = target_xcopy_locate_se_dev_e4(se_cmd, xop, true);
+ else
+ rc = target_xcopy_locate_se_dev_e4(se_cmd, xop, false);
+-
+- if (rc < 0)
++ /*
++ * If a matching IEEE NAA 0x83 descriptor for the requested device
++ * is not located on this node, return COPY_ABORTED with ASQ/ASQC
++ * 0x0d/0x02 - COPY_TARGET_DEVICE_NOT_REACHABLE to request the
++ * initiator to fall back to normal copy method.
++ */
++ if (rc < 0) {
++ *sense_ret = TCM_COPY_TARGET_DEVICE_NOT_REACHABLE;
+ goto out;
++ }
+
+ pr_debug("XCOPY TGT desc: Source dev: %p NAA IEEE WWN: 0x%16phN\n",
+ xop->src_dev, &xop->src_tid_wwn[0]);
+@@ -653,6 +662,7 @@ static int target_xcopy_read_source(
+ rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, src_dev, &cdb[0],
+ remote_port, true);
+ if (rc < 0) {
++ ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
+ transport_generic_free_cmd(se_cmd, 0);
+ return rc;
+ }
+@@ -664,6 +674,7 @@ static int target_xcopy_read_source(
+
+ rc = target_xcopy_issue_pt_cmd(xpt_cmd);
+ if (rc < 0) {
++ ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
+ transport_generic_free_cmd(se_cmd, 0);
+ return rc;
+ }
+@@ -714,6 +725,7 @@ static int target_xcopy_write_destination(
+ remote_port, false);
+ if (rc < 0) {
+ struct se_cmd *src_cmd = &xop->src_pt_cmd->se_cmd;
++ ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
+ /*
+ * If the failure happened before the t_mem_list hand-off in
+ * target_xcopy_setup_pt_cmd(), Reset memory + clear flag so that
+@@ -729,6 +741,7 @@ static int target_xcopy_write_destination(
+
+ rc = target_xcopy_issue_pt_cmd(xpt_cmd);
+ if (rc < 0) {
++ ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
+ se_cmd->se_cmd_flags &= ~SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC;
+ transport_generic_free_cmd(se_cmd, 0);
+ return rc;
+@@ -815,9 +828,14 @@ static void target_xcopy_do_work(struct work_struct *work)
+ out:
+ xcopy_pt_undepend_remotedev(xop);
+ kfree(xop);
+-
+- pr_warn("target_xcopy_do_work: Setting X-COPY CHECK_CONDITION -> sending response\n");
+- ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
++ /*
++ * Don't override an error scsi status if it has already been set
++ */
++ if (ec_cmd->scsi_status == SAM_STAT_GOOD) {
++ pr_warn_ratelimited("target_xcopy_do_work: rc: %d, Setting X-COPY"
++ " CHECK_CONDITION -> sending response\n", rc);
++ ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
++ }
+ target_complete_cmd(ec_cmd, SAM_STAT_CHECK_CONDITION);
+ }
+
+@@ -875,7 +893,7 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
+ " tdll: %hu sdll: %u inline_dl: %u\n", list_id, list_id_usage,
+ tdll, sdll, inline_dl);
+
+- rc = target_xcopy_parse_target_descriptors(se_cmd, xop, &p[16], tdll);
++ rc = target_xcopy_parse_target_descriptors(se_cmd, xop, &p[16], tdll, &ret);
+ if (rc <= 0)
+ goto out;
+
+diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
+index 216e18c..9a874a8 100644
+--- a/drivers/target/tcm_fc/tfc_cmd.c
++++ b/drivers/target/tcm_fc/tfc_cmd.c
+@@ -572,7 +572,7 @@ static void ft_send_work(struct work_struct *work)
+ if (target_submit_cmd(&cmd->se_cmd, cmd->sess->se_sess, fcp->fc_cdb,
+ &cmd->ft_sense_buffer[0], scsilun_to_int(&fcp->fc_lun),
+ ntohl(fcp->fc_dl), task_attr, data_dir,
+- TARGET_SCF_ACK_KREF))
++ TARGET_SCF_ACK_KREF | TARGET_SCF_USE_CPUID))
+ goto err;
+
+ pr_debug("r_ctl %x alloc target_submit_cmd\n", fh->fh_r_ctl);
+diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
+index 924bad4..37a37c4 100644
+--- a/drivers/video/fbdev/efifb.c
++++ b/drivers/video/fbdev/efifb.c
+@@ -50,9 +50,9 @@ static int efifb_setcolreg(unsigned regno, unsigned red, unsigned green,
+ return 1;
+
+ if (regno < 16) {
+- red >>= 8;
+- green >>= 8;
+- blue >>= 8;
++ red >>= 16 - info->var.red.length;
++ green >>= 16 - info->var.green.length;
++ blue >>= 16 - info->var.blue.length;
+ ((u32 *)(info->pseudo_palette))[regno] =
+ (red << info->var.red.offset) |
+ (green << info->var.green.offset) |
+diff --git a/drivers/watchdog/mt7621_wdt.c b/drivers/watchdog/mt7621_wdt.c
+index 4a2290f..d5735c1 100644
+--- a/drivers/watchdog/mt7621_wdt.c
++++ b/drivers/watchdog/mt7621_wdt.c
+@@ -139,7 +139,6 @@ static int mt7621_wdt_probe(struct platform_device *pdev)
+ if (!IS_ERR(mt7621_wdt_reset))
+ reset_control_deassert(mt7621_wdt_reset);
+
+- mt7621_wdt_dev.dev = &pdev->dev;
+ mt7621_wdt_dev.bootstatus = mt7621_wdt_bootcause();
+
+ watchdog_init_timeout(&mt7621_wdt_dev, mt7621_wdt_dev.max_timeout,
+diff --git a/drivers/watchdog/rt2880_wdt.c b/drivers/watchdog/rt2880_wdt.c
+index 1967919..14b4fd4 100644
+--- a/drivers/watchdog/rt2880_wdt.c
++++ b/drivers/watchdog/rt2880_wdt.c
+@@ -158,7 +158,6 @@ static int rt288x_wdt_probe(struct platform_device *pdev)
+
+ rt288x_wdt_freq = clk_get_rate(rt288x_wdt_clk) / RALINK_WDT_PRESCALE;
+
+- rt288x_wdt_dev.dev = &pdev->dev;
+ rt288x_wdt_dev.bootstatus = rt288x_wdt_bootcause();
+ rt288x_wdt_dev.max_timeout = (0xfffful / rt288x_wdt_freq);
+ rt288x_wdt_dev.parent = &pdev->dev;
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index 0f5375d..eede975 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -1272,7 +1272,8 @@ static ssize_t ceph_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ statret = __ceph_do_getattr(inode, page,
+ CEPH_STAT_CAP_INLINE_DATA, !!page);
+ if (statret < 0) {
+- __free_page(page);
++ if (page)
++ __free_page(page);
+ if (statret == -ENODATA) {
+ BUG_ON(retry_op != READ_INLINE);
+ goto again;
+diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
+index 6c58e13..3d03e48 100644
+--- a/fs/cifs/cifs_debug.c
++++ b/fs/cifs/cifs_debug.c
+@@ -152,6 +152,7 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
+ list_for_each(tmp1, &cifs_tcp_ses_list) {
+ server = list_entry(tmp1, struct TCP_Server_Info,
+ tcp_ses_list);
++ seq_printf(m, "\nNumber of credits: %d", server->credits);
+ i++;
+ list_for_each(tmp2, &server->smb_ses_list) {
+ ses = list_entry(tmp2, struct cifs_ses,
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 14ae4b8..8c68d03 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -271,7 +271,7 @@ cifs_alloc_inode(struct super_block *sb)
+ cifs_inode->createtime = 0;
+ cifs_inode->epoch = 0;
+ #ifdef CONFIG_CIFS_SMB2
+- get_random_bytes(cifs_inode->lease_key, SMB2_LEASE_KEY_SIZE);
++ generate_random_uuid(cifs_inode->lease_key);
+ #endif
+ /*
+ * Can not set i_flags here - they get immediately overwritten to zero
+@@ -1271,7 +1271,6 @@ init_cifs(void)
+ GlobalTotalActiveXid = 0;
+ GlobalMaxActiveXid = 0;
+ spin_lock_init(&cifs_tcp_ses_lock);
+- spin_lock_init(&cifs_file_list_lock);
+ spin_lock_init(&GlobalMid_Lock);
+
+ get_random_bytes(&cifs_lock_secret, sizeof(cifs_lock_secret));
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 8f1d8c1..65f78b7 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -833,6 +833,7 @@ struct cifs_tcon {
+ struct list_head tcon_list;
+ int tc_count;
+ struct list_head openFileList;
++ spinlock_t open_file_lock; /* protects list above */
+ struct cifs_ses *ses; /* pointer to session associated with */
+ char treeName[MAX_TREE_SIZE + 1]; /* UNC name of resource in ASCII */
+ char *nativeFileSystem;
+@@ -889,7 +890,7 @@ struct cifs_tcon {
+ #endif /* CONFIG_CIFS_STATS2 */
+ __u64 bytes_read;
+ __u64 bytes_written;
+- spinlock_t stat_lock;
++ spinlock_t stat_lock; /* protects the two fields above */
+ #endif /* CONFIG_CIFS_STATS */
+ FILE_SYSTEM_DEVICE_INFO fsDevInfo;
+ FILE_SYSTEM_ATTRIBUTE_INFO fsAttrInfo; /* ok if fs name truncated */
+@@ -1040,8 +1041,10 @@ struct cifs_fid_locks {
+ };
+
+ struct cifsFileInfo {
++ /* following two lists are protected by tcon->open_file_lock */
+ struct list_head tlist; /* pointer to next fid owned by tcon */
+ struct list_head flist; /* next fid (file instance) for this inode */
++ /* lock list below protected by cifsi->lock_sem */
+ struct cifs_fid_locks *llist; /* brlocks held by this fid */
+ kuid_t uid; /* allows finding which FileInfo structure */
+ __u32 pid; /* process id who opened file */
+@@ -1049,11 +1052,12 @@ struct cifsFileInfo {
+ /* BB add lock scope info here if needed */ ;
+ /* lock scope id (0 if none) */
+ struct dentry *dentry;
+- unsigned int f_flags;
+ struct tcon_link *tlink;
++ unsigned int f_flags;
+ bool invalidHandle:1; /* file closed via session abend */
+ bool oplock_break_cancelled:1;
+- int count; /* refcount protected by cifs_file_list_lock */
++ int count;
++ spinlock_t file_info_lock; /* protects four flag/count fields above */
+ struct mutex fh_mutex; /* prevents reopen race after dead ses*/
+ struct cifs_search_info srch_inf;
+ struct work_struct oplock_break; /* work for oplock breaks */
+@@ -1120,7 +1124,7 @@ struct cifs_writedata {
+
+ /*
+ * Take a reference on the file private data. Must be called with
+- * cifs_file_list_lock held.
++ * cfile->file_info_lock held.
+ */
+ static inline void
+ cifsFileInfo_get_locked(struct cifsFileInfo *cifs_file)
+@@ -1514,8 +1518,10 @@ require use of the stronger protocol */
+ * GlobalMid_Lock protects:
+ * list operations on pending_mid_q and oplockQ
+ * updates to XID counters, multiplex id and SMB sequence numbers
+- * cifs_file_list_lock protects:
+- * list operations on tcp and SMB session lists and tCon lists
++ * tcp_ses_lock protects:
++ * list operations on tcp and SMB session lists
++ * tcon->open_file_lock protects the list of open files hanging off the tcon
++ * cfile->file_info_lock protects counters and fields in cifs file struct
+ * f_owner.lock protects certain per file struct operations
+ * mapping->page_lock protects certain per page operations
+ *
+@@ -1547,18 +1553,12 @@ GLOBAL_EXTERN struct list_head cifs_tcp_ses_list;
+ * tcp session, and the list of tcon's per smb session. It also protects
+ * the reference counters for the server, smb session, and tcon. Finally,
+ * changes to the tcon->tidStatus should be done while holding this lock.
++ * generally the locks should be taken in order tcp_ses_lock before
++ * tcon->open_file_lock and that before file->file_info_lock since the
++ * structure order is cifs_socket-->cifs_ses-->cifs_tcon-->cifs_file
+ */
+ GLOBAL_EXTERN spinlock_t cifs_tcp_ses_lock;
+
+-/*
+- * This lock protects the cifs_file->llist and cifs_file->flist
+- * list operations, and updates to some flags (cifs_file->invalidHandle)
+- * It will be moved to either use the tcon->stat_lock or equivalent later.
+- * If cifs_tcp_ses_lock and the lock below are both needed to be held, then
+- * the cifs_tcp_ses_lock must be grabbed first and released last.
+- */
+-GLOBAL_EXTERN spinlock_t cifs_file_list_lock;
+-
+ #ifdef CONFIG_CIFS_DNOTIFY_EXPERIMENTAL /* unused temporarily */
+ /* Outstanding dir notify requests */
+ GLOBAL_EXTERN struct list_head GlobalDnotifyReqList;
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index d47197e..7804605 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -98,13 +98,13 @@ cifs_mark_open_files_invalid(struct cifs_tcon *tcon)
+ struct list_head *tmp1;
+
+ /* list all files open on tree connection and mark them invalid */
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&tcon->open_file_lock);
+ list_for_each_safe(tmp, tmp1, &tcon->openFileList) {
+ open_file = list_entry(tmp, struct cifsFileInfo, tlist);
+ open_file->invalidHandle = true;
+ open_file->oplock_break_cancelled = true;
+ }
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tcon->open_file_lock);
+ /*
+ * BB Add call to invalidate_inodes(sb) for all superblocks mounted
+ * to this tcon.
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 2e4f4ba..7b67179 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2163,7 +2163,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
+ memcpy(&tcp_ses->dstaddr, &volume_info->dstaddr,
+ sizeof(tcp_ses->dstaddr));
+ #ifdef CONFIG_CIFS_SMB2
+- get_random_bytes(tcp_ses->client_guid, SMB2_CLIENT_GUID_SIZE);
++ generate_random_uuid(tcp_ses->client_guid);
+ #endif
+ /*
+ * at this point we are the only ones with the pointer
+@@ -3688,14 +3688,16 @@ cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
+ goto mount_fail_check;
+ }
+
+- rc = cifs_are_all_path_components_accessible(server,
++ if (rc != -EREMOTE) {
++ rc = cifs_are_all_path_components_accessible(server,
+ xid, tcon, cifs_sb,
+ full_path);
+- if (rc != 0) {
+- cifs_dbg(VFS, "cannot query dirs between root and final path, "
+- "enabling CIFS_MOUNT_USE_PREFIX_PATH\n");
+- cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
+- rc = 0;
++ if (rc != 0) {
++ cifs_dbg(VFS, "cannot query dirs between root and final path, "
++ "enabling CIFS_MOUNT_USE_PREFIX_PATH\n");
++ cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
++ rc = 0;
++ }
+ }
+ kfree(full_path);
+ }
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 579e41b..605438a 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -305,6 +305,7 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
+ cfile->tlink = cifs_get_tlink(tlink);
+ INIT_WORK(&cfile->oplock_break, cifs_oplock_break);
+ mutex_init(&cfile->fh_mutex);
++ spin_lock_init(&cfile->file_info_lock);
+
+ cifs_sb_active(inode->i_sb);
+
+@@ -317,7 +318,7 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
+ oplock = 0;
+ }
+
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&tcon->open_file_lock);
+ if (fid->pending_open->oplock != CIFS_OPLOCK_NO_CHANGE && oplock)
+ oplock = fid->pending_open->oplock;
+ list_del(&fid->pending_open->olist);
+@@ -326,12 +327,13 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
+ server->ops->set_fid(cfile, fid, oplock);
+
+ list_add(&cfile->tlist, &tcon->openFileList);
++
+ /* if readable file instance put first in list*/
+ if (file->f_mode & FMODE_READ)
+ list_add(&cfile->flist, &cinode->openFileList);
+ else
+ list_add_tail(&cfile->flist, &cinode->openFileList);
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tcon->open_file_lock);
+
+ if (fid->purge_cache)
+ cifs_zap_mapping(inode);
+@@ -343,16 +345,16 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
+ struct cifsFileInfo *
+ cifsFileInfo_get(struct cifsFileInfo *cifs_file)
+ {
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&cifs_file->file_info_lock);
+ cifsFileInfo_get_locked(cifs_file);
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&cifs_file->file_info_lock);
+ return cifs_file;
+ }
+
+ /*
+ * Release a reference on the file private data. This may involve closing
+ * the filehandle out on the server. Must be called without holding
+- * cifs_file_list_lock.
++ * tcon->open_file_lock and cifs_file->file_info_lock.
+ */
+ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+ {
+@@ -367,11 +369,15 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+ struct cifs_pending_open open;
+ bool oplock_break_cancelled;
+
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&tcon->open_file_lock);
++
++ spin_lock(&cifs_file->file_info_lock);
+ if (--cifs_file->count > 0) {
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&cifs_file->file_info_lock);
++ spin_unlock(&tcon->open_file_lock);
+ return;
+ }
++ spin_unlock(&cifs_file->file_info_lock);
+
+ if (server->ops->get_lease_key)
+ server->ops->get_lease_key(inode, &fid);
+@@ -395,7 +401,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+ set_bit(CIFS_INO_INVALID_MAPPING, &cifsi->flags);
+ cifs_set_oplock_level(cifsi, 0);
+ }
+- spin_unlock(&cifs_file_list_lock);
++
++ spin_unlock(&tcon->open_file_lock);
+
+ oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break);
+
+@@ -772,10 +779,10 @@ int cifs_closedir(struct inode *inode, struct file *file)
+ server = tcon->ses->server;
+
+ cifs_dbg(FYI, "Freeing private data in close dir\n");
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&cfile->file_info_lock);
+ if (server->ops->dir_needs_close(cfile)) {
+ cfile->invalidHandle = true;
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&cfile->file_info_lock);
+ if (server->ops->close_dir)
+ rc = server->ops->close_dir(xid, tcon, &cfile->fid);
+ else
+@@ -784,7 +791,7 @@ int cifs_closedir(struct inode *inode, struct file *file)
+ /* not much we can do if it fails anyway, ignore rc */
+ rc = 0;
+ } else
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&cfile->file_info_lock);
+
+ buf = cfile->srch_inf.ntwrk_buf_start;
+ if (buf) {
+@@ -1728,12 +1735,13 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
+ {
+ struct cifsFileInfo *open_file = NULL;
+ struct cifs_sb_info *cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb);
++ struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
+
+ /* only filter by fsuid on multiuser mounts */
+ if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
+ fsuid_only = false;
+
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&tcon->open_file_lock);
+ /* we could simply get the first_list_entry since write-only entries
+ are always at the end of the list but since the first entry might
+ have a close pending, we go through the whole list */
+@@ -1744,8 +1752,8 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
+ if (!open_file->invalidHandle) {
+ /* found a good file */
+ /* lock it so it will not be closed on us */
+- cifsFileInfo_get_locked(open_file);
+- spin_unlock(&cifs_file_list_lock);
++ cifsFileInfo_get(open_file);
++ spin_unlock(&tcon->open_file_lock);
+ return open_file;
+ } /* else might as well continue, and look for
+ another, or simply have the caller reopen it
+@@ -1753,7 +1761,7 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
+ } else /* write only file */
+ break; /* write only files are last so must be done */
+ }
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tcon->open_file_lock);
+ return NULL;
+ }
+
+@@ -1762,6 +1770,7 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
+ {
+ struct cifsFileInfo *open_file, *inv_file = NULL;
+ struct cifs_sb_info *cifs_sb;
++ struct cifs_tcon *tcon;
+ bool any_available = false;
+ int rc;
+ unsigned int refind = 0;
+@@ -1777,15 +1786,16 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
+ }
+
+ cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb);
++ tcon = cifs_sb_master_tcon(cifs_sb);
+
+ /* only filter by fsuid on multiuser mounts */
+ if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
+ fsuid_only = false;
+
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&tcon->open_file_lock);
+ refind_writable:
+ if (refind > MAX_REOPEN_ATT) {
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tcon->open_file_lock);
+ return NULL;
+ }
+ list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
+@@ -1796,8 +1806,8 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
+ if (OPEN_FMODE(open_file->f_flags) & FMODE_WRITE) {
+ if (!open_file->invalidHandle) {
+ /* found a good writable file */
+- cifsFileInfo_get_locked(open_file);
+- spin_unlock(&cifs_file_list_lock);
++ cifsFileInfo_get(open_file);
++ spin_unlock(&tcon->open_file_lock);
+ return open_file;
+ } else {
+ if (!inv_file)
+@@ -1813,24 +1823,24 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
+
+ if (inv_file) {
+ any_available = false;
+- cifsFileInfo_get_locked(inv_file);
++ cifsFileInfo_get(inv_file);
+ }
+
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tcon->open_file_lock);
+
+ if (inv_file) {
+ rc = cifs_reopen_file(inv_file, false);
+ if (!rc)
+ return inv_file;
+ else {
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&tcon->open_file_lock);
+ list_move_tail(&inv_file->flist,
+ &cifs_inode->openFileList);
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tcon->open_file_lock);
+ cifsFileInfo_put(inv_file);
+- spin_lock(&cifs_file_list_lock);
+ ++refind;
+ inv_file = NULL;
++ spin_lock(&tcon->open_file_lock);
+ goto refind_writable;
+ }
+ }
+@@ -3618,15 +3628,17 @@ static int cifs_readpage(struct file *file, struct page *page)
+ static int is_inode_writable(struct cifsInodeInfo *cifs_inode)
+ {
+ struct cifsFileInfo *open_file;
++ struct cifs_tcon *tcon =
++ cifs_sb_master_tcon(CIFS_SB(cifs_inode->vfs_inode.i_sb));
+
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&tcon->open_file_lock);
+ list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
+ if (OPEN_FMODE(open_file->f_flags) & FMODE_WRITE) {
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tcon->open_file_lock);
+ return 1;
+ }
+ }
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tcon->open_file_lock);
+ return 0;
+ }
+
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index 813fe13..c672915 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -120,6 +120,7 @@ tconInfoAlloc(void)
+ ++ret_buf->tc_count;
+ INIT_LIST_HEAD(&ret_buf->openFileList);
+ INIT_LIST_HEAD(&ret_buf->tcon_list);
++ spin_lock_init(&ret_buf->open_file_lock);
+ #ifdef CONFIG_CIFS_STATS
+ spin_lock_init(&ret_buf->stat_lock);
+ #endif
+@@ -465,7 +466,7 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
+ continue;
+
+ cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks);
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&tcon->open_file_lock);
+ list_for_each(tmp2, &tcon->openFileList) {
+ netfile = list_entry(tmp2, struct cifsFileInfo,
+ tlist);
+@@ -495,11 +496,11 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
+ &netfile->oplock_break);
+ netfile->oplock_break_cancelled = false;
+
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tcon->open_file_lock);
+ spin_unlock(&cifs_tcp_ses_lock);
+ return true;
+ }
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tcon->open_file_lock);
+ spin_unlock(&cifs_tcp_ses_lock);
+ cifs_dbg(FYI, "No matching file for oplock break\n");
+ return true;
+@@ -613,9 +614,9 @@ backup_cred(struct cifs_sb_info *cifs_sb)
+ void
+ cifs_del_pending_open(struct cifs_pending_open *open)
+ {
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&tlink_tcon(open->tlink)->open_file_lock);
+ list_del(&open->olist);
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tlink_tcon(open->tlink)->open_file_lock);
+ }
+
+ void
+@@ -635,7 +636,7 @@ void
+ cifs_add_pending_open(struct cifs_fid *fid, struct tcon_link *tlink,
+ struct cifs_pending_open *open)
+ {
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&tlink_tcon(tlink)->open_file_lock);
+ cifs_add_pending_open_locked(fid, tlink, open);
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tlink_tcon(open->tlink)->open_file_lock);
+ }
+diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
+index 65cf85d..8f6a2a5 100644
+--- a/fs/cifs/readdir.c
++++ b/fs/cifs/readdir.c
+@@ -597,14 +597,14 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos,
+ is_dir_changed(file)) || (index_to_find < first_entry_in_buffer)) {
+ /* close and restart search */
+ cifs_dbg(FYI, "search backing up - close and restart search\n");
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&cfile->file_info_lock);
+ if (server->ops->dir_needs_close(cfile)) {
+ cfile->invalidHandle = true;
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&cfile->file_info_lock);
+ if (server->ops->close_dir)
+ server->ops->close_dir(xid, tcon, &cfile->fid);
+ } else
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&cfile->file_info_lock);
+ if (cfile->srch_inf.ntwrk_buf_start) {
+ cifs_dbg(FYI, "freeing SMB ff cache buf on search rewind\n");
+ if (cfile->srch_inf.smallBuf)
+diff --git a/fs/cifs/smb2glob.h b/fs/cifs/smb2glob.h
+index 0ffa180..238759c 100644
+--- a/fs/cifs/smb2glob.h
++++ b/fs/cifs/smb2glob.h
+@@ -61,4 +61,14 @@
+ /* Maximum buffer size value we can send with 1 credit */
+ #define SMB2_MAX_BUFFER_SIZE 65536
+
++/*
++ * Maximum number of credits to keep available.
++ * This value is chosen somewhat arbitrarily. The Windows client
++ * defaults to 128 credits, the Windows server allows clients up to
++ * 512 credits, and the NetApp server does not limit clients at all.
++ * Choose a high enough value such that the client shouldn't limit
++ * performance.
++ */
++#define SMB2_MAX_CREDITS_AVAILABLE 32000
++
+ #endif /* _SMB2_GLOB_H */
+diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c
+index 4f0231e..1238cd3 100644
+--- a/fs/cifs/smb2inode.c
++++ b/fs/cifs/smb2inode.c
+@@ -266,9 +266,15 @@ smb2_set_file_info(struct inode *inode, const char *full_path,
+ struct tcon_link *tlink;
+ int rc;
+
++ if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) &&
++ (buf->LastWriteTime == 0) && (buf->ChangeTime) &&
++ (buf->Attributes == 0))
++ return 0; /* would be a no op, no sense sending this */
++
+ tlink = cifs_sb_tlink(cifs_sb);
+ if (IS_ERR(tlink))
+ return PTR_ERR(tlink);
++
+ rc = smb2_open_op_close(xid, tlink_tcon(tlink), cifs_sb, full_path,
+ FILE_WRITE_ATTRIBUTES, FILE_OPEN, 0, buf,
+ SMB2_OP_SET_INFO);
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 389fb9f..3d38348 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -549,19 +549,19 @@ smb2_is_valid_lease_break(char *buffer)
+ list_for_each(tmp1, &server->smb_ses_list) {
+ ses = list_entry(tmp1, struct cifs_ses, smb_ses_list);
+
+- spin_lock(&cifs_file_list_lock);
+ list_for_each(tmp2, &ses->tcon_list) {
+ tcon = list_entry(tmp2, struct cifs_tcon,
+ tcon_list);
++ spin_lock(&tcon->open_file_lock);
+ cifs_stats_inc(
+ &tcon->stats.cifs_stats.num_oplock_brks);
+ if (smb2_tcon_has_lease(tcon, rsp, lw)) {
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tcon->open_file_lock);
+ spin_unlock(&cifs_tcp_ses_lock);
+ return true;
+ }
++ spin_unlock(&tcon->open_file_lock);
+ }
+- spin_unlock(&cifs_file_list_lock);
+ }
+ }
+ spin_unlock(&cifs_tcp_ses_lock);
+@@ -603,7 +603,7 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
+
+ cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks);
+- spin_lock(&cifs_file_list_lock);
++ spin_lock(&tcon->open_file_lock);
+ list_for_each(tmp2, &tcon->openFileList) {
+ cfile = list_entry(tmp2, struct cifsFileInfo,
+ tlist);
+@@ -615,7 +615,7 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+
+ cifs_dbg(FYI, "file id match, oplock break\n");
+ cinode = CIFS_I(d_inode(cfile->dentry));
+-
++ spin_lock(&cfile->file_info_lock);
+ if (!CIFS_CACHE_WRITE(cinode) &&
+ rsp->OplockLevel == SMB2_OPLOCK_LEVEL_NONE)
+ cfile->oplock_break_cancelled = true;
+@@ -637,14 +637,14 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ clear_bit(
+ CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+ &cinode->flags);
+-
++ spin_unlock(&cfile->file_info_lock);
+ queue_work(cifsiod_wq, &cfile->oplock_break);
+
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tcon->open_file_lock);
+ spin_unlock(&cifs_tcp_ses_lock);
+ return true;
+ }
+- spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&tcon->open_file_lock);
+ spin_unlock(&cifs_tcp_ses_lock);
+ cifs_dbg(FYI, "No matching file for oplock break\n");
+ return true;
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index d203c03..0e73cef 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -287,7 +287,7 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon)
+ cifs_dbg(FYI, "Link Speed %lld\n",
+ le64_to_cpu(out_buf->LinkSpeed));
+ }
+-
++ kfree(out_buf);
+ return rc;
+ }
+ #endif /* STATS2 */
+@@ -541,6 +541,7 @@ smb2_set_fid(struct cifsFileInfo *cfile, struct cifs_fid *fid, __u32 oplock)
+ server->ops->set_oplock_level(cinode, oplock, fid->epoch,
+ &fid->purge_cache);
+ cinode->can_cache_brlcks = CIFS_CACHE_WRITE(cinode);
++ memcpy(cfile->fid.create_guid, fid->create_guid, 16);
+ }
+
+ static void
+@@ -699,6 +700,7 @@ smb2_clone_range(const unsigned int xid,
+
+ cchunk_out:
+ kfree(pcchunk);
++ kfree(retbuf);
+ return rc;
+ }
+
+@@ -823,7 +825,6 @@ smb2_duplicate_extents(const unsigned int xid,
+ {
+ int rc;
+ unsigned int ret_data_len;
+- char *retbuf = NULL;
+ struct duplicate_extents_to_file dup_ext_buf;
+ struct cifs_tcon *tcon = tlink_tcon(trgtfile->tlink);
+
+@@ -849,7 +850,7 @@ smb2_duplicate_extents(const unsigned int xid,
+ FSCTL_DUPLICATE_EXTENTS_TO_FILE,
+ true /* is_fsctl */, (char *)&dup_ext_buf,
+ sizeof(struct duplicate_extents_to_file),
+- (char **)&retbuf,
++ NULL,
+ &ret_data_len);
+
+ if (ret_data_len > 0)
+@@ -872,7 +873,6 @@ smb3_set_integrity(const unsigned int xid, struct cifs_tcon *tcon,
+ struct cifsFileInfo *cfile)
+ {
+ struct fsctl_set_integrity_information_req integr_info;
+- char *retbuf = NULL;
+ unsigned int ret_data_len;
+
+ integr_info.ChecksumAlgorithm = cpu_to_le16(CHECKSUM_TYPE_UNCHANGED);
+@@ -884,7 +884,7 @@ smb3_set_integrity(const unsigned int xid, struct cifs_tcon *tcon,
+ FSCTL_SET_INTEGRITY_INFORMATION,
+ true /* is_fsctl */, (char *)&integr_info,
+ sizeof(struct fsctl_set_integrity_information_req),
+- (char **)&retbuf,
++ NULL,
+ &ret_data_len);
+
+ }
+@@ -1041,7 +1041,7 @@ smb2_set_lease_key(struct inode *inode, struct cifs_fid *fid)
+ static void
+ smb2_new_lease_key(struct cifs_fid *fid)
+ {
+- get_random_bytes(fid->lease_key, SMB2_LEASE_KEY_SIZE);
++ generate_random_uuid(fid->lease_key);
+ }
+
+ #define SMB2_SYMLINK_STRUCT_SIZE \
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 29e06db..3eec96c 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -100,7 +100,21 @@ smb2_hdr_assemble(struct smb2_hdr *hdr, __le16 smb2_cmd /* command */ ,
+ hdr->ProtocolId = SMB2_PROTO_NUMBER;
+ hdr->StructureSize = cpu_to_le16(64);
+ hdr->Command = smb2_cmd;
+- hdr->CreditRequest = cpu_to_le16(2); /* BB make this dynamic */
++ if (tcon && tcon->ses && tcon->ses->server) {
++ struct TCP_Server_Info *server = tcon->ses->server;
++
++ spin_lock(&server->req_lock);
++ /* Request up to 2 credits but don't go over the limit. */
++ if (server->credits >= SMB2_MAX_CREDITS_AVAILABLE)
++ hdr->CreditRequest = cpu_to_le16(0);
++ else
++ hdr->CreditRequest = cpu_to_le16(
++ min_t(int, SMB2_MAX_CREDITS_AVAILABLE -
++ server->credits, 2));
++ spin_unlock(&server->req_lock);
++ } else {
++ hdr->CreditRequest = cpu_to_le16(2);
++ }
+ hdr->ProcessId = cpu_to_le32((__u16)current->tgid);
+
+ if (!tcon)
+@@ -590,6 +604,7 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
+ char *security_blob = NULL;
+ unsigned char *ntlmssp_blob = NULL;
+ bool use_spnego = false; /* else use raw ntlmssp */
++ u64 previous_session = ses->Suid;
+
+ cifs_dbg(FYI, "Session Setup\n");
+
+@@ -627,6 +642,10 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
+ return rc;
+
+ req->hdr.SessionId = 0; /* First session, not a reauthenticate */
++
++ /* if reconnect, we need to send previous sess id, otherwise it is 0 */
++ req->PreviousSessionId = previous_session;
++
+ req->Flags = 0; /* MBZ */
+ /* to enable echos and oplocks */
+ req->hdr.CreditRequest = cpu_to_le16(3);
+@@ -1164,7 +1183,7 @@ create_durable_v2_buf(struct cifs_fid *pfid)
+
+ buf->dcontext.Timeout = 0; /* Should this be configurable by workload */
+ buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
+- get_random_bytes(buf->dcontext.CreateGuid, 16);
++ generate_random_uuid(buf->dcontext.CreateGuid);
+ memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16);
+
+ /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */
+@@ -2057,6 +2076,7 @@ smb2_async_readv(struct cifs_readdata *rdata)
+ if (rdata->credits) {
+ buf->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
+ SMB2_MAX_BUFFER_SIZE));
++ buf->CreditRequest = buf->CreditCharge;
+ spin_lock(&server->req_lock);
+ server->credits += rdata->credits -
+ le16_to_cpu(buf->CreditCharge);
+@@ -2243,6 +2263,7 @@ smb2_async_writev(struct cifs_writedata *wdata,
+ if (wdata->credits) {
+ req->hdr.CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes,
+ SMB2_MAX_BUFFER_SIZE));
++ req->hdr.CreditRequest = req->hdr.CreditCharge;
+ spin_lock(&server->req_lock);
+ server->credits += wdata->credits -
+ le16_to_cpu(req->hdr.CreditCharge);
+diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
+index ff88d9f..fd3709e 100644
+--- a/fs/cifs/smb2pdu.h
++++ b/fs/cifs/smb2pdu.h
+@@ -276,7 +276,7 @@ struct smb2_sess_setup_req {
+ __le32 Channel;
+ __le16 SecurityBufferOffset;
+ __le16 SecurityBufferLength;
+- __le64 PreviousSessionId;
++ __u64 PreviousSessionId;
+ __u8 Buffer[1]; /* variable length GSS security buffer */
+ } __packed;
+
+diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
+index c502c11..55d64fb 100644
+--- a/fs/crypto/crypto.c
++++ b/fs/crypto/crypto.c
+@@ -152,7 +152,10 @@ static int do_page_crypto(struct inode *inode,
+ struct page *src_page, struct page *dest_page,
+ gfp_t gfp_flags)
+ {
+- u8 xts_tweak[FS_XTS_TWEAK_SIZE];
++ struct {
++ __le64 index;
++ u8 padding[FS_XTS_TWEAK_SIZE - sizeof(__le64)];
++ } xts_tweak;
+ struct skcipher_request *req = NULL;
+ DECLARE_FS_COMPLETION_RESULT(ecr);
+ struct scatterlist dst, src;
+@@ -172,17 +175,15 @@ static int do_page_crypto(struct inode *inode,
+ req, CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
+ fscrypt_complete, &ecr);
+
+- BUILD_BUG_ON(FS_XTS_TWEAK_SIZE < sizeof(index));
+- memcpy(xts_tweak, &index, sizeof(index));
+- memset(&xts_tweak[sizeof(index)], 0,
+- FS_XTS_TWEAK_SIZE - sizeof(index));
++ BUILD_BUG_ON(sizeof(xts_tweak) != FS_XTS_TWEAK_SIZE);
++ xts_tweak.index = cpu_to_le64(index);
++ memset(xts_tweak.padding, 0, sizeof(xts_tweak.padding));
+
+ sg_init_table(&dst, 1);
+ sg_set_page(&dst, dest_page, PAGE_SIZE, 0);
+ sg_init_table(&src, 1);
+ sg_set_page(&src, src_page, PAGE_SIZE, 0);
+- skcipher_request_set_crypt(req, &src, &dst, PAGE_SIZE,
+- xts_tweak);
++ skcipher_request_set_crypt(req, &src, &dst, PAGE_SIZE, &xts_tweak);
+ if (rw == FS_DECRYPT)
+ res = crypto_skcipher_decrypt(req);
+ else
+diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
+index ed115ac..6865663 100644
+--- a/fs/crypto/policy.c
++++ b/fs/crypto/policy.c
+@@ -109,6 +109,8 @@ int fscrypt_process_policy(struct file *filp,
+ if (ret)
+ return ret;
+
++ inode_lock(inode);
++
+ if (!inode_has_encryption_context(inode)) {
+ if (!S_ISDIR(inode->i_mode))
+ ret = -EINVAL;
+@@ -127,6 +129,8 @@ int fscrypt_process_policy(struct file *filp,
+ ret = -EINVAL;
+ }
+
++ inode_unlock(inode);
++
+ mnt_drop_write_file(filp);
+ return ret;
+ }
+diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c
+index 73bcfd4..42145be 100644
+--- a/fs/ext4/sysfs.c
++++ b/fs/ext4/sysfs.c
+@@ -223,14 +223,18 @@ static struct attribute *ext4_attrs[] = {
+ EXT4_ATTR_FEATURE(lazy_itable_init);
+ EXT4_ATTR_FEATURE(batched_discard);
+ EXT4_ATTR_FEATURE(meta_bg_resize);
++#ifdef CONFIG_EXT4_FS_ENCRYPTION
+ EXT4_ATTR_FEATURE(encryption);
++#endif
+ EXT4_ATTR_FEATURE(metadata_csum_seed);
+
+ static struct attribute *ext4_feat_attrs[] = {
+ ATTR_LIST(lazy_itable_init),
+ ATTR_LIST(batched_discard),
+ ATTR_LIST(meta_bg_resize),
++#ifdef CONFIG_EXT4_FS_ENCRYPTION
+ ATTR_LIST(encryption),
++#endif
+ ATTR_LIST(metadata_csum_seed),
+ NULL,
+ };
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index ad0c745..871c8b3 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -687,6 +687,11 @@ static int isofs_fill_super(struct super_block *s, void *data, int silent)
+ pri_bh = NULL;
+
+ root_found:
++ /* We don't support read-write mounts */
++ if (!(s->s_flags & MS_RDONLY)) {
++ error = -EACCES;
++ goto out_freebh;
++ }
+
+ if (joliet_level && (pri == NULL || !opt.rock)) {
+ /* This is the case of Joliet with the norock mount flag.
+@@ -1501,9 +1506,6 @@ struct inode *__isofs_iget(struct super_block *sb,
+ static struct dentry *isofs_mount(struct file_system_type *fs_type,
+ int flags, const char *dev_name, void *data)
+ {
+- /* We don't support read-write mounts */
+- if (!(flags & MS_RDONLY))
+- return ERR_PTR(-EACCES);
+ return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super);
+ }
+
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 3d8246a..e165266 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1149,6 +1149,7 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh)
+ JBUFFER_TRACE(jh, "file as BJ_Reserved");
+ spin_lock(&journal->j_list_lock);
+ __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved);
++ spin_unlock(&journal->j_list_lock);
+ } else if (jh->b_transaction == journal->j_committing_transaction) {
+ /* first access by this transaction */
+ jh->b_modified = 0;
+@@ -1156,8 +1157,8 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh)
+ JBUFFER_TRACE(jh, "set next transaction");
+ spin_lock(&journal->j_list_lock);
+ jh->b_next_transaction = transaction;
++ spin_unlock(&journal->j_list_lock);
+ }
+- spin_unlock(&journal->j_list_lock);
+ jbd_unlock_bh_state(bh);
+
+ /*
+diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
+index 2178476..2905479 100644
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -344,9 +344,10 @@ static void bl_write_cleanup(struct work_struct *work)
+ u64 start = hdr->args.offset & (loff_t)PAGE_MASK;
+ u64 end = (hdr->args.offset + hdr->args.count +
+ PAGE_SIZE - 1) & (loff_t)PAGE_MASK;
++ u64 lwb = hdr->args.offset + hdr->args.count;
+
+ ext_tree_mark_written(bl, start >> SECTOR_SHIFT,
+- (end - start) >> SECTOR_SHIFT, end);
++ (end - start) >> SECTOR_SHIFT, lwb);
+ }
+
+ pnfs_ld_write_done(hdr);
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 322c258..b9c6542 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -41,6 +41,17 @@ void nfs_mark_delegation_referenced(struct nfs_delegation *delegation)
+ set_bit(NFS_DELEGATION_REFERENCED, &delegation->flags);
+ }
+
++static bool
++nfs4_is_valid_delegation(const struct nfs_delegation *delegation,
++ fmode_t flags)
++{
++ if (delegation != NULL && (delegation->type & flags) == flags &&
++ !test_bit(NFS_DELEGATION_REVOKED, &delegation->flags) &&
++ !test_bit(NFS_DELEGATION_RETURNING, &delegation->flags))
++ return true;
++ return false;
++}
++
+ static int
+ nfs4_do_check_delegation(struct inode *inode, fmode_t flags, bool mark)
+ {
+@@ -50,8 +61,7 @@ nfs4_do_check_delegation(struct inode *inode, fmode_t flags, bool mark)
+ flags &= FMODE_READ|FMODE_WRITE;
+ rcu_read_lock();
+ delegation = rcu_dereference(NFS_I(inode)->delegation);
+- if (delegation != NULL && (delegation->type & flags) == flags &&
+- !test_bit(NFS_DELEGATION_RETURNING, &delegation->flags)) {
++ if (nfs4_is_valid_delegation(delegation, flags)) {
+ if (mark)
+ nfs_mark_delegation_referenced(delegation);
+ ret = 1;
+@@ -893,7 +903,7 @@ bool nfs4_copy_delegation_stateid(struct inode *inode, fmode_t flags,
+ flags &= FMODE_READ|FMODE_WRITE;
+ rcu_read_lock();
+ delegation = rcu_dereference(nfsi->delegation);
+- ret = (delegation != NULL && (delegation->type & flags) == flags);
++ ret = nfs4_is_valid_delegation(delegation, flags);
+ if (ret) {
+ nfs4_stateid_copy(dst, &delegation->stateid);
+ nfs_mark_delegation_referenced(delegation);
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index 177fefb..6bc5a68 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -435,11 +435,11 @@ int nfs_same_file(struct dentry *dentry, struct nfs_entry *entry)
+ return 0;
+
+ nfsi = NFS_I(inode);
+- if (entry->fattr->fileid == nfsi->fileid)
+- return 1;
+- if (nfs_compare_fh(entry->fh, &nfsi->fh) == 0)
+- return 1;
+- return 0;
++ if (entry->fattr->fileid != nfsi->fileid)
++ return 0;
++ if (entry->fh->size && nfs_compare_fh(entry->fh, &nfsi->fh) != 0)
++ return 0;
++ return 1;
+ }
+
+ static
+@@ -517,6 +517,8 @@ void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry)
+ &entry->fattr->fsid))
+ goto out;
+ if (nfs_same_file(dentry, entry)) {
++ if (!entry->fh->size)
++ goto out;
+ nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
+ status = nfs_refresh_inode(d_inode(dentry), entry->fattr);
+ if (!status)
+@@ -529,6 +531,10 @@ void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry)
+ goto again;
+ }
+ }
++ if (!entry->fh->size) {
++ d_lookup_done(dentry);
++ goto out;
++ }
+
+ inode = nfs_fhget(dentry->d_sb, entry->fh, entry->fattr, entry->label);
+ alias = d_splice_alias(inode, dentry);
+diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
+index 64b43b4..6085019 100644
+--- a/fs/nfs/nfs42proc.c
++++ b/fs/nfs/nfs42proc.c
+@@ -443,6 +443,7 @@ int nfs42_proc_layoutstats_generic(struct nfs_server *server,
+ task = rpc_run_task(&task_setup);
+ if (IS_ERR(task))
+ return PTR_ERR(task);
++ rpc_put_task(task);
+ return 0;
+ }
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index cada00a..8353f33f 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1498,6 +1498,9 @@ static int nfs4_reclaim_open_state(struct nfs4_state_owner *sp, const struct nfs
+ __func__, status);
+ case -ENOENT:
+ case -ENOMEM:
++ case -EACCES:
++ case -EROFS:
++ case -EIO:
+ case -ESTALE:
+ /* Open state on this file cannot be recovered */
+ nfs4_state_mark_recovery_failed(state, status);
+diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
+index 45007ac..a2b65fc 100644
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -366,14 +366,21 @@ static struct notifier_block nfsd_inet6addr_notifier = {
+ };
+ #endif
+
++/* Only used under nfsd_mutex, so this atomic may be overkill: */
++static atomic_t nfsd_notifier_refcount = ATOMIC_INIT(0);
++
+ static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
+ {
+ struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+
+- unregister_inetaddr_notifier(&nfsd_inetaddr_notifier);
++ /* check if the notifier still has clients */
++ if (atomic_dec_return(&nfsd_notifier_refcount) == 0) {
++ unregister_inetaddr_notifier(&nfsd_inetaddr_notifier);
+ #if IS_ENABLED(CONFIG_IPV6)
+- unregister_inet6addr_notifier(&nfsd_inet6addr_notifier);
++ unregister_inet6addr_notifier(&nfsd_inet6addr_notifier);
+ #endif
++ }
++
+ /*
+ * write_ports can create the server without actually starting
+ * any threads--if we get shut down before any threads are
+@@ -488,10 +495,13 @@ int nfsd_create_serv(struct net *net)
+ }
+
+ set_max_drc();
+- register_inetaddr_notifier(&nfsd_inetaddr_notifier);
++ /* check if the notifier is already set */
++ if (atomic_inc_return(&nfsd_notifier_refcount) == 1) {
++ register_inetaddr_notifier(&nfsd_inetaddr_notifier);
+ #if IS_ENABLED(CONFIG_IPV6)
+- register_inet6addr_notifier(&nfsd_inet6addr_notifier);
++ register_inet6addr_notifier(&nfsd_inet6addr_notifier);
+ #endif
++ }
+ do_gettimeofday(&nn->nfssvc_boot); /* record boot time */
+ return 0;
+ }
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 43fdc27..abadbc3 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -57,6 +57,7 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
+ ssize_t list_size, size, value_size = 0;
+ char *buf, *name, *value = NULL;
+ int uninitialized_var(error);
++ size_t slen;
+
+ if (!old->d_inode->i_op->getxattr ||
+ !new->d_inode->i_op->getxattr)
+@@ -79,7 +80,16 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
+ goto out;
+ }
+
+- for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
++ for (name = buf; list_size; name += slen) {
++ slen = strnlen(name, list_size) + 1;
++
++ /* underlying fs providing us with an broken xattr list? */
++ if (WARN_ON(slen > list_size)) {
++ error = -EIO;
++ break;
++ }
++ list_size -= slen;
++
+ if (ovl_is_private_xattr(name))
+ continue;
+ retry:
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index 1560fdc..74e6964 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -14,6 +14,7 @@
+ #include <linux/cred.h>
+ #include <linux/posix_acl.h>
+ #include <linux/posix_acl_xattr.h>
++#include <linux/atomic.h>
+ #include "overlayfs.h"
+
+ void ovl_cleanup(struct inode *wdir, struct dentry *wdentry)
+@@ -37,8 +38,10 @@ struct dentry *ovl_lookup_temp(struct dentry *workdir, struct dentry *dentry)
+ {
+ struct dentry *temp;
+ char name[20];
++ static atomic_t temp_id = ATOMIC_INIT(0);
+
+- snprintf(name, sizeof(name), "#%lx", (unsigned long) dentry);
++ /* counter is allowed to wrap, since temp dentries are ephemeral */
++ snprintf(name, sizeof(name), "#%x", atomic_inc_return(&temp_id));
+
+ temp = lookup_one_len(name, workdir, strlen(name));
+ if (!IS_ERR(temp) && temp->d_inode) {
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index 7a034d6..2340262 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -377,13 +377,14 @@ static void ramoops_free_przs(struct ramoops_context *cxt)
+ {
+ int i;
+
+- cxt->max_dump_cnt = 0;
+ if (!cxt->przs)
+ return;
+
+- for (i = 0; !IS_ERR_OR_NULL(cxt->przs[i]); i++)
++ for (i = 0; i < cxt->max_dump_cnt; i++)
+ persistent_ram_free(cxt->przs[i]);
++
+ kfree(cxt->przs);
++ cxt->max_dump_cnt = 0;
+ }
+
+ static int ramoops_init_przs(struct device *dev, struct ramoops_context *cxt,
+@@ -408,7 +409,7 @@ static int ramoops_init_przs(struct device *dev, struct ramoops_context *cxt,
+ GFP_KERNEL);
+ if (!cxt->przs) {
+ dev_err(dev, "failed to initialize a prz array for dumps\n");
+- goto fail_prz;
++ goto fail_mem;
+ }
+
+ for (i = 0; i < cxt->max_dump_cnt; i++) {
+@@ -419,6 +420,11 @@ static int ramoops_init_przs(struct device *dev, struct ramoops_context *cxt,
+ err = PTR_ERR(cxt->przs[i]);
+ dev_err(dev, "failed to request mem region (0x%zx@0x%llx): %d\n",
+ cxt->record_size, (unsigned long long)*paddr, err);
++
++ while (i > 0) {
++ i--;
++ persistent_ram_free(cxt->przs[i]);
++ }
+ goto fail_prz;
+ }
+ *paddr += cxt->record_size;
+@@ -426,7 +432,9 @@ static int ramoops_init_przs(struct device *dev, struct ramoops_context *cxt,
+
+ return 0;
+ fail_prz:
+- ramoops_free_przs(cxt);
++ kfree(cxt->przs);
++fail_mem:
++ cxt->max_dump_cnt = 0;
+ return err;
+ }
+
+@@ -659,7 +667,6 @@ static int ramoops_remove(struct platform_device *pdev)
+ struct ramoops_context *cxt = &oops_cxt;
+
+ pstore_unregister(&cxt->pstore);
+- cxt->max_dump_cnt = 0;
+
+ kfree(cxt->pstore.buf);
+ cxt->pstore.bufsize = 0;
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index 76c3f80..364d2df 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -47,43 +47,10 @@ static inline size_t buffer_start(struct persistent_ram_zone *prz)
+ return atomic_read(&prz->buffer->start);
+ }
+
+-/* increase and wrap the start pointer, returning the old value */
+-static size_t buffer_start_add_atomic(struct persistent_ram_zone *prz, size_t a)
+-{
+- int old;
+- int new;
+-
+- do {
+- old = atomic_read(&prz->buffer->start);
+- new = old + a;
+- while (unlikely(new >= prz->buffer_size))
+- new -= prz->buffer_size;
+- } while (atomic_cmpxchg(&prz->buffer->start, old, new) != old);
+-
+- return old;
+-}
+-
+-/* increase the size counter until it hits the max size */
+-static void buffer_size_add_atomic(struct persistent_ram_zone *prz, size_t a)
+-{
+- size_t old;
+- size_t new;
+-
+- if (atomic_read(&prz->buffer->size) == prz->buffer_size)
+- return;
+-
+- do {
+- old = atomic_read(&prz->buffer->size);
+- new = old + a;
+- if (new > prz->buffer_size)
+- new = prz->buffer_size;
+- } while (atomic_cmpxchg(&prz->buffer->size, old, new) != old);
+-}
+-
+ static DEFINE_RAW_SPINLOCK(buffer_lock);
+
+ /* increase and wrap the start pointer, returning the old value */
+-static size_t buffer_start_add_locked(struct persistent_ram_zone *prz, size_t a)
++static size_t buffer_start_add(struct persistent_ram_zone *prz, size_t a)
+ {
+ int old;
+ int new;
+@@ -103,7 +70,7 @@ static size_t buffer_start_add_locked(struct persistent_ram_zone *prz, size_t a)
+ }
+
+ /* increase the size counter until it hits the max size */
+-static void buffer_size_add_locked(struct persistent_ram_zone *prz, size_t a)
++static void buffer_size_add(struct persistent_ram_zone *prz, size_t a)
+ {
+ size_t old;
+ size_t new;
+@@ -124,9 +91,6 @@ static void buffer_size_add_locked(struct persistent_ram_zone *prz, size_t a)
+ raw_spin_unlock_irqrestore(&buffer_lock, flags);
+ }
+
+-static size_t (*buffer_start_add)(struct persistent_ram_zone *, size_t) = buffer_start_add_atomic;
+-static void (*buffer_size_add)(struct persistent_ram_zone *, size_t) = buffer_size_add_atomic;
+-
+ static void notrace persistent_ram_encode_rs8(struct persistent_ram_zone *prz,
+ uint8_t *data, size_t len, uint8_t *ecc)
+ {
+@@ -299,7 +263,7 @@ static void notrace persistent_ram_update(struct persistent_ram_zone *prz,
+ const void *s, unsigned int start, unsigned int count)
+ {
+ struct persistent_ram_buffer *buffer = prz->buffer;
+- memcpy(buffer->data + start, s, count);
++ memcpy_toio(buffer->data + start, s, count);
+ persistent_ram_update_ecc(prz, start, count);
+ }
+
+@@ -322,8 +286,8 @@ void persistent_ram_save_old(struct persistent_ram_zone *prz)
+ }
+
+ prz->old_log_size = size;
+- memcpy(prz->old_log, &buffer->data[start], size - start);
+- memcpy(prz->old_log + size - start, &buffer->data[0], start);
++ memcpy_fromio(prz->old_log, &buffer->data[start], size - start);
++ memcpy_fromio(prz->old_log + size - start, &buffer->data[0], start);
+ }
+
+ int notrace persistent_ram_write(struct persistent_ram_zone *prz,
+@@ -426,9 +390,6 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size,
+ return NULL;
+ }
+
+- buffer_start_add = buffer_start_add_locked;
+- buffer_size_add = buffer_size_add_locked;
+-
+ if (memtype)
+ va = ioremap(start, size);
+ else
+diff --git a/fs/super.c b/fs/super.c
+index c2ff475..47d11e0 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -1379,8 +1379,8 @@ int freeze_super(struct super_block *sb)
+ }
+ }
+ /*
+- * This is just for debugging purposes so that fs can warn if it
+- * sees write activity when frozen is set to SB_FREEZE_COMPLETE.
++ * For debugging purposes so that fs can warn if it sees write activity
++ * when frozen is set to SB_FREEZE_COMPLETE, and for thaw_super().
+ */
+ sb->s_writers.frozen = SB_FREEZE_COMPLETE;
+ up_write(&sb->s_umount);
+@@ -1399,7 +1399,7 @@ int thaw_super(struct super_block *sb)
+ int error;
+
+ down_write(&sb->s_umount);
+- if (sb->s_writers.frozen == SB_UNFROZEN) {
++ if (sb->s_writers.frozen != SB_FREEZE_COMPLETE) {
+ up_write(&sb->s_umount);
+ return -EINVAL;
+ }
+diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
+index 11a0041..c9ee6f6 100644
+--- a/fs/ubifs/xattr.c
++++ b/fs/ubifs/xattr.c
+@@ -172,6 +172,7 @@ static int create_xattr(struct ubifs_info *c, struct inode *host,
+ host_ui->xattr_cnt -= 1;
+ host_ui->xattr_size -= CALC_DENT_SIZE(nm->len);
+ host_ui->xattr_size -= CALC_XATTR_BYTES(size);
++ host_ui->xattr_names -= nm->len;
+ mutex_unlock(&host_ui->ui_mutex);
+ out_free:
+ make_bad_inode(inode);
+@@ -476,6 +477,7 @@ static int remove_xattr(struct ubifs_info *c, struct inode *host,
+ host_ui->xattr_cnt += 1;
+ host_ui->xattr_size += CALC_DENT_SIZE(nm->len);
+ host_ui->xattr_size += CALC_XATTR_BYTES(ui->data_len);
++ host_ui->xattr_names += nm->len;
+ mutex_unlock(&host_ui->ui_mutex);
+ ubifs_release_budget(c, &req);
+ make_bad_inode(inode);
+diff --git a/include/dt-bindings/clock/imx6qdl-clock.h b/include/dt-bindings/clock/imx6qdl-clock.h
+index 2905033..da59fd9 100644
+--- a/include/dt-bindings/clock/imx6qdl-clock.h
++++ b/include/dt-bindings/clock/imx6qdl-clock.h
+@@ -269,6 +269,8 @@
+ #define IMX6QDL_CLK_PRG0_APB 256
+ #define IMX6QDL_CLK_PRG1_APB 257
+ #define IMX6QDL_CLK_PRE_AXI 258
+-#define IMX6QDL_CLK_END 259
++#define IMX6QDL_CLK_MLB_SEL 259
++#define IMX6QDL_CLK_MLB_PODF 260
++#define IMX6QDL_CLK_END 261
+
+ #endif /* __DT_BINDINGS_CLOCK_IMX6QDL_H */
+diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
+index 631ba33b..32dc0cbd 100644
+--- a/include/linux/cpufreq.h
++++ b/include/linux/cpufreq.h
+@@ -639,19 +639,19 @@ static inline int cpufreq_table_find_index_al(struct cpufreq_policy *policy,
+ unsigned int target_freq)
+ {
+ struct cpufreq_frequency_table *table = policy->freq_table;
++ struct cpufreq_frequency_table *pos, *best = table - 1;
+ unsigned int freq;
+- int i, best = -1;
+
+- for (i = 0; table[i].frequency != CPUFREQ_TABLE_END; i++) {
+- freq = table[i].frequency;
++ cpufreq_for_each_valid_entry(pos, table) {
++ freq = pos->frequency;
+
+ if (freq >= target_freq)
+- return i;
++ return pos - table;
+
+- best = i;
++ best = pos;
+ }
+
+- return best;
++ return best - table;
+ }
+
+ /* Find lowest freq at or above target in a table in descending order */
+@@ -659,28 +659,28 @@ static inline int cpufreq_table_find_index_dl(struct cpufreq_policy *policy,
+ unsigned int target_freq)
+ {
+ struct cpufreq_frequency_table *table = policy->freq_table;
++ struct cpufreq_frequency_table *pos, *best = table - 1;
+ unsigned int freq;
+- int i, best = -1;
+
+- for (i = 0; table[i].frequency != CPUFREQ_TABLE_END; i++) {
+- freq = table[i].frequency;
++ cpufreq_for_each_valid_entry(pos, table) {
++ freq = pos->frequency;
+
+ if (freq == target_freq)
+- return i;
++ return pos - table;
+
+ if (freq > target_freq) {
+- best = i;
++ best = pos;
+ continue;
+ }
+
+ /* No freq found above target_freq */
+- if (best == -1)
+- return i;
++ if (best == table - 1)
++ return pos - table;
+
+- return best;
++ return best - table;
+ }
+
+- return best;
++ return best - table;
+ }
+
+ /* Works only on sorted freq-tables */
+@@ -700,28 +700,28 @@ static inline int cpufreq_table_find_index_ah(struct cpufreq_policy *policy,
+ unsigned int target_freq)
+ {
+ struct cpufreq_frequency_table *table = policy->freq_table;
++ struct cpufreq_frequency_table *pos, *best = table - 1;
+ unsigned int freq;
+- int i, best = -1;
+
+- for (i = 0; table[i].frequency != CPUFREQ_TABLE_END; i++) {
+- freq = table[i].frequency;
++ cpufreq_for_each_valid_entry(pos, table) {
++ freq = pos->frequency;
+
+ if (freq == target_freq)
+- return i;
++ return pos - table;
+
+ if (freq < target_freq) {
+- best = i;
++ best = pos;
+ continue;
+ }
+
+ /* No freq found below target_freq */
+- if (best == -1)
+- return i;
++ if (best == table - 1)
++ return pos - table;
+
+- return best;
++ return best - table;
+ }
+
+- return best;
++ return best - table;
+ }
+
+ /* Find highest freq at or below target in a table in descending order */
+@@ -729,19 +729,19 @@ static inline int cpufreq_table_find_index_dh(struct cpufreq_policy *policy,
+ unsigned int target_freq)
+ {
+ struct cpufreq_frequency_table *table = policy->freq_table;
++ struct cpufreq_frequency_table *pos, *best = table - 1;
+ unsigned int freq;
+- int i, best = -1;
+
+- for (i = 0; table[i].frequency != CPUFREQ_TABLE_END; i++) {
+- freq = table[i].frequency;
++ cpufreq_for_each_valid_entry(pos, table) {
++ freq = pos->frequency;
+
+ if (freq <= target_freq)
+- return i;
++ return pos - table;
+
+- best = i;
++ best = pos;
+ }
+
+- return best;
++ return best - table;
+ }
+
+ /* Works only on sorted freq-tables */
+@@ -761,32 +761,32 @@ static inline int cpufreq_table_find_index_ac(struct cpufreq_policy *policy,
+ unsigned int target_freq)
+ {
+ struct cpufreq_frequency_table *table = policy->freq_table;
++ struct cpufreq_frequency_table *pos, *best = table - 1;
+ unsigned int freq;
+- int i, best = -1;
+
+- for (i = 0; table[i].frequency != CPUFREQ_TABLE_END; i++) {
+- freq = table[i].frequency;
++ cpufreq_for_each_valid_entry(pos, table) {
++ freq = pos->frequency;
+
+ if (freq == target_freq)
+- return i;
++ return pos - table;
+
+ if (freq < target_freq) {
+- best = i;
++ best = pos;
+ continue;
+ }
+
+ /* No freq found below target_freq */
+- if (best == -1)
+- return i;
++ if (best == table - 1)
++ return pos - table;
+
+ /* Choose the closest freq */
+- if (target_freq - table[best].frequency > freq - target_freq)
+- return i;
++ if (target_freq - best->frequency > freq - target_freq)
++ return pos - table;
+
+- return best;
++ return best - table;
+ }
+
+- return best;
++ return best - table;
+ }
+
+ /* Find closest freq to target in a table in descending order */
+@@ -794,32 +794,32 @@ static inline int cpufreq_table_find_index_dc(struct cpufreq_policy *policy,
+ unsigned int target_freq)
+ {
+ struct cpufreq_frequency_table *table = policy->freq_table;
++ struct cpufreq_frequency_table *pos, *best = table - 1;
+ unsigned int freq;
+- int i, best = -1;
+
+- for (i = 0; table[i].frequency != CPUFREQ_TABLE_END; i++) {
+- freq = table[i].frequency;
++ cpufreq_for_each_valid_entry(pos, table) {
++ freq = pos->frequency;
+
+ if (freq == target_freq)
+- return i;
++ return pos - table;
+
+ if (freq > target_freq) {
+- best = i;
++ best = pos;
+ continue;
+ }
+
+ /* No freq found above target_freq */
+- if (best == -1)
+- return i;
++ if (best == table - 1)
++ return pos - table;
+
+ /* Choose the closest freq */
+- if (table[best].frequency - target_freq > target_freq - freq)
+- return i;
++ if (best->frequency - target_freq > target_freq - freq)
++ return pos - table;
+
+- return best;
++ return best - table;
+ }
+
+- return best;
++ return best - table;
+ }
+
+ /* Works only on sorted freq-tables */
+diff --git a/include/linux/devfreq-event.h b/include/linux/devfreq-event.h
+index 0a83a1e..4db00b0 100644
+--- a/include/linux/devfreq-event.h
++++ b/include/linux/devfreq-event.h
+@@ -148,11 +148,6 @@ static inline int devfreq_event_reset_event(struct devfreq_event_dev *edev)
+ return -EINVAL;
+ }
+
+-static inline void *devfreq_event_get_drvdata(struct devfreq_event_dev *edev)
+-{
+- return ERR_PTR(-EINVAL);
+-}
+-
+ static inline struct devfreq_event_dev *devfreq_event_get_edev_by_phandle(
+ struct device *dev, int index)
+ {
+diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
+index 99ac022..3a8610e 100644
+--- a/include/linux/irqchip/arm-gic-v3.h
++++ b/include/linux/irqchip/arm-gic-v3.h
+@@ -290,7 +290,7 @@
+ #define GITS_BASER_TYPE_SHIFT (56)
+ #define GITS_BASER_TYPE(r) (((r) >> GITS_BASER_TYPE_SHIFT) & 7)
+ #define GITS_BASER_ENTRY_SIZE_SHIFT (48)
+-#define GITS_BASER_ENTRY_SIZE(r) ((((r) >> GITS_BASER_ENTRY_SIZE_SHIFT) & 0xff) + 1)
++#define GITS_BASER_ENTRY_SIZE(r) ((((r) >> GITS_BASER_ENTRY_SIZE_SHIFT) & 0x1f) + 1)
+ #define GITS_BASER_SHAREABILITY_SHIFT (10)
+ #define GITS_BASER_InnerShareable \
+ GIC_BASER_SHAREABILITY(GITS_BASER, InnerShareable)
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index fb8e3b6..c211900 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -177,6 +177,7 @@ enum tcm_sense_reason_table {
+ TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED = R(0x15),
+ TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED = R(0x16),
+ TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED = R(0x17),
++ TCM_COPY_TARGET_DEVICE_NOT_REACHABLE = R(0x18),
+ #undef R
+ };
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 039de34..8b3610c 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -456,17 +456,23 @@ static inline int entity_before(struct sched_entity *a,
+
+ static void update_min_vruntime(struct cfs_rq *cfs_rq)
+ {
++ struct sched_entity *curr = cfs_rq->curr;
++
+ u64 vruntime = cfs_rq->min_vruntime;
+
+- if (cfs_rq->curr)
+- vruntime = cfs_rq->curr->vruntime;
++ if (curr) {
++ if (curr->on_rq)
++ vruntime = curr->vruntime;
++ else
++ curr = NULL;
++ }
+
+ if (cfs_rq->rb_leftmost) {
+ struct sched_entity *se = rb_entry(cfs_rq->rb_leftmost,
+ struct sched_entity,
+ run_node);
+
+- if (!cfs_rq->curr)
++ if (!curr)
+ vruntime = se->vruntime;
+ else
+ vruntime = min_vruntime(vruntime, se->vruntime);
+@@ -680,7 +686,14 @@ void init_entity_runnable_average(struct sched_entity *se)
+ * will definitely be update (after enqueue).
+ */
+ sa->period_contrib = 1023;
+- sa->load_avg = scale_load_down(se->load.weight);
++ /*
++ * Tasks are intialized with full load to be seen as heavy tasks until
++ * they get a chance to stabilize to their real load level.
++ * Group entities are intialized with zero load to reflect the fact that
++ * nothing has been attached to the task group yet.
++ */
++ if (entity_is_task(se))
++ sa->load_avg = scale_load_down(se->load.weight);
+ sa->load_sum = sa->load_avg * LOAD_AVG_MAX;
+ /*
+ * At this point, util_avg won't be used in select_task_rq_fair anyway
+@@ -3459,9 +3472,10 @@ dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
+ account_entity_dequeue(cfs_rq, se);
+
+ /*
+- * Normalize the entity after updating the min_vruntime because the
+- * update can refer to the ->curr item and we need to reflect this
+- * movement in our normalized position.
++ * Normalize after update_curr(); which will also have moved
++ * min_vruntime if @se is the one holding it back. But before doing
++ * update_min_vruntime() again, which will discount @se's position and
++ * can move min_vruntime forward still more.
+ */
+ if (!(flags & DEQUEUE_SLEEP))
+ se->vruntime -= cfs_rq->min_vruntime;
+@@ -3469,8 +3483,16 @@ dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
+ /* return excess runtime on last dequeue */
+ return_cfs_rq_runtime(cfs_rq);
+
+- update_min_vruntime(cfs_rq);
+ update_cfs_shares(cfs_rq);
++
++ /*
++ * Now advance min_vruntime if @se was the entity holding it back,
++ * except when: DEQUEUE_SAVE && !DEQUEUE_MOVE, in this case we'll be
++ * put back on, and if we advance min_vruntime, we'll be placed back
++ * further than we started -- ie. we'll be penalized.
++ */
++ if ((flags & (DEQUEUE_SAVE | DEQUEUE_MOVE)) == DEQUEUE_SAVE)
++ update_min_vruntime(cfs_rq);
+ }
+
+ /*
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index bf16883..e72581d 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -473,7 +473,16 @@ static int xs_nospace(struct rpc_task *task)
+ spin_unlock_bh(&xprt->transport_lock);
+
+ /* Race breaker in case memory is freed before above code is called */
+- sk->sk_write_space(sk);
++ if (ret == -EAGAIN) {
++ struct socket_wq *wq;
++
++ rcu_read_lock();
++ wq = rcu_dereference(sk->sk_wq);
++ set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags);
++ rcu_read_unlock();
++
++ sk->sk_write_space(sk);
++ }
+ return ret;
+ }
+
+diff --git a/sound/pci/hda/dell_wmi_helper.c b/sound/pci/hda/dell_wmi_helper.c
+index 9c22f95..19d41da 100644
+--- a/sound/pci/hda/dell_wmi_helper.c
++++ b/sound/pci/hda/dell_wmi_helper.c
+@@ -49,7 +49,7 @@ static void alc_fixup_dell_wmi(struct hda_codec *codec,
+ removefunc = true;
+ if (dell_led_set_func(DELL_LED_MICMUTE, false) >= 0) {
+ dell_led_value = 0;
+- if (spec->gen.num_adc_nids > 1)
++ if (spec->gen.num_adc_nids > 1 && !spec->gen.dyn_adc_switch)
+ codec_dbg(codec, "Skipping micmute LED control due to several ADCs");
+ else {
+ dell_old_cap_hook = spec->gen.cap_sync_hook;
+diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c
+index f0955fd..6a23302 100644
+--- a/sound/pci/hda/thinkpad_helper.c
++++ b/sound/pci/hda/thinkpad_helper.c
+@@ -62,7 +62,7 @@ static void hda_fixup_thinkpad_acpi(struct hda_codec *codec,
+ removefunc = false;
+ }
+ if (led_set_func(TPACPI_LED_MICMUTE, false) >= 0) {
+- if (spec->num_adc_nids > 1)
++ if (spec->num_adc_nids > 1 && !spec->dyn_adc_switch)
+ codec_dbg(codec,
+ "Skipping micmute LED control due to several ADCs");
+ else {
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index 8ff6c6a..c9c8dc3 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -89,6 +89,7 @@ struct intel_pt_decoder {
+ bool pge;
+ bool have_tma;
+ bool have_cyc;
++ bool fixup_last_mtc;
+ uint64_t pos;
+ uint64_t last_ip;
+ uint64_t ip;
+@@ -584,10 +585,31 @@ struct intel_pt_calc_cyc_to_tsc_info {
+ uint64_t tsc_timestamp;
+ uint64_t timestamp;
+ bool have_tma;
++ bool fixup_last_mtc;
+ bool from_mtc;
+ double cbr_cyc_to_tsc;
+ };
+
++/*
++ * MTC provides a 8-bit slice of CTC but the TMA packet only provides the lower
++ * 16 bits of CTC. If mtc_shift > 8 then some of the MTC bits are not in the CTC
++ * provided by the TMA packet. Fix-up the last_mtc calculated from the TMA
++ * packet by copying the missing bits from the current MTC assuming the least
++ * difference between the two, and that the current MTC comes after last_mtc.
++ */
++static void intel_pt_fixup_last_mtc(uint32_t mtc, int mtc_shift,
++ uint32_t *last_mtc)
++{
++ uint32_t first_missing_bit = 1U << (16 - mtc_shift);
++ uint32_t mask = ~(first_missing_bit - 1);
++
++ *last_mtc |= mtc & mask;
++ if (*last_mtc >= mtc) {
++ *last_mtc -= first_missing_bit;
++ *last_mtc &= 0xff;
++ }
++}
++
+ static int intel_pt_calc_cyc_cb(struct intel_pt_pkt_info *pkt_info)
+ {
+ struct intel_pt_decoder *decoder = pkt_info->decoder;
+@@ -617,6 +639,11 @@ static int intel_pt_calc_cyc_cb(struct intel_pt_pkt_info *pkt_info)
+ return 0;
+
+ mtc = pkt_info->packet.payload;
++ if (decoder->mtc_shift > 8 && data->fixup_last_mtc) {
++ data->fixup_last_mtc = false;
++ intel_pt_fixup_last_mtc(mtc, decoder->mtc_shift,
++ &data->last_mtc);
++ }
+ if (mtc > data->last_mtc)
+ mtc_delta = mtc - data->last_mtc;
+ else
+@@ -685,6 +712,7 @@ static int intel_pt_calc_cyc_cb(struct intel_pt_pkt_info *pkt_info)
+
+ data->ctc_delta = 0;
+ data->have_tma = true;
++ data->fixup_last_mtc = true;
+
+ return 0;
+
+@@ -751,6 +779,7 @@ static void intel_pt_calc_cyc_to_tsc(struct intel_pt_decoder *decoder,
+ .tsc_timestamp = decoder->tsc_timestamp,
+ .timestamp = decoder->timestamp,
+ .have_tma = decoder->have_tma,
++ .fixup_last_mtc = decoder->fixup_last_mtc,
+ .from_mtc = from_mtc,
+ .cbr_cyc_to_tsc = 0,
+ };
+@@ -1241,6 +1270,7 @@ static void intel_pt_calc_tma(struct intel_pt_decoder *decoder)
+ }
+ decoder->ctc_delta = 0;
+ decoder->have_tma = true;
++ decoder->fixup_last_mtc = true;
+ intel_pt_log("CTC timestamp " x64_fmt " last MTC %#x CTC rem %#x\n",
+ decoder->ctc_timestamp, decoder->last_mtc, ctc_rem);
+ }
+@@ -1255,6 +1285,12 @@ static void intel_pt_calc_mtc_timestamp(struct intel_pt_decoder *decoder)
+
+ mtc = decoder->packet.payload;
+
++ if (decoder->mtc_shift > 8 && decoder->fixup_last_mtc) {
++ decoder->fixup_last_mtc = false;
++ intel_pt_fixup_last_mtc(mtc, decoder->mtc_shift,
++ &decoder->last_mtc);
++ }
++
+ if (mtc > decoder->last_mtc)
+ mtc_delta = mtc - decoder->last_mtc;
+ else
+@@ -1323,6 +1359,8 @@ static void intel_pt_calc_cyc_timestamp(struct intel_pt_decoder *decoder)
+ timestamp, decoder->timestamp);
+ else
+ decoder->timestamp = timestamp;
++
++ decoder->timestamp_insn_cnt = 0;
+ }
+
+ /* Walk PSB+ packets when already in sync. */
+diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
+index 551ff6f..b2878d2 100644
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -241,7 +241,7 @@ static int intel_pt_get_trace(struct intel_pt_buffer *b, void *data)
+ }
+
+ queue = &ptq->pt->queues.queue_array[ptq->queue_nr];
+-
++next:
+ buffer = auxtrace_buffer__next(queue, buffer);
+ if (!buffer) {
+ if (old_buffer)
+@@ -264,9 +264,6 @@ static int intel_pt_get_trace(struct intel_pt_buffer *b, void *data)
+ intel_pt_do_fix_overlap(ptq->pt, old_buffer, buffer))
+ return -ENOMEM;
+
+- if (old_buffer)
+- auxtrace_buffer__drop_data(old_buffer);
+-
+ if (buffer->use_data) {
+ b->len = buffer->use_size;
+ b->buf = buffer->use_data;
+@@ -276,6 +273,16 @@ static int intel_pt_get_trace(struct intel_pt_buffer *b, void *data)
+ }
+ b->ref_timestamp = buffer->reference;
+
++ /*
++ * If in snapshot mode and the buffer has no usable data, get next
++ * buffer and again check overlap against old_buffer.
++ */
++ if (ptq->pt->snapshot_mode && !b->len)
++ goto next;
++
++ if (old_buffer)
++ auxtrace_buffer__drop_data(old_buffer);
++
+ if (!old_buffer || ptq->pt->sampling_mode || (ptq->pt->snapshot_mode &&
+ !buffer->consecutive)) {
+ b->consecutive = false;
+diff --git a/tools/spi/spidev_test.c b/tools/spi/spidev_test.c
+index 8a73d81..f3825b6 100644
+--- a/tools/spi/spidev_test.c
++++ b/tools/spi/spidev_test.c
+@@ -284,7 +284,7 @@ static void parse_opts(int argc, char *argv[])
+
+ static void transfer_escaped_string(int fd, char *str)
+ {
+- size_t size = strlen(str + 1);
++ size_t size = strlen(str);
+ uint8_t *tx;
+ uint8_t *rx;
+
diff --git a/4.8.6/1005_linux-4.8.6.patch b/4.8.6/1005_linux-4.8.6.patch
new file mode 100644
index 0000000..641ba27
--- /dev/null
+++ b/4.8.6/1005_linux-4.8.6.patch
@@ -0,0 +1,5137 @@
+diff --git a/Makefile b/Makefile
+index daa3a01..b249529 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 8
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = Psychotic Stoned Sheep
+
+diff --git a/arch/arm/boot/dts/arm-realview-eb.dtsi b/arch/arm/boot/dts/arm-realview-eb.dtsi
+index 1c6a040..e2e9599 100644
+--- a/arch/arm/boot/dts/arm-realview-eb.dtsi
++++ b/arch/arm/boot/dts/arm-realview-eb.dtsi
+@@ -51,14 +51,6 @@
+ regulator-boot-on;
+ };
+
+- veth: fixedregulator@0 {
+- compatible = "regulator-fixed";
+- regulator-name = "veth";
+- regulator-min-microvolt = <3300000>;
+- regulator-max-microvolt = <3300000>;
+- regulator-boot-on;
+- };
+-
+ xtal24mhz: xtal24mhz@24M {
+ #clock-cells = <0>;
+ compatible = "fixed-clock";
+@@ -134,16 +126,15 @@
+ bank-width = <4>;
+ };
+
+- /* SMSC 9118 ethernet with PHY and EEPROM */
++ /* SMSC LAN91C111 ethernet with PHY and EEPROM */
+ ethernet: ethernet@4e000000 {
+- compatible = "smsc,lan9118", "smsc,lan9115";
++ compatible = "smsc,lan91c111";
+ reg = <0x4e000000 0x10000>;
+- phy-mode = "mii";
+- reg-io-width = <4>;
+- smsc,irq-active-high;
+- smsc,irq-push-pull;
+- vdd33a-supply = <&veth>;
+- vddvario-supply = <&veth>;
++ /*
++ * This means the adapter can be accessed with 8, 16 or
++ * 32 bit reads/writes.
++ */
++ reg-io-width = <7>;
+ };
+
+ usb: usb@4f000000 {
+diff --git a/arch/arm/boot/dts/bcm958625hr.dts b/arch/arm/boot/dts/bcm958625hr.dts
+index 03b8bbe..652418a 100644
+--- a/arch/arm/boot/dts/bcm958625hr.dts
++++ b/arch/arm/boot/dts/bcm958625hr.dts
+@@ -47,7 +47,8 @@
+ };
+
+ memory {
+- reg = <0x60000000 0x20000000>;
++ device_type = "memory";
++ reg = <0x60000000 0x80000000>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
+index ca86da6..854117d 100644
+--- a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
+@@ -119,7 +119,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&mcspi1_pins>;
+
+- lcd0: display {
++ lcd0: display@1 {
+ compatible = "lgphilips,lb035q02";
+ label = "lcd35";
+
+diff --git a/arch/arm/boot/dts/sun9i-a80.dtsi b/arch/arm/boot/dts/sun9i-a80.dtsi
+index f68b324..3f528a3 100644
+--- a/arch/arm/boot/dts/sun9i-a80.dtsi
++++ b/arch/arm/boot/dts/sun9i-a80.dtsi
+@@ -899,8 +899,7 @@
+ resets = <&apbs_rst 0>;
+ gpio-controller;
+ interrupt-controller;
+- #address-cells = <1>;
+- #size-cells = <0>;
++ #interrupt-cells = <3>;
+ #gpio-cells = <3>;
+
+ r_ir_pins: r_ir {
+diff --git a/arch/arm/crypto/ghash-ce-glue.c b/arch/arm/crypto/ghash-ce-glue.c
+index 1568cb5..b88364a 100644
+--- a/arch/arm/crypto/ghash-ce-glue.c
++++ b/arch/arm/crypto/ghash-ce-glue.c
+@@ -220,6 +220,27 @@ static int ghash_async_digest(struct ahash_request *req)
+ }
+ }
+
++static int ghash_async_import(struct ahash_request *req, const void *in)
++{
++ struct ahash_request *cryptd_req = ahash_request_ctx(req);
++ struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
++ struct ghash_async_ctx *ctx = crypto_ahash_ctx(tfm);
++ struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
++
++ desc->tfm = cryptd_ahash_child(ctx->cryptd_tfm);
++ desc->flags = req->base.flags;
++
++ return crypto_shash_import(desc, in);
++}
++
++static int ghash_async_export(struct ahash_request *req, void *out)
++{
++ struct ahash_request *cryptd_req = ahash_request_ctx(req);
++ struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
++
++ return crypto_shash_export(desc, out);
++}
++
+ static int ghash_async_setkey(struct crypto_ahash *tfm, const u8 *key,
+ unsigned int keylen)
+ {
+@@ -268,7 +289,10 @@ static struct ahash_alg ghash_async_alg = {
+ .final = ghash_async_final,
+ .setkey = ghash_async_setkey,
+ .digest = ghash_async_digest,
++ .import = ghash_async_import,
++ .export = ghash_async_export,
+ .halg.digestsize = GHASH_DIGEST_SIZE,
++ .halg.statesize = sizeof(struct ghash_desc_ctx),
+ .halg.base = {
+ .cra_name = "ghash",
+ .cra_driver_name = "ghash-ce",
+diff --git a/arch/arm/mach-pxa/corgi_pm.c b/arch/arm/mach-pxa/corgi_pm.c
+index d920681..c71c483 100644
+--- a/arch/arm/mach-pxa/corgi_pm.c
++++ b/arch/arm/mach-pxa/corgi_pm.c
+@@ -131,16 +131,11 @@ static int corgi_should_wakeup(unsigned int resume_on_alarm)
+ return is_resume;
+ }
+
+-static unsigned long corgi_charger_wakeup(void)
++static bool corgi_charger_wakeup(void)
+ {
+- unsigned long ret;
+-
+- ret = (!gpio_get_value(CORGI_GPIO_AC_IN) << GPIO_bit(CORGI_GPIO_AC_IN))
+- | (!gpio_get_value(CORGI_GPIO_KEY_INT)
+- << GPIO_bit(CORGI_GPIO_KEY_INT))
+- | (!gpio_get_value(CORGI_GPIO_WAKEUP)
+- << GPIO_bit(CORGI_GPIO_WAKEUP));
+- return ret;
++ return !gpio_get_value(CORGI_GPIO_AC_IN) ||
++ !gpio_get_value(CORGI_GPIO_KEY_INT) ||
++ !gpio_get_value(CORGI_GPIO_WAKEUP);
+ }
+
+ unsigned long corgipm_read_devdata(int type)
+diff --git a/arch/arm/mach-pxa/pxa_cplds_irqs.c b/arch/arm/mach-pxa/pxa_cplds_irqs.c
+index 2385052..e362f86 100644
+--- a/arch/arm/mach-pxa/pxa_cplds_irqs.c
++++ b/arch/arm/mach-pxa/pxa_cplds_irqs.c
+@@ -41,30 +41,35 @@ static irqreturn_t cplds_irq_handler(int in_irq, void *d)
+ unsigned long pending;
+ unsigned int bit;
+
+- pending = readl(fpga->base + FPGA_IRQ_SET_CLR) & fpga->irq_mask;
+- for_each_set_bit(bit, &pending, CPLDS_NB_IRQ)
+- generic_handle_irq(irq_find_mapping(fpga->irqdomain, bit));
++ do {
++ pending = readl(fpga->base + FPGA_IRQ_SET_CLR) & fpga->irq_mask;
++ for_each_set_bit(bit, &pending, CPLDS_NB_IRQ) {
++ generic_handle_irq(irq_find_mapping(fpga->irqdomain,
++ bit));
++ }
++ } while (pending);
+
+ return IRQ_HANDLED;
+ }
+
+-static void cplds_irq_mask_ack(struct irq_data *d)
++static void cplds_irq_mask(struct irq_data *d)
+ {
+ struct cplds *fpga = irq_data_get_irq_chip_data(d);
+ unsigned int cplds_irq = irqd_to_hwirq(d);
+- unsigned int set, bit = BIT(cplds_irq);
++ unsigned int bit = BIT(cplds_irq);
+
+ fpga->irq_mask &= ~bit;
+ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
+- set = readl(fpga->base + FPGA_IRQ_SET_CLR);
+- writel(set & ~bit, fpga->base + FPGA_IRQ_SET_CLR);
+ }
+
+ static void cplds_irq_unmask(struct irq_data *d)
+ {
+ struct cplds *fpga = irq_data_get_irq_chip_data(d);
+ unsigned int cplds_irq = irqd_to_hwirq(d);
+- unsigned int bit = BIT(cplds_irq);
++ unsigned int set, bit = BIT(cplds_irq);
++
++ set = readl(fpga->base + FPGA_IRQ_SET_CLR);
++ writel(set & ~bit, fpga->base + FPGA_IRQ_SET_CLR);
+
+ fpga->irq_mask |= bit;
+ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
+@@ -72,7 +77,8 @@ static void cplds_irq_unmask(struct irq_data *d)
+
+ static struct irq_chip cplds_irq_chip = {
+ .name = "pxa_cplds",
+- .irq_mask_ack = cplds_irq_mask_ack,
++ .irq_ack = cplds_irq_mask,
++ .irq_mask = cplds_irq_mask,
+ .irq_unmask = cplds_irq_unmask,
+ .flags = IRQCHIP_MASK_ON_SUSPEND | IRQCHIP_SKIP_SET_WAKE,
+ };
+diff --git a/arch/arm/mach-pxa/sharpsl_pm.c b/arch/arm/mach-pxa/sharpsl_pm.c
+index b80eab9..249b7bd 100644
+--- a/arch/arm/mach-pxa/sharpsl_pm.c
++++ b/arch/arm/mach-pxa/sharpsl_pm.c
+@@ -744,7 +744,7 @@ static int sharpsl_off_charge_battery(void)
+ time = RCNR;
+ while (1) {
+ /* Check if any wakeup event had occurred */
+- if (sharpsl_pm.machinfo->charger_wakeup() != 0)
++ if (sharpsl_pm.machinfo->charger_wakeup())
+ return 0;
+ /* Check for timeout */
+ if ((RCNR - time) > SHARPSL_WAIT_CO_TIME)
+diff --git a/arch/arm/mach-pxa/sharpsl_pm.h b/arch/arm/mach-pxa/sharpsl_pm.h
+index 905be67..fa75b6d 100644
+--- a/arch/arm/mach-pxa/sharpsl_pm.h
++++ b/arch/arm/mach-pxa/sharpsl_pm.h
+@@ -34,7 +34,7 @@ struct sharpsl_charger_machinfo {
+ #define SHARPSL_STATUS_LOCK 5
+ #define SHARPSL_STATUS_CHRGFULL 6
+ #define SHARPSL_STATUS_FATAL 7
+- unsigned long (*charger_wakeup)(void);
++ bool (*charger_wakeup)(void);
+ int (*should_wakeup)(unsigned int resume_on_alarm);
+ void (*backlight_limit)(int);
+ int (*backlight_get_status) (void);
+diff --git a/arch/arm/mach-pxa/spitz_pm.c b/arch/arm/mach-pxa/spitz_pm.c
+index ea9f903..4e64a14 100644
+--- a/arch/arm/mach-pxa/spitz_pm.c
++++ b/arch/arm/mach-pxa/spitz_pm.c
+@@ -165,13 +165,10 @@ static int spitz_should_wakeup(unsigned int resume_on_alarm)
+ return is_resume;
+ }
+
+-static unsigned long spitz_charger_wakeup(void)
++static bool spitz_charger_wakeup(void)
+ {
+- unsigned long ret;
+- ret = ((!gpio_get_value(SPITZ_GPIO_KEY_INT)
+- << GPIO_bit(SPITZ_GPIO_KEY_INT))
+- | gpio_get_value(SPITZ_GPIO_SYNC));
+- return ret;
++ return !gpio_get_value(SPITZ_GPIO_KEY_INT) ||
++ gpio_get_value(SPITZ_GPIO_SYNC);
+ }
+
+ unsigned long spitzpm_read_devdata(int type)
+diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
+index 263bf39..9bd84ba 100644
+--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
++++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
+@@ -6,6 +6,8 @@
+ */
+ #define _PAGE_BIT_SWAP_TYPE 0
+
++#define _PAGE_RO 0
++
+ #define _PAGE_EXEC 0x00001 /* execute permission */
+ #define _PAGE_WRITE 0x00002 /* write access allowed */
+ #define _PAGE_READ 0x00004 /* read access allowed */
+diff --git a/arch/powerpc/kernel/nvram_64.c b/arch/powerpc/kernel/nvram_64.c
+index 64174bf..05a0a91 100644
+--- a/arch/powerpc/kernel/nvram_64.c
++++ b/arch/powerpc/kernel/nvram_64.c
+@@ -956,7 +956,7 @@ int __init nvram_remove_partition(const char *name, int sig,
+
+ /* Make partition a free partition */
+ part->header.signature = NVRAM_SIG_FREE;
+- strncpy(part->header.name, "wwwwwwwwwwww", 12);
++ memset(part->header.name, 'w', 12);
+ part->header.checksum = nvram_checksum(&part->header);
+ rc = nvram_write_header(part);
+ if (rc <= 0) {
+@@ -974,8 +974,8 @@ int __init nvram_remove_partition(const char *name, int sig,
+ }
+ if (prev) {
+ prev->header.length += part->header.length;
+- prev->header.checksum = nvram_checksum(&part->header);
+- rc = nvram_write_header(part);
++ prev->header.checksum = nvram_checksum(&prev->header);
++ rc = nvram_write_header(prev);
+ if (rc <= 0) {
+ printk(KERN_ERR "nvram_remove_partition: nvram_write failed (%d)\n", rc);
+ return rc;
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index 9ee2623..ad37aa1 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -88,7 +88,13 @@ static void check_if_tm_restore_required(struct task_struct *tsk)
+ set_thread_flag(TIF_RESTORE_TM);
+ }
+ }
++
++static inline bool msr_tm_active(unsigned long msr)
++{
++ return MSR_TM_ACTIVE(msr);
++}
+ #else
++static inline bool msr_tm_active(unsigned long msr) { return false; }
+ static inline void check_if_tm_restore_required(struct task_struct *tsk) { }
+ #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
+
+@@ -208,7 +214,7 @@ void enable_kernel_fp(void)
+ EXPORT_SYMBOL(enable_kernel_fp);
+
+ static int restore_fp(struct task_struct *tsk) {
+- if (tsk->thread.load_fp) {
++ if (tsk->thread.load_fp || msr_tm_active(tsk->thread.regs->msr)) {
+ load_fp_state(&current->thread.fp_state);
+ current->thread.load_fp++;
+ return 1;
+@@ -278,7 +284,8 @@ EXPORT_SYMBOL_GPL(flush_altivec_to_thread);
+
+ static int restore_altivec(struct task_struct *tsk)
+ {
+- if (cpu_has_feature(CPU_FTR_ALTIVEC) && tsk->thread.load_vec) {
++ if (cpu_has_feature(CPU_FTR_ALTIVEC) &&
++ (tsk->thread.load_vec || msr_tm_active(tsk->thread.regs->msr))) {
+ load_vr_state(&tsk->thread.vr_state);
+ tsk->thread.used_vr = 1;
+ tsk->thread.load_vec++;
+@@ -438,6 +445,7 @@ void giveup_all(struct task_struct *tsk)
+ return;
+
+ msr_check_and_set(msr_all_available);
++ check_if_tm_restore_required(tsk);
+
+ #ifdef CONFIG_PPC_FPU
+ if (usermsr & MSR_FP)
+@@ -464,7 +472,8 @@ void restore_math(struct pt_regs *regs)
+ {
+ unsigned long msr;
+
+- if (!current->thread.load_fp && !loadvec(current->thread))
++ if (!msr_tm_active(regs->msr) &&
++ !current->thread.load_fp && !loadvec(current->thread))
+ return;
+
+ msr = regs->msr;
+@@ -983,6 +992,13 @@ void restore_tm_state(struct pt_regs *regs)
+ msr_diff = current->thread.ckpt_regs.msr & ~regs->msr;
+ msr_diff &= MSR_FP | MSR_VEC | MSR_VSX;
+
++ /* Ensure that restore_math() will restore */
++ if (msr_diff & MSR_FP)
++ current->thread.load_fp = 1;
++#ifdef CONFIG_ALIVEC
++ if (cpu_has_feature(CPU_FTR_ALTIVEC) && msr_diff & MSR_VEC)
++ current->thread.load_vec = 1;
++#endif
+ restore_math(regs);
+
+ regs->msr |= msr_diff;
+diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
+index 7372ee1..a5d3ecd 100644
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -1019,8 +1019,15 @@ int gup_hugepte(pte_t *ptep, unsigned long sz, unsigned long addr,
+
+ pte = READ_ONCE(*ptep);
+ mask = _PAGE_PRESENT | _PAGE_READ;
++
++ /*
++ * On some CPUs like the 8xx, _PAGE_RW hence _PAGE_WRITE is defined
++ * as 0 and _PAGE_RO has to be set when a page is not writable
++ */
+ if (write)
+ mask |= _PAGE_WRITE;
++ else
++ mask |= _PAGE_RO;
+
+ if ((pte_val(pte) & mask) != mask)
+ return 0;
+diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
+index de7501e..8b8852b 100644
+--- a/arch/x86/kernel/early-quirks.c
++++ b/arch/x86/kernel/early-quirks.c
+@@ -317,16 +317,11 @@ static phys_addr_t __init i85x_stolen_base(int num, int slot, int func,
+ static phys_addr_t __init i865_stolen_base(int num, int slot, int func,
+ size_t stolen_size)
+ {
+- u16 toud;
++ u16 toud = 0;
+
+- /*
+- * FIXME is the graphics stolen memory region
+- * always at TOUD? Ie. is it always the last
+- * one to be allocated by the BIOS?
+- */
+ toud = read_pci_config_16(0, 0, 0, I865_TOUD);
+
+- return (phys_addr_t)toud << 16;
++ return (phys_addr_t)(toud << 16) + i845_tseg_size();
+ }
+
+ static phys_addr_t __init gen3_stolen_base(int num, int slot, int func,
+diff --git a/crypto/gcm.c b/crypto/gcm.c
+index 70a892e8..f624ac9 100644
+--- a/crypto/gcm.c
++++ b/crypto/gcm.c
+@@ -117,7 +117,7 @@ static int crypto_gcm_setkey(struct crypto_aead *aead, const u8 *key,
+ struct crypto_skcipher *ctr = ctx->ctr;
+ struct {
+ be128 hash;
+- u8 iv[8];
++ u8 iv[16];
+
+ struct crypto_gcm_setkey_result result;
+
+diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
+index 01d4be2..f5c26a5 100644
+--- a/drivers/char/hw_random/omap-rng.c
++++ b/drivers/char/hw_random/omap-rng.c
+@@ -385,7 +385,7 @@ static int omap_rng_probe(struct platform_device *pdev)
+
+ pm_runtime_enable(&pdev->dev);
+ ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret) {
++ if (ret < 0) {
+ dev_err(&pdev->dev, "Failed to runtime_get device: %d\n", ret);
+ pm_runtime_put_noidle(&pdev->dev);
+ goto err_ioremap;
+@@ -443,7 +443,7 @@ static int __maybe_unused omap_rng_resume(struct device *dev)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret) {
++ if (ret < 0) {
+ dev_err(dev, "Failed to runtime_get device: %d\n", ret);
+ pm_runtime_put_noidle(dev);
+ return ret;
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index 7a79708..0fc71cb 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1006,16 +1006,28 @@ static int bcm2835_clock_set_rate(struct clk_hw *hw,
+ return 0;
+ }
+
++static bool
++bcm2835_clk_is_pllc(struct clk_hw *hw)
++{
++ if (!hw)
++ return false;
++
++ return strncmp(clk_hw_get_name(hw), "pllc", 4) == 0;
++}
++
+ static int bcm2835_clock_determine_rate(struct clk_hw *hw,
+ struct clk_rate_request *req)
+ {
+ struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
+ struct clk_hw *parent, *best_parent = NULL;
++ bool current_parent_is_pllc;
+ unsigned long rate, best_rate = 0;
+ unsigned long prate, best_prate = 0;
+ size_t i;
+ u32 div;
+
++ current_parent_is_pllc = bcm2835_clk_is_pllc(clk_hw_get_parent(hw));
++
+ /*
+ * Select parent clock that results in the closest but lower rate
+ */
+@@ -1023,6 +1035,17 @@ static int bcm2835_clock_determine_rate(struct clk_hw *hw,
+ parent = clk_hw_get_parent_by_index(hw, i);
+ if (!parent)
+ continue;
++
++ /*
++ * Don't choose a PLLC-derived clock as our parent
++ * unless it had been manually set that way. PLLC's
++ * frequency gets adjusted by the firmware due to
++ * over-temp or under-voltage conditions, without
++ * prior notification to our clock consumer.
++ */
++ if (bcm2835_clk_is_pllc(parent) && !current_parent_is_pllc)
++ continue;
++
+ prate = clk_hw_get_rate(parent);
+ div = bcm2835_clock_choose_div(hw, req->rate, prate, true);
+ rate = bcm2835_clock_rate_from_divisor(clock, prate, div);
+diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
+index a0f55bc..96386ff 100644
+--- a/drivers/clk/clk-divider.c
++++ b/drivers/clk/clk-divider.c
+@@ -352,7 +352,7 @@ static long clk_divider_round_rate(struct clk_hw *hw, unsigned long rate,
+
+ /* if read only, just return current value */
+ if (divider->flags & CLK_DIVIDER_READ_ONLY) {
+- bestdiv = readl(divider->reg) >> divider->shift;
++ bestdiv = clk_readl(divider->reg) >> divider->shift;
+ bestdiv &= div_mask(divider->width);
+ bestdiv = _get_div(divider->table, bestdiv, divider->flags,
+ divider->width);
+diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
+index 58566a17..20b1055 100644
+--- a/drivers/clk/clk-qoriq.c
++++ b/drivers/clk/clk-qoriq.c
+@@ -766,7 +766,11 @@ static struct clk * __init create_one_cmux(struct clockgen *cg, int idx)
+ if (!hwc)
+ return NULL;
+
+- hwc->reg = cg->regs + 0x20 * idx;
++ if (cg->info.flags & CG_VER3)
++ hwc->reg = cg->regs + 0x70000 + 0x20 * idx;
++ else
++ hwc->reg = cg->regs + 0x20 * idx;
++
+ hwc->info = cg->info.cmux_groups[cg->info.cmux_to_group[idx]];
+
+ /*
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 820a939..2877a4d 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -1908,10 +1908,6 @@ int clk_set_phase(struct clk *clk, int degrees)
+
+ clk_prepare_lock();
+
+- /* bail early if nothing to do */
+- if (degrees == clk->core->phase)
+- goto out;
+-
+ trace_clk_set_phase(clk->core, degrees);
+
+ if (clk->core->ops->set_phase)
+@@ -1922,7 +1918,6 @@ int clk_set_phase(struct clk *clk, int degrees)
+ if (!ret)
+ clk->core->phase = degrees;
+
+-out:
+ clk_prepare_unlock();
+
+ return ret;
+@@ -3186,7 +3181,7 @@ struct clk *__of_clk_get_from_provider(struct of_phandle_args *clkspec,
+ {
+ struct of_clk_provider *provider;
+ struct clk *clk = ERR_PTR(-EPROBE_DEFER);
+- struct clk_hw *hw = ERR_PTR(-EPROBE_DEFER);
++ struct clk_hw *hw;
+
+ if (!clkspec)
+ return ERR_PTR(-EINVAL);
+@@ -3194,12 +3189,13 @@ struct clk *__of_clk_get_from_provider(struct of_phandle_args *clkspec,
+ /* Check if we have such a provider in our array */
+ mutex_lock(&of_clk_mutex);
+ list_for_each_entry(provider, &of_clk_providers, link) {
+- if (provider->node == clkspec->np)
++ if (provider->node == clkspec->np) {
+ hw = __of_clk_get_hw_from_provider(provider, clkspec);
+- if (!IS_ERR(hw)) {
+ clk = __clk_create_clk(hw, dev_id, con_id);
++ }
+
+- if (!IS_ERR(clk) && !__clk_get(clk)) {
++ if (!IS_ERR(clk)) {
++ if (!__clk_get(clk)) {
+ __clk_free_clk(clk);
+ clk = ERR_PTR(-ENOENT);
+ }
+diff --git a/drivers/clk/imx/clk-imx35.c b/drivers/clk/imx/clk-imx35.c
+index b0978d3..d302ed3 100644
+--- a/drivers/clk/imx/clk-imx35.c
++++ b/drivers/clk/imx/clk-imx35.c
+@@ -115,7 +115,7 @@ static void __init _mx35_clocks_init(void)
+ }
+
+ clk[ckih] = imx_clk_fixed("ckih", 24000000);
+- clk[ckil] = imx_clk_fixed("ckih", 32768);
++ clk[ckil] = imx_clk_fixed("ckil", 32768);
+ clk[mpll] = imx_clk_pllv1(IMX_PLLV1_IMX35, "mpll", "ckih", base + MX35_CCM_MPCTL);
+ clk[ppll] = imx_clk_pllv1(IMX_PLLV1_IMX35, "ppll", "ckih", base + MX35_CCM_PPCTL);
+
+diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig
+index 95e3b3e..98909b1 100644
+--- a/drivers/clk/qcom/Kconfig
++++ b/drivers/clk/qcom/Kconfig
+@@ -117,6 +117,7 @@ config MSM_MMCC_8974
+
+ config MSM_GCC_8996
+ tristate "MSM8996 Global Clock Controller"
++ select QCOM_GDSC
+ depends on COMMON_CLK_QCOM
+ help
+ Support for the global clock controller on msm8996 devices.
+@@ -126,6 +127,7 @@ config MSM_GCC_8996
+ config MSM_MMCC_8996
+ tristate "MSM8996 Multimedia Clock Controller"
+ select MSM_GCC_8996
++ select QCOM_GDSC
+ depends on COMMON_CLK_QCOM
+ help
+ Support for the multimedia clock controller on msm8996 devices.
+diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c
+index bbf732b..9f643cc 100644
+--- a/drivers/clk/qcom/gcc-msm8996.c
++++ b/drivers/clk/qcom/gcc-msm8996.c
+@@ -2592,9 +2592,9 @@ static struct clk_branch gcc_pcie_2_aux_clk = {
+ };
+
+ static struct clk_branch gcc_pcie_2_pipe_clk = {
+- .halt_reg = 0x6e108,
++ .halt_reg = 0x6e018,
+ .clkr = {
+- .enable_reg = 0x6e108,
++ .enable_reg = 0x6e018,
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_2_pipe_clk",
+diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
+index 94f77b0..32f645e 100644
+--- a/drivers/crypto/ccp/ccp-dmaengine.c
++++ b/drivers/crypto/ccp/ccp-dmaengine.c
+@@ -650,7 +650,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
+ dma_desc_cache_name = devm_kasprintf(ccp->dev, GFP_KERNEL,
+ "%s-dmaengine-desc-cache",
+ ccp->name);
+- if (!dma_cmd_cache_name)
++ if (!dma_desc_cache_name)
+ return -ENOMEM;
+ ccp->dma_desc_cache = kmem_cache_create(dma_desc_cache_name,
+ sizeof(struct ccp_dma_desc),
+diff --git a/drivers/crypto/marvell/cesa.c b/drivers/crypto/marvell/cesa.c
+index d64af86..37dadb2 100644
+--- a/drivers/crypto/marvell/cesa.c
++++ b/drivers/crypto/marvell/cesa.c
+@@ -166,6 +166,7 @@ static irqreturn_t mv_cesa_int(int irq, void *priv)
+ if (!req)
+ break;
+
++ ctx = crypto_tfm_ctx(req->tfm);
+ mv_cesa_complete_req(ctx, req, 0);
+ }
+ }
+diff --git a/drivers/crypto/marvell/hash.c b/drivers/crypto/marvell/hash.c
+index 82e0f4e6..b111e14 100644
+--- a/drivers/crypto/marvell/hash.c
++++ b/drivers/crypto/marvell/hash.c
+@@ -805,13 +805,14 @@ static int mv_cesa_md5_init(struct ahash_request *req)
+ struct mv_cesa_op_ctx tmpl = { };
+
+ mv_cesa_set_op_cfg(&tmpl, CESA_SA_DESC_CFG_MACM_MD5);
++
++ mv_cesa_ahash_init(req, &tmpl, true);
++
+ creq->state[0] = MD5_H0;
+ creq->state[1] = MD5_H1;
+ creq->state[2] = MD5_H2;
+ creq->state[3] = MD5_H3;
+
+- mv_cesa_ahash_init(req, &tmpl, true);
+-
+ return 0;
+ }
+
+@@ -873,14 +874,15 @@ static int mv_cesa_sha1_init(struct ahash_request *req)
+ struct mv_cesa_op_ctx tmpl = { };
+
+ mv_cesa_set_op_cfg(&tmpl, CESA_SA_DESC_CFG_MACM_SHA1);
++
++ mv_cesa_ahash_init(req, &tmpl, false);
++
+ creq->state[0] = SHA1_H0;
+ creq->state[1] = SHA1_H1;
+ creq->state[2] = SHA1_H2;
+ creq->state[3] = SHA1_H3;
+ creq->state[4] = SHA1_H4;
+
+- mv_cesa_ahash_init(req, &tmpl, false);
+-
+ return 0;
+ }
+
+@@ -942,6 +944,9 @@ static int mv_cesa_sha256_init(struct ahash_request *req)
+ struct mv_cesa_op_ctx tmpl = { };
+
+ mv_cesa_set_op_cfg(&tmpl, CESA_SA_DESC_CFG_MACM_SHA256);
++
++ mv_cesa_ahash_init(req, &tmpl, false);
++
+ creq->state[0] = SHA256_H0;
+ creq->state[1] = SHA256_H1;
+ creq->state[2] = SHA256_H2;
+@@ -951,8 +956,6 @@ static int mv_cesa_sha256_init(struct ahash_request *req)
+ creq->state[6] = SHA256_H6;
+ creq->state[7] = SHA256_H7;
+
+- mv_cesa_ahash_init(req, &tmpl, false);
+-
+ return 0;
+ }
+
+diff --git a/drivers/dma/ipu/ipu_irq.c b/drivers/dma/ipu/ipu_irq.c
+index 2bf37e6..dd184b5 100644
+--- a/drivers/dma/ipu/ipu_irq.c
++++ b/drivers/dma/ipu/ipu_irq.c
+@@ -286,22 +286,21 @@ static void ipu_irq_handler(struct irq_desc *desc)
+ raw_spin_unlock(&bank_lock);
+ while ((line = ffs(status))) {
+ struct ipu_irq_map *map;
+- unsigned int irq = NO_IRQ;
++ unsigned int irq;
+
+ line--;
+ status &= ~(1UL << line);
+
+ raw_spin_lock(&bank_lock);
+ map = src2map(32 * i + line);
+- if (map)
+- irq = map->irq;
+- raw_spin_unlock(&bank_lock);
+-
+ if (!map) {
++ raw_spin_unlock(&bank_lock);
+ pr_err("IPU: Interrupt on unmapped source %u bank %d\n",
+ line, i);
+ continue;
+ }
++ irq = map->irq;
++ raw_spin_unlock(&bank_lock);
+ generic_handle_irq(irq);
+ }
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+index 17e1362..4e71a68 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+@@ -43,6 +43,9 @@ static int amdgpu_ctx_init(struct amdgpu_device *adev, struct amdgpu_ctx *ctx)
+ ctx->rings[i].sequence = 1;
+ ctx->rings[i].fences = &ctx->fences[amdgpu_sched_jobs * i];
+ }
++
++ ctx->reset_counter = atomic_read(&adev->gpu_reset_counter);
++
+ /* create context entity for each ring */
+ for (i = 0; i < adev->num_rings; i++) {
+ struct amdgpu_ring *ring = adev->rings[i];
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
+index fe36caf..14f57d9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
+@@ -113,24 +113,26 @@ void amdgpu_dpm_print_ps_status(struct amdgpu_device *adev,
+ printk("\n");
+ }
+
++
+ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev)
+ {
+ struct drm_device *dev = adev->ddev;
+ struct drm_crtc *crtc;
+ struct amdgpu_crtc *amdgpu_crtc;
+- u32 line_time_us, vblank_lines;
++ u32 vblank_in_pixels;
+ u32 vblank_time_us = 0xffffffff; /* if the displays are off, vblank time is max */
+
+ if (adev->mode_info.num_crtc && adev->mode_info.mode_config_initialized) {
+ list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+ amdgpu_crtc = to_amdgpu_crtc(crtc);
+ if (crtc->enabled && amdgpu_crtc->enabled && amdgpu_crtc->hw_mode.clock) {
+- line_time_us = (amdgpu_crtc->hw_mode.crtc_htotal * 1000) /
+- amdgpu_crtc->hw_mode.clock;
+- vblank_lines = amdgpu_crtc->hw_mode.crtc_vblank_end -
++ vblank_in_pixels =
++ amdgpu_crtc->hw_mode.crtc_htotal *
++ (amdgpu_crtc->hw_mode.crtc_vblank_end -
+ amdgpu_crtc->hw_mode.crtc_vdisplay +
+- (amdgpu_crtc->v_border * 2);
+- vblank_time_us = vblank_lines * line_time_us;
++ (amdgpu_crtc->v_border * 2));
++
++ vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock;
+ break;
+ }
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index d942654..e24a8af 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -292,7 +292,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
+ type = AMD_IP_BLOCK_TYPE_UVD;
+ ring_mask = adev->uvd.ring.ready ? 1 : 0;
+ ib_start_alignment = AMDGPU_GPU_PAGE_SIZE;
+- ib_size_alignment = 8;
++ ib_size_alignment = 16;
+ break;
+ case AMDGPU_HW_IP_VCE:
+ type = AMD_IP_BLOCK_TYPE_VCE;
+diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+index c1b04e9..172bed9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+@@ -425,16 +425,6 @@ static void dce_v10_0_hpd_init(struct amdgpu_device *adev)
+ list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+ struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
+
+- if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
+- connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
+- /* don't try to enable hpd on eDP or LVDS avoid breaking the
+- * aux dp channel on imac and help (but not completely fix)
+- * https://bugzilla.redhat.com/show_bug.cgi?id=726143
+- * also avoid interrupt storms during dpms.
+- */
+- continue;
+- }
+-
+ switch (amdgpu_connector->hpd.hpd) {
+ case AMDGPU_HPD_1:
+ idx = 0;
+@@ -458,6 +448,19 @@ static void dce_v10_0_hpd_init(struct amdgpu_device *adev)
+ continue;
+ }
+
++ if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
++ connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
++ /* don't try to enable hpd on eDP or LVDS avoid breaking the
++ * aux dp channel on imac and help (but not completely fix)
++ * https://bugzilla.redhat.com/show_bug.cgi?id=726143
++ * also avoid interrupt storms during dpms.
++ */
++ tmp = RREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx]);
++ tmp = REG_SET_FIELD(tmp, DC_HPD_INT_CONTROL, DC_HPD_INT_EN, 0);
++ WREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx], tmp);
++ continue;
++ }
++
+ tmp = RREG32(mmDC_HPD_CONTROL + hpd_offsets[idx]);
+ tmp = REG_SET_FIELD(tmp, DC_HPD_CONTROL, DC_HPD_EN, 1);
+ WREG32(mmDC_HPD_CONTROL + hpd_offsets[idx], tmp);
+diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+index d4bf133..67c7c05 100644
+--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+@@ -443,16 +443,6 @@ static void dce_v11_0_hpd_init(struct amdgpu_device *adev)
+ list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+ struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
+
+- if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
+- connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
+- /* don't try to enable hpd on eDP or LVDS avoid breaking the
+- * aux dp channel on imac and help (but not completely fix)
+- * https://bugzilla.redhat.com/show_bug.cgi?id=726143
+- * also avoid interrupt storms during dpms.
+- */
+- continue;
+- }
+-
+ switch (amdgpu_connector->hpd.hpd) {
+ case AMDGPU_HPD_1:
+ idx = 0;
+@@ -476,6 +466,19 @@ static void dce_v11_0_hpd_init(struct amdgpu_device *adev)
+ continue;
+ }
+
++ if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
++ connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
++ /* don't try to enable hpd on eDP or LVDS avoid breaking the
++ * aux dp channel on imac and help (but not completely fix)
++ * https://bugzilla.redhat.com/show_bug.cgi?id=726143
++ * also avoid interrupt storms during dpms.
++ */
++ tmp = RREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx]);
++ tmp = REG_SET_FIELD(tmp, DC_HPD_INT_CONTROL, DC_HPD_INT_EN, 0);
++ WREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx], tmp);
++ continue;
++ }
++
+ tmp = RREG32(mmDC_HPD_CONTROL + hpd_offsets[idx]);
+ tmp = REG_SET_FIELD(tmp, DC_HPD_CONTROL, DC_HPD_EN, 1);
+ WREG32(mmDC_HPD_CONTROL + hpd_offsets[idx], tmp);
+@@ -3109,6 +3112,7 @@ static int dce_v11_0_sw_fini(void *handle)
+
+ dce_v11_0_afmt_fini(adev);
+
++ drm_mode_config_cleanup(adev->ddev);
+ adev->mode_info.mode_config_initialized = false;
+
+ return 0;
+diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+index 4fdfab1..ea07c50 100644
+--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+@@ -395,15 +395,6 @@ static void dce_v8_0_hpd_init(struct amdgpu_device *adev)
+ list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+ struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
+
+- if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
+- connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
+- /* don't try to enable hpd on eDP or LVDS avoid breaking the
+- * aux dp channel on imac and help (but not completely fix)
+- * https://bugzilla.redhat.com/show_bug.cgi?id=726143
+- * also avoid interrupt storms during dpms.
+- */
+- continue;
+- }
+ switch (amdgpu_connector->hpd.hpd) {
+ case AMDGPU_HPD_1:
+ WREG32(mmDC_HPD1_CONTROL, tmp);
+@@ -426,6 +417,45 @@ static void dce_v8_0_hpd_init(struct amdgpu_device *adev)
+ default:
+ break;
+ }
++
++ if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
++ connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
++ /* don't try to enable hpd on eDP or LVDS avoid breaking the
++ * aux dp channel on imac and help (but not completely fix)
++ * https://bugzilla.redhat.com/show_bug.cgi?id=726143
++ * also avoid interrupt storms during dpms.
++ */
++ u32 dc_hpd_int_cntl_reg, dc_hpd_int_cntl;
++
++ switch (amdgpu_connector->hpd.hpd) {
++ case AMDGPU_HPD_1:
++ dc_hpd_int_cntl_reg = mmDC_HPD1_INT_CONTROL;
++ break;
++ case AMDGPU_HPD_2:
++ dc_hpd_int_cntl_reg = mmDC_HPD2_INT_CONTROL;
++ break;
++ case AMDGPU_HPD_3:
++ dc_hpd_int_cntl_reg = mmDC_HPD3_INT_CONTROL;
++ break;
++ case AMDGPU_HPD_4:
++ dc_hpd_int_cntl_reg = mmDC_HPD4_INT_CONTROL;
++ break;
++ case AMDGPU_HPD_5:
++ dc_hpd_int_cntl_reg = mmDC_HPD5_INT_CONTROL;
++ break;
++ case AMDGPU_HPD_6:
++ dc_hpd_int_cntl_reg = mmDC_HPD6_INT_CONTROL;
++ break;
++ default:
++ continue;
++ }
++
++ dc_hpd_int_cntl = RREG32(dc_hpd_int_cntl_reg);
++ dc_hpd_int_cntl &= ~DC_HPD1_INT_CONTROL__DC_HPD1_INT_EN_MASK;
++ WREG32(dc_hpd_int_cntl_reg, dc_hpd_int_cntl);
++ continue;
++ }
++
+ dce_v8_0_hpd_set_polarity(adev, amdgpu_connector->hpd.hpd);
+ amdgpu_irq_get(adev, &adev->hpd_irq, amdgpu_connector->hpd.hpd);
+ }
+diff --git a/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c b/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c
+index 635fc4b..92b1178 100644
+--- a/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c
++++ b/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c
+@@ -262,6 +262,8 @@ static const pem_event_action * const display_config_change_event[] = {
+ unblock_adjust_power_state_tasks,
+ set_cpu_power_state,
+ notify_hw_power_source_tasks,
++ get_2d_performance_state_tasks,
++ set_performance_state_tasks,
+ /* updateDALConfigurationTasks,
+ variBrightDisplayConfigurationChangeTasks, */
+ adjust_power_state_tasks,
+diff --git a/drivers/gpu/drm/amd/powerplay/eventmgr/psm.c b/drivers/gpu/drm/amd/powerplay/eventmgr/psm.c
+index a46225c..d6bee72 100644
+--- a/drivers/gpu/drm/amd/powerplay/eventmgr/psm.c
++++ b/drivers/gpu/drm/amd/powerplay/eventmgr/psm.c
+@@ -100,11 +100,12 @@ int psm_adjust_power_state_dynamic(struct pp_eventmgr *eventmgr, bool skip)
+ if (requested == NULL)
+ return 0;
+
++ phm_apply_state_adjust_rules(hwmgr, requested, pcurrent);
++
+ if (pcurrent == NULL || (0 != phm_check_states_equal(hwmgr, &pcurrent->hardware, &requested->hardware, &equal)))
+ equal = false;
+
+ if (!equal || phm_check_smc_update_required_for_display_configuration(hwmgr)) {
+- phm_apply_state_adjust_rules(hwmgr, requested, pcurrent);
+ phm_set_power_state(hwmgr, &pcurrent->hardware, &requested->hardware);
+ hwmgr->current_ps = requested;
+ }
+diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
+index 780589b..9c4387d 100644
+--- a/drivers/gpu/drm/drm_prime.c
++++ b/drivers/gpu/drm/drm_prime.c
+@@ -335,14 +335,17 @@ static const struct dma_buf_ops drm_gem_prime_dmabuf_ops = {
+ * using the PRIME helpers.
+ */
+ struct dma_buf *drm_gem_prime_export(struct drm_device *dev,
+- struct drm_gem_object *obj, int flags)
++ struct drm_gem_object *obj,
++ int flags)
+ {
+- DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+-
+- exp_info.ops = &drm_gem_prime_dmabuf_ops;
+- exp_info.size = obj->size;
+- exp_info.flags = flags;
+- exp_info.priv = obj;
++ struct dma_buf_export_info exp_info = {
++ .exp_name = KBUILD_MODNAME, /* white lie for debug */
++ .owner = dev->driver->fops->owner,
++ .ops = &drm_gem_prime_dmabuf_ops,
++ .size = obj->size,
++ .flags = flags,
++ .priv = obj,
++ };
+
+ if (dev->driver->gem_prime_res_obj)
+ exp_info.resv = dev->driver->gem_prime_res_obj(obj);
+diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+index 7882387..5fc8ebd 100644
+--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+@@ -330,6 +330,7 @@ static int fsl_dcu_drm_probe(struct platform_device *pdev)
+ const char *pix_clk_in_name;
+ const struct of_device_id *id;
+ int ret;
++ u8 div_ratio_shift = 0;
+
+ fsl_dev = devm_kzalloc(dev, sizeof(*fsl_dev), GFP_KERNEL);
+ if (!fsl_dev)
+@@ -382,11 +383,14 @@ static int fsl_dcu_drm_probe(struct platform_device *pdev)
+ pix_clk_in = fsl_dev->clk;
+ }
+
++ if (of_property_read_bool(dev->of_node, "big-endian"))
++ div_ratio_shift = 24;
++
+ pix_clk_in_name = __clk_get_name(pix_clk_in);
+ snprintf(pix_clk_name, sizeof(pix_clk_name), "%s_pix", pix_clk_in_name);
+ fsl_dev->pix_clk = clk_register_divider(dev, pix_clk_name,
+ pix_clk_in_name, 0, base + DCU_DIV_RATIO,
+- 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL);
++ div_ratio_shift, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL);
+ if (IS_ERR(fsl_dev->pix_clk)) {
+ dev_err(dev, "failed to register pix clk\n");
+ ret = PTR_ERR(fsl_dev->pix_clk);
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index f68c789..84a0010 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -631,6 +631,8 @@ struct drm_i915_display_funcs {
+ struct intel_crtc_state *crtc_state);
+ void (*crtc_enable)(struct drm_crtc *crtc);
+ void (*crtc_disable)(struct drm_crtc *crtc);
++ void (*update_crtcs)(struct drm_atomic_state *state,
++ unsigned int *crtc_vblank_mask);
+ void (*audio_codec_enable)(struct drm_connector *connector,
+ struct intel_encoder *encoder,
+ const struct drm_display_mode *adjusted_mode);
+@@ -1965,11 +1967,11 @@ struct drm_i915_private {
+ struct vlv_s0ix_state vlv_s0ix_state;
+
+ enum {
+- I915_SKL_SAGV_UNKNOWN = 0,
+- I915_SKL_SAGV_DISABLED,
+- I915_SKL_SAGV_ENABLED,
+- I915_SKL_SAGV_NOT_CONTROLLED
+- } skl_sagv_status;
++ I915_SAGV_UNKNOWN = 0,
++ I915_SAGV_DISABLED,
++ I915_SAGV_ENABLED,
++ I915_SAGV_NOT_CONTROLLED
++ } sagv_status;
+
+ struct {
+ /*
+@@ -2280,21 +2282,19 @@ struct drm_i915_gem_object {
+ /** Record of address bit 17 of each page at last unbind. */
+ unsigned long *bit_17;
+
+- union {
+- /** for phy allocated objects */
+- struct drm_dma_handle *phys_handle;
+-
+- struct i915_gem_userptr {
+- uintptr_t ptr;
+- unsigned read_only :1;
+- unsigned workers :4;
++ struct i915_gem_userptr {
++ uintptr_t ptr;
++ unsigned read_only :1;
++ unsigned workers :4;
+ #define I915_GEM_USERPTR_MAX_WORKERS 15
+
+- struct i915_mm_struct *mm;
+- struct i915_mmu_object *mmu_object;
+- struct work_struct *work;
+- } userptr;
+- };
++ struct i915_mm_struct *mm;
++ struct i915_mmu_object *mmu_object;
++ struct work_struct *work;
++ } userptr;
++
++ /** for phys allocated objects */
++ struct drm_dma_handle *phys_handle;
+ };
+ #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
+
+diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
+index 66be299a1..2bb69f3 100644
+--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
+@@ -115,17 +115,28 @@ static unsigned long i915_stolen_to_physical(struct drm_device *dev)
+
+ base = bsm & INTEL_BSM_MASK;
+ } else if (IS_I865G(dev)) {
++ u32 tseg_size = 0;
+ u16 toud = 0;
++ u8 tmp;
++
++ pci_bus_read_config_byte(dev->pdev->bus, PCI_DEVFN(0, 0),
++ I845_ESMRAMC, &tmp);
++
++ if (tmp & TSEG_ENABLE) {
++ switch (tmp & I845_TSEG_SIZE_MASK) {
++ case I845_TSEG_SIZE_512K:
++ tseg_size = KB(512);
++ break;
++ case I845_TSEG_SIZE_1M:
++ tseg_size = MB(1);
++ break;
++ }
++ }
+
+- /*
+- * FIXME is the graphics stolen memory region
+- * always at TOUD? Ie. is it always the last
+- * one to be allocated by the BIOS?
+- */
+ pci_bus_read_config_word(dev->pdev->bus, PCI_DEVFN(0, 0),
+ I865_TOUD, &toud);
+
+- base = toud << 16;
++ base = (toud << 16) + tseg_size;
+ } else if (IS_I85X(dev)) {
+ u32 tseg_size = 0;
+ u32 tom;
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 175595f..e9a64fb 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2980,6 +2980,7 @@ static void skylake_update_primary_plane(struct drm_plane *plane,
+ struct intel_crtc *intel_crtc = to_intel_crtc(crtc_state->base.crtc);
+ struct drm_framebuffer *fb = plane_state->base.fb;
+ struct drm_i915_gem_object *obj = intel_fb_obj(fb);
++ const struct skl_wm_values *wm = &dev_priv->wm.skl_results;
+ int pipe = intel_crtc->pipe;
+ u32 plane_ctl, stride_div, stride;
+ u32 tile_height, plane_offset, plane_size;
+@@ -3031,6 +3032,9 @@ static void skylake_update_primary_plane(struct drm_plane *plane,
+ intel_crtc->adjusted_x = x_offset;
+ intel_crtc->adjusted_y = y_offset;
+
++ if (wm->dirty_pipes & drm_crtc_mask(&intel_crtc->base))
++ skl_write_plane_wm(intel_crtc, wm, 0);
++
+ I915_WRITE(PLANE_CTL(pipe, 0), plane_ctl);
+ I915_WRITE(PLANE_OFFSET(pipe, 0), plane_offset);
+ I915_WRITE(PLANE_SIZE(pipe, 0), plane_size);
+@@ -3061,7 +3065,15 @@ static void skylake_disable_primary_plane(struct drm_plane *primary,
+ {
+ struct drm_device *dev = crtc->dev;
+ struct drm_i915_private *dev_priv = to_i915(dev);
+- int pipe = to_intel_crtc(crtc)->pipe;
++ struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
++ int pipe = intel_crtc->pipe;
++
++ /*
++ * We only populate skl_results on watermark updates, and if the
++ * plane's visiblity isn't actually changing neither is its watermarks.
++ */
++ if (!to_intel_plane_state(crtc->primary->state)->visible)
++ skl_write_plane_wm(intel_crtc, &dev_priv->wm.skl_results, 0);
+
+ I915_WRITE(PLANE_CTL(pipe, 0), 0);
+ I915_WRITE(PLANE_SURF(pipe, 0), 0);
+@@ -8995,6 +9007,24 @@ static void ironlake_compute_dpll(struct intel_crtc *intel_crtc,
+ if (intel_crtc_has_dp_encoder(crtc_state))
+ dpll |= DPLL_SDVO_HIGH_SPEED;
+
++ /*
++ * The high speed IO clock is only really required for
++ * SDVO/HDMI/DP, but we also enable it for CRT to make it
++ * possible to share the DPLL between CRT and HDMI. Enabling
++ * the clock needlessly does no real harm, except use up a
++ * bit of power potentially.
++ *
++ * We'll limit this to IVB with 3 pipes, since it has only two
++ * DPLLs and so DPLL sharing is the only way to get three pipes
++ * driving PCH ports at the same time. On SNB we could do this,
++ * and potentially avoid enabling the second DPLL, but it's not
++ * clear if it''s a win or loss power wise. No point in doing
++ * this on ILK at all since it has a fixed DPLL<->pipe mapping.
++ */
++ if (INTEL_INFO(dev_priv)->num_pipes == 3 &&
++ intel_crtc_has_type(crtc_state, INTEL_OUTPUT_ANALOG))
++ dpll |= DPLL_SDVO_HIGH_SPEED;
++
+ /* compute bitmask from p1 value */
+ dpll |= (1 << (crtc_state->dpll.p1 - 1)) << DPLL_FPA01_P1_POST_DIV_SHIFT;
+ /* also FPA1 */
+@@ -10306,9 +10336,13 @@ static void i9xx_update_cursor(struct drm_crtc *crtc, u32 base,
+ struct drm_device *dev = crtc->dev;
+ struct drm_i915_private *dev_priv = to_i915(dev);
+ struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
++ const struct skl_wm_values *wm = &dev_priv->wm.skl_results;
+ int pipe = intel_crtc->pipe;
+ uint32_t cntl = 0;
+
++ if (INTEL_GEN(dev_priv) >= 9 && wm->dirty_pipes & drm_crtc_mask(crtc))
++ skl_write_cursor_wm(intel_crtc, wm);
++
+ if (plane_state && plane_state->visible) {
+ cntl = MCURSOR_GAMMA_ENABLE;
+ switch (plane_state->base.crtc_w) {
+@@ -12956,16 +12990,23 @@ static void verify_wm_state(struct drm_crtc *crtc,
+ hw_entry->start, hw_entry->end);
+ }
+
+- /* cursor */
+- hw_entry = &hw_ddb.plane[pipe][PLANE_CURSOR];
+- sw_entry = &sw_ddb->plane[pipe][PLANE_CURSOR];
+-
+- if (!skl_ddb_entry_equal(hw_entry, sw_entry)) {
+- DRM_ERROR("mismatch in DDB state pipe %c cursor "
+- "(expected (%u,%u), found (%u,%u))\n",
+- pipe_name(pipe),
+- sw_entry->start, sw_entry->end,
+- hw_entry->start, hw_entry->end);
++ /*
++ * cursor
++ * If the cursor plane isn't active, we may not have updated it's ddb
++ * allocation. In that case since the ddb allocation will be updated
++ * once the plane becomes visible, we can skip this check
++ */
++ if (intel_crtc->cursor_addr) {
++ hw_entry = &hw_ddb.plane[pipe][PLANE_CURSOR];
++ sw_entry = &sw_ddb->plane[pipe][PLANE_CURSOR];
++
++ if (!skl_ddb_entry_equal(hw_entry, sw_entry)) {
++ DRM_ERROR("mismatch in DDB state pipe %c cursor "
++ "(expected (%u,%u), found (%u,%u))\n",
++ pipe_name(pipe),
++ sw_entry->start, sw_entry->end,
++ hw_entry->start, hw_entry->end);
++ }
+ }
+ }
+
+@@ -13671,6 +13712,111 @@ static bool needs_vblank_wait(struct intel_crtc_state *crtc_state)
+ return false;
+ }
+
++static void intel_update_crtc(struct drm_crtc *crtc,
++ struct drm_atomic_state *state,
++ struct drm_crtc_state *old_crtc_state,
++ unsigned int *crtc_vblank_mask)
++{
++ struct drm_device *dev = crtc->dev;
++ struct drm_i915_private *dev_priv = to_i915(dev);
++ struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
++ struct intel_crtc_state *pipe_config = to_intel_crtc_state(crtc->state);
++ bool modeset = needs_modeset(crtc->state);
++
++ if (modeset) {
++ update_scanline_offset(intel_crtc);
++ dev_priv->display.crtc_enable(crtc);
++ } else {
++ intel_pre_plane_update(to_intel_crtc_state(old_crtc_state));
++ }
++
++ if (drm_atomic_get_existing_plane_state(state, crtc->primary)) {
++ intel_fbc_enable(
++ intel_crtc, pipe_config,
++ to_intel_plane_state(crtc->primary->state));
++ }
++
++ drm_atomic_helper_commit_planes_on_crtc(old_crtc_state);
++
++ if (needs_vblank_wait(pipe_config))
++ *crtc_vblank_mask |= drm_crtc_mask(crtc);
++}
++
++static void intel_update_crtcs(struct drm_atomic_state *state,
++ unsigned int *crtc_vblank_mask)
++{
++ struct drm_crtc *crtc;
++ struct drm_crtc_state *old_crtc_state;
++ int i;
++
++ for_each_crtc_in_state(state, crtc, old_crtc_state, i) {
++ if (!crtc->state->active)
++ continue;
++
++ intel_update_crtc(crtc, state, old_crtc_state,
++ crtc_vblank_mask);
++ }
++}
++
++static void skl_update_crtcs(struct drm_atomic_state *state,
++ unsigned int *crtc_vblank_mask)
++{
++ struct drm_device *dev = state->dev;
++ struct drm_i915_private *dev_priv = to_i915(dev);
++ struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
++ struct drm_crtc *crtc;
++ struct drm_crtc_state *old_crtc_state;
++ struct skl_ddb_allocation *new_ddb = &intel_state->wm_results.ddb;
++ struct skl_ddb_allocation *cur_ddb = &dev_priv->wm.skl_hw.ddb;
++ unsigned int updated = 0;
++ bool progress;
++ enum pipe pipe;
++
++ /*
++ * Whenever the number of active pipes changes, we need to make sure we
++ * update the pipes in the right order so that their ddb allocations
++ * never overlap with eachother inbetween CRTC updates. Otherwise we'll
++ * cause pipe underruns and other bad stuff.
++ */
++ do {
++ int i;
++ progress = false;
++
++ for_each_crtc_in_state(state, crtc, old_crtc_state, i) {
++ bool vbl_wait = false;
++ unsigned int cmask = drm_crtc_mask(crtc);
++ pipe = to_intel_crtc(crtc)->pipe;
++
++ if (updated & cmask || !crtc->state->active)
++ continue;
++ if (skl_ddb_allocation_overlaps(state, cur_ddb, new_ddb,
++ pipe))
++ continue;
++
++ updated |= cmask;
++
++ /*
++ * If this is an already active pipe, it's DDB changed,
++ * and this isn't the last pipe that needs updating
++ * then we need to wait for a vblank to pass for the
++ * new ddb allocation to take effect.
++ */
++ if (!skl_ddb_allocation_equals(cur_ddb, new_ddb, pipe) &&
++ !crtc->state->active_changed &&
++ intel_state->wm_results.dirty_pipes != updated)
++ vbl_wait = true;
++
++ intel_update_crtc(crtc, state, old_crtc_state,
++ crtc_vblank_mask);
++
++ if (vbl_wait)
++ intel_wait_for_vblank(dev, pipe);
++
++ progress = true;
++ }
++ } while (progress);
++}
++
+ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
+ {
+ struct drm_device *dev = state->dev;
+@@ -13763,23 +13909,15 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
+ * SKL workaround: bspec recommends we disable the SAGV when we
+ * have more then one pipe enabled
+ */
+- if (IS_SKYLAKE(dev_priv) && !skl_can_enable_sagv(state))
+- skl_disable_sagv(dev_priv);
++ if (!intel_can_enable_sagv(state))
++ intel_disable_sagv(dev_priv);
+
+ intel_modeset_verify_disabled(dev);
+ }
+
+- /* Now enable the clocks, plane, pipe, and connectors that we set up. */
++ /* Complete the events for pipes that have now been disabled */
+ for_each_crtc_in_state(state, crtc, old_crtc_state, i) {
+- struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+ bool modeset = needs_modeset(crtc->state);
+- struct intel_crtc_state *pipe_config =
+- to_intel_crtc_state(crtc->state);
+-
+- if (modeset && crtc->state->active) {
+- update_scanline_offset(to_intel_crtc(crtc));
+- dev_priv->display.crtc_enable(crtc);
+- }
+
+ /* Complete events for now disable pipes here. */
+ if (modeset && !crtc->state->active && crtc->state->event) {
+@@ -13789,21 +13927,11 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
+
+ crtc->state->event = NULL;
+ }
+-
+- if (!modeset)
+- intel_pre_plane_update(to_intel_crtc_state(old_crtc_state));
+-
+- if (crtc->state->active &&
+- drm_atomic_get_existing_plane_state(state, crtc->primary))
+- intel_fbc_enable(intel_crtc, pipe_config, to_intel_plane_state(crtc->primary->state));
+-
+- if (crtc->state->active)
+- drm_atomic_helper_commit_planes_on_crtc(old_crtc_state);
+-
+- if (pipe_config->base.active && needs_vblank_wait(pipe_config))
+- crtc_vblank_mask |= 1 << i;
+ }
+
++ /* Now enable the clocks, plane, pipe, and connectors that we set up. */
++ dev_priv->display.update_crtcs(state, &crtc_vblank_mask);
++
+ /* FIXME: We should call drm_atomic_helper_commit_hw_done() here
+ * already, but still need the state for the delayed optimization. To
+ * fix this:
+@@ -13839,9 +13967,8 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
+ intel_modeset_verify_crtc(crtc, old_crtc_state, crtc->state);
+ }
+
+- if (IS_SKYLAKE(dev_priv) && intel_state->modeset &&
+- skl_can_enable_sagv(state))
+- skl_enable_sagv(dev_priv);
++ if (intel_state->modeset && intel_can_enable_sagv(state))
++ intel_enable_sagv(dev_priv);
+
+ drm_atomic_helper_commit_hw_done(state);
+
+@@ -14221,10 +14348,12 @@ static void intel_begin_crtc_commit(struct drm_crtc *crtc,
+ struct drm_crtc_state *old_crtc_state)
+ {
+ struct drm_device *dev = crtc->dev;
++ struct drm_i915_private *dev_priv = to_i915(dev);
+ struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+ struct intel_crtc_state *old_intel_state =
+ to_intel_crtc_state(old_crtc_state);
+ bool modeset = needs_modeset(crtc->state);
++ enum pipe pipe = intel_crtc->pipe;
+
+ /* Perform vblank evasion around commit operation */
+ intel_pipe_update_start(intel_crtc);
+@@ -14239,8 +14368,12 @@ static void intel_begin_crtc_commit(struct drm_crtc *crtc,
+
+ if (to_intel_crtc_state(crtc->state)->update_pipe)
+ intel_update_pipe_config(intel_crtc, old_intel_state);
+- else if (INTEL_INFO(dev)->gen >= 9)
++ else if (INTEL_GEN(dev_priv) >= 9) {
+ skl_detach_scalers(intel_crtc);
++
++ I915_WRITE(PIPE_WM_LINETIME(pipe),
++ dev_priv->wm.skl_hw.wm_linetime[pipe]);
++ }
+ }
+
+ static void intel_finish_crtc_commit(struct drm_crtc *crtc,
+@@ -15347,6 +15480,11 @@ void intel_init_display_hooks(struct drm_i915_private *dev_priv)
+ skl_modeset_calc_cdclk;
+ }
+
++ if (dev_priv->info.gen >= 9)
++ dev_priv->display.update_crtcs = skl_update_crtcs;
++ else
++ dev_priv->display.update_crtcs = intel_update_crtcs;
++
+ switch (INTEL_INFO(dev_priv)->gen) {
+ case 2:
+ dev_priv->display.queue_flip = intel_gen2_queue_flip;
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 21b04c3..1ca155f 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -4148,7 +4148,7 @@ static bool bxt_digital_port_connected(struct drm_i915_private *dev_priv,
+ *
+ * Return %true if @port is connected, %false otherwise.
+ */
+-bool intel_digital_port_connected(struct drm_i915_private *dev_priv,
++static bool intel_digital_port_connected(struct drm_i915_private *dev_priv,
+ struct intel_digital_port *port)
+ {
+ if (HAS_PCH_IBX(dev_priv))
+@@ -4207,7 +4207,7 @@ intel_dp_unset_edid(struct intel_dp *intel_dp)
+ intel_dp->has_audio = false;
+ }
+
+-static void
++static enum drm_connector_status
+ intel_dp_long_pulse(struct intel_connector *intel_connector)
+ {
+ struct drm_connector *connector = &intel_connector->base;
+@@ -4232,7 +4232,7 @@ intel_dp_long_pulse(struct intel_connector *intel_connector)
+ else
+ status = connector_status_disconnected;
+
+- if (status != connector_status_connected) {
++ if (status == connector_status_disconnected) {
+ intel_dp->compliance_test_active = 0;
+ intel_dp->compliance_test_type = 0;
+ intel_dp->compliance_test_data = 0;
+@@ -4284,8 +4284,8 @@ intel_dp_long_pulse(struct intel_connector *intel_connector)
+ intel_dp->aux.i2c_defer_count = 0;
+
+ intel_dp_set_edid(intel_dp);
+-
+- status = connector_status_connected;
++ if (is_edp(intel_dp) || intel_connector->detect_edid)
++ status = connector_status_connected;
+ intel_dp->detect_done = true;
+
+ /* Try to read the source of the interrupt */
+@@ -4303,12 +4303,11 @@ intel_dp_long_pulse(struct intel_connector *intel_connector)
+ }
+
+ out:
+- if ((status != connector_status_connected) &&
+- (intel_dp->is_mst == false))
++ if (status != connector_status_connected && !intel_dp->is_mst)
+ intel_dp_unset_edid(intel_dp);
+
+ intel_display_power_put(to_i915(dev), power_domain);
+- return;
++ return status;
+ }
+
+ static enum drm_connector_status
+@@ -4317,7 +4316,7 @@ intel_dp_detect(struct drm_connector *connector, bool force)
+ struct intel_dp *intel_dp = intel_attached_dp(connector);
+ struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
+ struct intel_encoder *intel_encoder = &intel_dig_port->base;
+- struct intel_connector *intel_connector = to_intel_connector(connector);
++ enum drm_connector_status status = connector->status;
+
+ DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
+ connector->base.id, connector->name);
+@@ -4332,14 +4331,11 @@ intel_dp_detect(struct drm_connector *connector, bool force)
+
+ /* If full detect is not performed yet, do a full detect */
+ if (!intel_dp->detect_done)
+- intel_dp_long_pulse(intel_dp->attached_connector);
++ status = intel_dp_long_pulse(intel_dp->attached_connector);
+
+ intel_dp->detect_done = false;
+
+- if (is_edp(intel_dp) || intel_connector->detect_edid)
+- return connector_status_connected;
+- else
+- return connector_status_disconnected;
++ return status;
+ }
+
+ static void
+@@ -4696,36 +4692,34 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
+ port_name(intel_dig_port->port),
+ long_hpd ? "long" : "short");
+
++ if (long_hpd) {
++ intel_dp->detect_done = false;
++ return IRQ_NONE;
++ }
++
+ power_domain = intel_display_port_aux_power_domain(intel_encoder);
+ intel_display_power_get(dev_priv, power_domain);
+
+- if (long_hpd) {
+- intel_dp_long_pulse(intel_dp->attached_connector);
+- if (intel_dp->is_mst)
+- ret = IRQ_HANDLED;
+- goto put_power;
+-
+- } else {
+- if (intel_dp->is_mst) {
+- if (intel_dp_check_mst_status(intel_dp) == -EINVAL) {
+- /*
+- * If we were in MST mode, and device is not
+- * there, get out of MST mode
+- */
+- DRM_DEBUG_KMS("MST device may have disappeared %d vs %d\n",
+- intel_dp->is_mst, intel_dp->mst_mgr.mst_state);
+- intel_dp->is_mst = false;
+- drm_dp_mst_topology_mgr_set_mst(&intel_dp->mst_mgr,
+- intel_dp->is_mst);
+- goto put_power;
+- }
++ if (intel_dp->is_mst) {
++ if (intel_dp_check_mst_status(intel_dp) == -EINVAL) {
++ /*
++ * If we were in MST mode, and device is not
++ * there, get out of MST mode
++ */
++ DRM_DEBUG_KMS("MST device may have disappeared %d vs %d\n",
++ intel_dp->is_mst, intel_dp->mst_mgr.mst_state);
++ intel_dp->is_mst = false;
++ drm_dp_mst_topology_mgr_set_mst(&intel_dp->mst_mgr,
++ intel_dp->is_mst);
++ intel_dp->detect_done = false;
++ goto put_power;
+ }
++ }
+
+- if (!intel_dp->is_mst) {
+- if (!intel_dp_short_pulse(intel_dp)) {
+- intel_dp_long_pulse(intel_dp->attached_connector);
+- goto put_power;
+- }
++ if (!intel_dp->is_mst) {
++ if (!intel_dp_short_pulse(intel_dp)) {
++ intel_dp->detect_done = false;
++ goto put_power;
+ }
+ }
+
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index ff399b9..9a58800 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -236,6 +236,7 @@ struct intel_panel {
+ bool enabled;
+ bool combination_mode; /* gen 2/4 only */
+ bool active_low_pwm;
++ bool alternate_pwm_increment; /* lpt+ */
+
+ /* PWM chip */
+ bool util_pin_active_low; /* bxt+ */
+@@ -1387,8 +1388,6 @@ void intel_edp_drrs_disable(struct intel_dp *intel_dp);
+ void intel_edp_drrs_invalidate(struct drm_device *dev,
+ unsigned frontbuffer_bits);
+ void intel_edp_drrs_flush(struct drm_device *dev, unsigned frontbuffer_bits);
+-bool intel_digital_port_connected(struct drm_i915_private *dev_priv,
+- struct intel_digital_port *port);
+
+ void
+ intel_dp_program_link_training_pattern(struct intel_dp *intel_dp,
+@@ -1716,9 +1715,21 @@ void ilk_wm_get_hw_state(struct drm_device *dev);
+ void skl_wm_get_hw_state(struct drm_device *dev);
+ void skl_ddb_get_hw_state(struct drm_i915_private *dev_priv,
+ struct skl_ddb_allocation *ddb /* out */);
+-bool skl_can_enable_sagv(struct drm_atomic_state *state);
+-int skl_enable_sagv(struct drm_i915_private *dev_priv);
+-int skl_disable_sagv(struct drm_i915_private *dev_priv);
++bool intel_can_enable_sagv(struct drm_atomic_state *state);
++int intel_enable_sagv(struct drm_i915_private *dev_priv);
++int intel_disable_sagv(struct drm_i915_private *dev_priv);
++bool skl_ddb_allocation_equals(const struct skl_ddb_allocation *old,
++ const struct skl_ddb_allocation *new,
++ enum pipe pipe);
++bool skl_ddb_allocation_overlaps(struct drm_atomic_state *state,
++ const struct skl_ddb_allocation *old,
++ const struct skl_ddb_allocation *new,
++ enum pipe pipe);
++void skl_write_cursor_wm(struct intel_crtc *intel_crtc,
++ const struct skl_wm_values *wm);
++void skl_write_plane_wm(struct intel_crtc *intel_crtc,
++ const struct skl_wm_values *wm,
++ int plane);
+ uint32_t ilk_pipe_pixel_rate(const struct intel_crtc_state *pipe_config);
+ bool ilk_disable_lp_wm(struct drm_device *dev);
+ int sanitize_rc6_option(struct drm_i915_private *dev_priv, int enable_rc6);
+diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
+index 4df9f38..c3aa9e6 100644
+--- a/drivers/gpu/drm/i915/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/intel_hdmi.c
+@@ -1422,24 +1422,22 @@ intel_hdmi_dp_dual_mode_detect(struct drm_connector *connector, bool has_edid)
+ }
+
+ static bool
+-intel_hdmi_set_edid(struct drm_connector *connector, bool force)
++intel_hdmi_set_edid(struct drm_connector *connector)
+ {
+ struct drm_i915_private *dev_priv = to_i915(connector->dev);
+ struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector);
+- struct edid *edid = NULL;
++ struct edid *edid;
+ bool connected = false;
+
+- if (force) {
+- intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS);
++ intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS);
+
+- edid = drm_get_edid(connector,
+- intel_gmbus_get_adapter(dev_priv,
+- intel_hdmi->ddc_bus));
++ edid = drm_get_edid(connector,
++ intel_gmbus_get_adapter(dev_priv,
++ intel_hdmi->ddc_bus));
+
+- intel_hdmi_dp_dual_mode_detect(connector, edid != NULL);
++ intel_hdmi_dp_dual_mode_detect(connector, edid != NULL);
+
+- intel_display_power_put(dev_priv, POWER_DOMAIN_GMBUS);
+- }
++ intel_display_power_put(dev_priv, POWER_DOMAIN_GMBUS);
+
+ to_intel_connector(connector)->detect_edid = edid;
+ if (edid && edid->input & DRM_EDID_INPUT_DIGITAL) {
+@@ -1465,37 +1463,16 @@ static enum drm_connector_status
+ intel_hdmi_detect(struct drm_connector *connector, bool force)
+ {
+ enum drm_connector_status status;
+- struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector);
+ struct drm_i915_private *dev_priv = to_i915(connector->dev);
+- bool live_status = false;
+- unsigned int try;
+
+ DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
+ connector->base.id, connector->name);
+
+ intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS);
+
+- for (try = 0; !live_status && try < 9; try++) {
+- if (try)
+- msleep(10);
+- live_status = intel_digital_port_connected(dev_priv,
+- hdmi_to_dig_port(intel_hdmi));
+- }
+-
+- if (!live_status) {
+- DRM_DEBUG_KMS("HDMI live status down\n");
+- /*
+- * Live status register is not reliable on all intel platforms.
+- * So consider live_status only for certain platforms, for
+- * others, read EDID to determine presence of sink.
+- */
+- if (INTEL_INFO(dev_priv)->gen < 7 || IS_IVYBRIDGE(dev_priv))
+- live_status = true;
+- }
+-
+ intel_hdmi_unset_edid(connector);
+
+- if (intel_hdmi_set_edid(connector, live_status)) {
++ if (intel_hdmi_set_edid(connector)) {
+ struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector);
+
+ hdmi_to_dig_port(intel_hdmi)->base.type = INTEL_OUTPUT_HDMI;
+@@ -1521,7 +1498,7 @@ intel_hdmi_force(struct drm_connector *connector)
+ if (connector->status != connector_status_connected)
+ return;
+
+- intel_hdmi_set_edid(connector, true);
++ intel_hdmi_set_edid(connector);
+ hdmi_to_dig_port(intel_hdmi)->base.type = INTEL_OUTPUT_HDMI;
+ }
+
+diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
+index 96c65d7..9a2393a 100644
+--- a/drivers/gpu/drm/i915/intel_panel.c
++++ b/drivers/gpu/drm/i915/intel_panel.c
+@@ -841,7 +841,7 @@ static void lpt_enable_backlight(struct intel_connector *connector)
+ {
+ struct drm_i915_private *dev_priv = to_i915(connector->base.dev);
+ struct intel_panel *panel = &connector->panel;
+- u32 pch_ctl1, pch_ctl2;
++ u32 pch_ctl1, pch_ctl2, schicken;
+
+ pch_ctl1 = I915_READ(BLC_PWM_PCH_CTL1);
+ if (pch_ctl1 & BLM_PCH_PWM_ENABLE) {
+@@ -850,6 +850,22 @@ static void lpt_enable_backlight(struct intel_connector *connector)
+ I915_WRITE(BLC_PWM_PCH_CTL1, pch_ctl1);
+ }
+
++ if (HAS_PCH_LPT(dev_priv)) {
++ schicken = I915_READ(SOUTH_CHICKEN2);
++ if (panel->backlight.alternate_pwm_increment)
++ schicken |= LPT_PWM_GRANULARITY;
++ else
++ schicken &= ~LPT_PWM_GRANULARITY;
++ I915_WRITE(SOUTH_CHICKEN2, schicken);
++ } else {
++ schicken = I915_READ(SOUTH_CHICKEN1);
++ if (panel->backlight.alternate_pwm_increment)
++ schicken |= SPT_PWM_GRANULARITY;
++ else
++ schicken &= ~SPT_PWM_GRANULARITY;
++ I915_WRITE(SOUTH_CHICKEN1, schicken);
++ }
++
+ pch_ctl2 = panel->backlight.max << 16;
+ I915_WRITE(BLC_PWM_PCH_CTL2, pch_ctl2);
+
+@@ -1242,10 +1258,10 @@ static u32 bxt_hz_to_pwm(struct intel_connector *connector, u32 pwm_freq_hz)
+ */
+ static u32 spt_hz_to_pwm(struct intel_connector *connector, u32 pwm_freq_hz)
+ {
+- struct drm_i915_private *dev_priv = to_i915(connector->base.dev);
++ struct intel_panel *panel = &connector->panel;
+ u32 mul;
+
+- if (I915_READ(SOUTH_CHICKEN1) & SPT_PWM_GRANULARITY)
++ if (panel->backlight.alternate_pwm_increment)
+ mul = 128;
+ else
+ mul = 16;
+@@ -1261,9 +1277,10 @@ static u32 spt_hz_to_pwm(struct intel_connector *connector, u32 pwm_freq_hz)
+ static u32 lpt_hz_to_pwm(struct intel_connector *connector, u32 pwm_freq_hz)
+ {
+ struct drm_i915_private *dev_priv = to_i915(connector->base.dev);
++ struct intel_panel *panel = &connector->panel;
+ u32 mul, clock;
+
+- if (I915_READ(SOUTH_CHICKEN2) & LPT_PWM_GRANULARITY)
++ if (panel->backlight.alternate_pwm_increment)
+ mul = 16;
+ else
+ mul = 128;
+@@ -1414,6 +1431,13 @@ static int lpt_setup_backlight(struct intel_connector *connector, enum pipe unus
+ struct drm_i915_private *dev_priv = to_i915(connector->base.dev);
+ struct intel_panel *panel = &connector->panel;
+ u32 pch_ctl1, pch_ctl2, val;
++ bool alt;
++
++ if (HAS_PCH_LPT(dev_priv))
++ alt = I915_READ(SOUTH_CHICKEN2) & LPT_PWM_GRANULARITY;
++ else
++ alt = I915_READ(SOUTH_CHICKEN1) & SPT_PWM_GRANULARITY;
++ panel->backlight.alternate_pwm_increment = alt;
+
+ pch_ctl1 = I915_READ(BLC_PWM_PCH_CTL1);
+ panel->backlight.active_low_pwm = pch_ctl1 & BLM_PCH_POLARITY;
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 2d24813..e59a28c 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2119,32 +2119,34 @@ static void intel_read_wm_latency(struct drm_device *dev, uint16_t wm[8])
+ GEN9_MEM_LATENCY_LEVEL_MASK;
+
+ /*
++ * If a level n (n > 1) has a 0us latency, all levels m (m >= n)
++ * need to be disabled. We make sure to sanitize the values out
++ * of the punit to satisfy this requirement.
++ */
++ for (level = 1; level <= max_level; level++) {
++ if (wm[level] == 0) {
++ for (i = level + 1; i <= max_level; i++)
++ wm[i] = 0;
++ break;
++ }
++ }
++
++ /*
+ * WaWmMemoryReadLatency:skl
+ *
+ * punit doesn't take into account the read latency so we need
+- * to add 2us to the various latency levels we retrieve from
+- * the punit.
+- * - W0 is a bit special in that it's the only level that
+- * can't be disabled if we want to have display working, so
+- * we always add 2us there.
+- * - For levels >=1, punit returns 0us latency when they are
+- * disabled, so we respect that and don't add 2us then
+- *
+- * Additionally, if a level n (n > 1) has a 0us latency, all
+- * levels m (m >= n) need to be disabled. We make sure to
+- * sanitize the values out of the punit to satisfy this
+- * requirement.
++ * to add 2us to the various latency levels we retrieve from the
++ * punit when level 0 response data us 0us.
+ */
+- wm[0] += 2;
+- for (level = 1; level <= max_level; level++)
+- if (wm[level] != 0)
++ if (wm[0] == 0) {
++ wm[0] += 2;
++ for (level = 1; level <= max_level; level++) {
++ if (wm[level] == 0)
++ break;
+ wm[level] += 2;
+- else {
+- for (i = level + 1; i <= max_level; i++)
+- wm[i] = 0;
+-
+- break;
+ }
++ }
++
+ } else if (IS_HASWELL(dev) || IS_BROADWELL(dev)) {
+ uint64_t sskpd = I915_READ64(MCH_SSKPD);
+
+@@ -2876,6 +2878,19 @@ skl_wm_plane_id(const struct intel_plane *plane)
+ }
+ }
+
++static bool
++intel_has_sagv(struct drm_i915_private *dev_priv)
++{
++ if (IS_KABYLAKE(dev_priv))
++ return true;
++
++ if (IS_SKYLAKE(dev_priv) &&
++ dev_priv->sagv_status != I915_SAGV_NOT_CONTROLLED)
++ return true;
++
++ return false;
++}
++
+ /*
+ * SAGV dynamically adjusts the system agent voltage and clock frequencies
+ * depending on power and performance requirements. The display engine access
+@@ -2888,12 +2903,14 @@ skl_wm_plane_id(const struct intel_plane *plane)
+ * - We're not using an interlaced display configuration
+ */
+ int
+-skl_enable_sagv(struct drm_i915_private *dev_priv)
++intel_enable_sagv(struct drm_i915_private *dev_priv)
+ {
+ int ret;
+
+- if (dev_priv->skl_sagv_status == I915_SKL_SAGV_NOT_CONTROLLED ||
+- dev_priv->skl_sagv_status == I915_SKL_SAGV_ENABLED)
++ if (!intel_has_sagv(dev_priv))
++ return 0;
++
++ if (dev_priv->sagv_status == I915_SAGV_ENABLED)
+ return 0;
+
+ DRM_DEBUG_KMS("Enabling the SAGV\n");
+@@ -2909,21 +2926,21 @@ skl_enable_sagv(struct drm_i915_private *dev_priv)
+ * Some skl systems, pre-release machines in particular,
+ * don't actually have an SAGV.
+ */
+- if (ret == -ENXIO) {
++ if (IS_SKYLAKE(dev_priv) && ret == -ENXIO) {
+ DRM_DEBUG_DRIVER("No SAGV found on system, ignoring\n");
+- dev_priv->skl_sagv_status = I915_SKL_SAGV_NOT_CONTROLLED;
++ dev_priv->sagv_status = I915_SAGV_NOT_CONTROLLED;
+ return 0;
+ } else if (ret < 0) {
+ DRM_ERROR("Failed to enable the SAGV\n");
+ return ret;
+ }
+
+- dev_priv->skl_sagv_status = I915_SKL_SAGV_ENABLED;
++ dev_priv->sagv_status = I915_SAGV_ENABLED;
+ return 0;
+ }
+
+ static int
+-skl_do_sagv_disable(struct drm_i915_private *dev_priv)
++intel_do_sagv_disable(struct drm_i915_private *dev_priv)
+ {
+ int ret;
+ uint32_t temp = GEN9_SAGV_DISABLE;
+@@ -2937,19 +2954,21 @@ skl_do_sagv_disable(struct drm_i915_private *dev_priv)
+ }
+
+ int
+-skl_disable_sagv(struct drm_i915_private *dev_priv)
++intel_disable_sagv(struct drm_i915_private *dev_priv)
+ {
+ int ret, result;
+
+- if (dev_priv->skl_sagv_status == I915_SKL_SAGV_NOT_CONTROLLED ||
+- dev_priv->skl_sagv_status == I915_SKL_SAGV_DISABLED)
++ if (!intel_has_sagv(dev_priv))
++ return 0;
++
++ if (dev_priv->sagv_status == I915_SAGV_DISABLED)
+ return 0;
+
+ DRM_DEBUG_KMS("Disabling the SAGV\n");
+ mutex_lock(&dev_priv->rps.hw_lock);
+
+ /* bspec says to keep retrying for at least 1 ms */
+- ret = wait_for(result = skl_do_sagv_disable(dev_priv), 1);
++ ret = wait_for(result = intel_do_sagv_disable(dev_priv), 1);
+ mutex_unlock(&dev_priv->rps.hw_lock);
+
+ if (ret == -ETIMEDOUT) {
+@@ -2961,20 +2980,20 @@ skl_disable_sagv(struct drm_i915_private *dev_priv)
+ * Some skl systems, pre-release machines in particular,
+ * don't actually have an SAGV.
+ */
+- if (result == -ENXIO) {
++ if (IS_SKYLAKE(dev_priv) && result == -ENXIO) {
+ DRM_DEBUG_DRIVER("No SAGV found on system, ignoring\n");
+- dev_priv->skl_sagv_status = I915_SKL_SAGV_NOT_CONTROLLED;
++ dev_priv->sagv_status = I915_SAGV_NOT_CONTROLLED;
+ return 0;
+ } else if (result < 0) {
+ DRM_ERROR("Failed to disable the SAGV\n");
+ return result;
+ }
+
+- dev_priv->skl_sagv_status = I915_SKL_SAGV_DISABLED;
++ dev_priv->sagv_status = I915_SAGV_DISABLED;
+ return 0;
+ }
+
+-bool skl_can_enable_sagv(struct drm_atomic_state *state)
++bool intel_can_enable_sagv(struct drm_atomic_state *state)
+ {
+ struct drm_device *dev = state->dev;
+ struct drm_i915_private *dev_priv = to_i915(dev);
+@@ -2983,6 +3002,9 @@ bool skl_can_enable_sagv(struct drm_atomic_state *state)
+ enum pipe pipe;
+ int level, plane;
+
++ if (!intel_has_sagv(dev_priv))
++ return false;
++
+ /*
+ * SKL workaround: bspec recommends we disable the SAGV when we have
+ * more then one pipe enabled
+@@ -3473,29 +3495,14 @@ static uint32_t skl_wm_method1(uint32_t pixel_rate, uint8_t cpp, uint32_t latenc
+ }
+
+ static uint32_t skl_wm_method2(uint32_t pixel_rate, uint32_t pipe_htotal,
+- uint32_t horiz_pixels, uint8_t cpp,
+- uint64_t tiling, uint32_t latency)
++ uint32_t latency, uint32_t plane_blocks_per_line)
+ {
+ uint32_t ret;
+- uint32_t plane_bytes_per_line, plane_blocks_per_line;
+ uint32_t wm_intermediate_val;
+
+ if (latency == 0)
+ return UINT_MAX;
+
+- plane_bytes_per_line = horiz_pixels * cpp;
+-
+- if (tiling == I915_FORMAT_MOD_Y_TILED ||
+- tiling == I915_FORMAT_MOD_Yf_TILED) {
+- plane_bytes_per_line *= 4;
+- plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512);
+- plane_blocks_per_line /= 4;
+- } else if (tiling == DRM_FORMAT_MOD_NONE) {
+- plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512) + 1;
+- } else {
+- plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512);
+- }
+-
+ wm_intermediate_val = latency * pixel_rate;
+ ret = DIV_ROUND_UP(wm_intermediate_val, pipe_htotal * 1000) *
+ plane_blocks_per_line;
+@@ -3546,6 +3553,7 @@ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
+ uint8_t cpp;
+ uint32_t width = 0, height = 0;
+ uint32_t plane_pixel_rate;
++ uint32_t y_tile_minimum, y_min_scanlines;
+
+ if (latency == 0 || !cstate->base.active || !intel_pstate->visible) {
+ *enabled = false;
+@@ -3561,38 +3569,51 @@ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
+ cpp = drm_format_plane_cpp(fb->pixel_format, 0);
+ plane_pixel_rate = skl_adjusted_plane_pixel_rate(cstate, intel_pstate);
+
++ if (intel_rotation_90_or_270(pstate->rotation)) {
++ int cpp = (fb->pixel_format == DRM_FORMAT_NV12) ?
++ drm_format_plane_cpp(fb->pixel_format, 1) :
++ drm_format_plane_cpp(fb->pixel_format, 0);
++
++ switch (cpp) {
++ case 1:
++ y_min_scanlines = 16;
++ break;
++ case 2:
++ y_min_scanlines = 8;
++ break;
++ default:
++ WARN(1, "Unsupported pixel depth for rotation");
++ case 4:
++ y_min_scanlines = 4;
++ break;
++ }
++ } else {
++ y_min_scanlines = 4;
++ }
++
++ plane_bytes_per_line = width * cpp;
++ if (fb->modifier[0] == I915_FORMAT_MOD_Y_TILED ||
++ fb->modifier[0] == I915_FORMAT_MOD_Yf_TILED) {
++ plane_blocks_per_line =
++ DIV_ROUND_UP(plane_bytes_per_line * y_min_scanlines, 512);
++ plane_blocks_per_line /= y_min_scanlines;
++ } else if (fb->modifier[0] == DRM_FORMAT_MOD_NONE) {
++ plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512)
++ + 1;
++ } else {
++ plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512);
++ }
++
+ method1 = skl_wm_method1(plane_pixel_rate, cpp, latency);
+ method2 = skl_wm_method2(plane_pixel_rate,
+ cstate->base.adjusted_mode.crtc_htotal,
+- width,
+- cpp,
+- fb->modifier[0],
+- latency);
++ latency,
++ plane_blocks_per_line);
+
+- plane_bytes_per_line = width * cpp;
+- plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512);
++ y_tile_minimum = plane_blocks_per_line * y_min_scanlines;
+
+ if (fb->modifier[0] == I915_FORMAT_MOD_Y_TILED ||
+ fb->modifier[0] == I915_FORMAT_MOD_Yf_TILED) {
+- uint32_t min_scanlines = 4;
+- uint32_t y_tile_minimum;
+- if (intel_rotation_90_or_270(pstate->rotation)) {
+- int cpp = (fb->pixel_format == DRM_FORMAT_NV12) ?
+- drm_format_plane_cpp(fb->pixel_format, 1) :
+- drm_format_plane_cpp(fb->pixel_format, 0);
+-
+- switch (cpp) {
+- case 1:
+- min_scanlines = 16;
+- break;
+- case 2:
+- min_scanlines = 8;
+- break;
+- case 8:
+- WARN(1, "Unsupported pixel depth for rotation");
+- }
+- }
+- y_tile_minimum = plane_blocks_per_line * min_scanlines;
+ selected_result = max(method2, y_tile_minimum);
+ } else {
+ if ((ddb_allocation / plane_blocks_per_line) >= 1)
+@@ -3606,10 +3627,12 @@ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
+
+ if (level >= 1 && level <= 7) {
+ if (fb->modifier[0] == I915_FORMAT_MOD_Y_TILED ||
+- fb->modifier[0] == I915_FORMAT_MOD_Yf_TILED)
+- res_lines += 4;
+- else
++ fb->modifier[0] == I915_FORMAT_MOD_Yf_TILED) {
++ res_blocks += y_tile_minimum;
++ res_lines += y_min_scanlines;
++ } else {
+ res_blocks++;
++ }
+ }
+
+ if (res_blocks >= ddb_allocation || res_lines > 31) {
+@@ -3828,183 +3851,82 @@ static void skl_ddb_entry_write(struct drm_i915_private *dev_priv,
+ I915_WRITE(reg, 0);
+ }
+
+-static void skl_write_wm_values(struct drm_i915_private *dev_priv,
+- const struct skl_wm_values *new)
++void skl_write_plane_wm(struct intel_crtc *intel_crtc,
++ const struct skl_wm_values *wm,
++ int plane)
+ {
+- struct drm_device *dev = &dev_priv->drm;
+- struct intel_crtc *crtc;
+-
+- for_each_intel_crtc(dev, crtc) {
+- int i, level, max_level = ilk_wm_max_level(dev);
+- enum pipe pipe = crtc->pipe;
+-
+- if ((new->dirty_pipes & drm_crtc_mask(&crtc->base)) == 0)
+- continue;
+- if (!crtc->active)
+- continue;
+-
+- I915_WRITE(PIPE_WM_LINETIME(pipe), new->wm_linetime[pipe]);
+-
+- for (level = 0; level <= max_level; level++) {
+- for (i = 0; i < intel_num_planes(crtc); i++)
+- I915_WRITE(PLANE_WM(pipe, i, level),
+- new->plane[pipe][i][level]);
+- I915_WRITE(CUR_WM(pipe, level),
+- new->plane[pipe][PLANE_CURSOR][level]);
+- }
+- for (i = 0; i < intel_num_planes(crtc); i++)
+- I915_WRITE(PLANE_WM_TRANS(pipe, i),
+- new->plane_trans[pipe][i]);
+- I915_WRITE(CUR_WM_TRANS(pipe),
+- new->plane_trans[pipe][PLANE_CURSOR]);
+-
+- for (i = 0; i < intel_num_planes(crtc); i++) {
+- skl_ddb_entry_write(dev_priv,
+- PLANE_BUF_CFG(pipe, i),
+- &new->ddb.plane[pipe][i]);
+- skl_ddb_entry_write(dev_priv,
+- PLANE_NV12_BUF_CFG(pipe, i),
+- &new->ddb.y_plane[pipe][i]);
+- }
++ struct drm_crtc *crtc = &intel_crtc->base;
++ struct drm_device *dev = crtc->dev;
++ struct drm_i915_private *dev_priv = to_i915(dev);
++ int level, max_level = ilk_wm_max_level(dev);
++ enum pipe pipe = intel_crtc->pipe;
+
+- skl_ddb_entry_write(dev_priv, CUR_BUF_CFG(pipe),
+- &new->ddb.plane[pipe][PLANE_CURSOR]);
++ for (level = 0; level <= max_level; level++) {
++ I915_WRITE(PLANE_WM(pipe, plane, level),
++ wm->plane[pipe][plane][level]);
+ }
+-}
++ I915_WRITE(PLANE_WM_TRANS(pipe, plane), wm->plane_trans[pipe][plane]);
+
+-/*
+- * When setting up a new DDB allocation arrangement, we need to correctly
+- * sequence the times at which the new allocations for the pipes are taken into
+- * account or we'll have pipes fetching from space previously allocated to
+- * another pipe.
+- *
+- * Roughly the sequence looks like:
+- * 1. re-allocate the pipe(s) with the allocation being reduced and not
+- * overlapping with a previous light-up pipe (another way to put it is:
+- * pipes with their new allocation strickly included into their old ones).
+- * 2. re-allocate the other pipes that get their allocation reduced
+- * 3. allocate the pipes having their allocation increased
+- *
+- * Steps 1. and 2. are here to take care of the following case:
+- * - Initially DDB looks like this:
+- * | B | C |
+- * - enable pipe A.
+- * - pipe B has a reduced DDB allocation that overlaps with the old pipe C
+- * allocation
+- * | A | B | C |
+- *
+- * We need to sequence the re-allocation: C, B, A (and not B, C, A).
+- */
++ skl_ddb_entry_write(dev_priv, PLANE_BUF_CFG(pipe, plane),
++ &wm->ddb.plane[pipe][plane]);
++ skl_ddb_entry_write(dev_priv, PLANE_NV12_BUF_CFG(pipe, plane),
++ &wm->ddb.y_plane[pipe][plane]);
++}
+
+-static void
+-skl_wm_flush_pipe(struct drm_i915_private *dev_priv, enum pipe pipe, int pass)
++void skl_write_cursor_wm(struct intel_crtc *intel_crtc,
++ const struct skl_wm_values *wm)
+ {
+- int plane;
+-
+- DRM_DEBUG_KMS("flush pipe %c (pass %d)\n", pipe_name(pipe), pass);
++ struct drm_crtc *crtc = &intel_crtc->base;
++ struct drm_device *dev = crtc->dev;
++ struct drm_i915_private *dev_priv = to_i915(dev);
++ int level, max_level = ilk_wm_max_level(dev);
++ enum pipe pipe = intel_crtc->pipe;
+
+- for_each_plane(dev_priv, pipe, plane) {
+- I915_WRITE(PLANE_SURF(pipe, plane),
+- I915_READ(PLANE_SURF(pipe, plane)));
++ for (level = 0; level <= max_level; level++) {
++ I915_WRITE(CUR_WM(pipe, level),
++ wm->plane[pipe][PLANE_CURSOR][level]);
+ }
+- I915_WRITE(CURBASE(pipe), I915_READ(CURBASE(pipe)));
++ I915_WRITE(CUR_WM_TRANS(pipe), wm->plane_trans[pipe][PLANE_CURSOR]);
++
++ skl_ddb_entry_write(dev_priv, CUR_BUF_CFG(pipe),
++ &wm->ddb.plane[pipe][PLANE_CURSOR]);
+ }
+
+-static bool
+-skl_ddb_allocation_included(const struct skl_ddb_allocation *old,
+- const struct skl_ddb_allocation *new,
+- enum pipe pipe)
++bool skl_ddb_allocation_equals(const struct skl_ddb_allocation *old,
++ const struct skl_ddb_allocation *new,
++ enum pipe pipe)
+ {
+- uint16_t old_size, new_size;
+-
+- old_size = skl_ddb_entry_size(&old->pipe[pipe]);
+- new_size = skl_ddb_entry_size(&new->pipe[pipe]);
+-
+- return old_size != new_size &&
+- new->pipe[pipe].start >= old->pipe[pipe].start &&
+- new->pipe[pipe].end <= old->pipe[pipe].end;
++ return new->pipe[pipe].start == old->pipe[pipe].start &&
++ new->pipe[pipe].end == old->pipe[pipe].end;
+ }
+
+-static void skl_flush_wm_values(struct drm_i915_private *dev_priv,
+- struct skl_wm_values *new_values)
++static inline bool skl_ddb_entries_overlap(const struct skl_ddb_entry *a,
++ const struct skl_ddb_entry *b)
+ {
+- struct drm_device *dev = &dev_priv->drm;
+- struct skl_ddb_allocation *cur_ddb, *new_ddb;
+- bool reallocated[I915_MAX_PIPES] = {};
+- struct intel_crtc *crtc;
+- enum pipe pipe;
+-
+- new_ddb = &new_values->ddb;
+- cur_ddb = &dev_priv->wm.skl_hw.ddb;
+-
+- /*
+- * First pass: flush the pipes with the new allocation contained into
+- * the old space.
+- *
+- * We'll wait for the vblank on those pipes to ensure we can safely
+- * re-allocate the freed space without this pipe fetching from it.
+- */
+- for_each_intel_crtc(dev, crtc) {
+- if (!crtc->active)
+- continue;
+-
+- pipe = crtc->pipe;
+-
+- if (!skl_ddb_allocation_included(cur_ddb, new_ddb, pipe))
+- continue;
+-
+- skl_wm_flush_pipe(dev_priv, pipe, 1);
+- intel_wait_for_vblank(dev, pipe);
+-
+- reallocated[pipe] = true;
+- }
+-
++ return a->start < b->end && b->start < a->end;
++}
+
+- /*
+- * Second pass: flush the pipes that are having their allocation
+- * reduced, but overlapping with a previous allocation.
+- *
+- * Here as well we need to wait for the vblank to make sure the freed
+- * space is not used anymore.
+- */
+- for_each_intel_crtc(dev, crtc) {
+- if (!crtc->active)
+- continue;
++bool skl_ddb_allocation_overlaps(struct drm_atomic_state *state,
++ const struct skl_ddb_allocation *old,
++ const struct skl_ddb_allocation *new,
++ enum pipe pipe)
++{
++ struct drm_device *dev = state->dev;
++ struct intel_crtc *intel_crtc;
++ enum pipe otherp;
+
+- pipe = crtc->pipe;
++ for_each_intel_crtc(dev, intel_crtc) {
++ otherp = intel_crtc->pipe;
+
+- if (reallocated[pipe])
++ if (otherp == pipe)
+ continue;
+
+- if (skl_ddb_entry_size(&new_ddb->pipe[pipe]) <
+- skl_ddb_entry_size(&cur_ddb->pipe[pipe])) {
+- skl_wm_flush_pipe(dev_priv, pipe, 2);
+- intel_wait_for_vblank(dev, pipe);
+- reallocated[pipe] = true;
+- }
++ if (skl_ddb_entries_overlap(&new->pipe[pipe],
++ &old->pipe[otherp]))
++ return true;
+ }
+
+- /*
+- * Third pass: flush the pipes that got more space allocated.
+- *
+- * We don't need to actively wait for the update here, next vblank
+- * will just get more DDB space with the correct WM values.
+- */
+- for_each_intel_crtc(dev, crtc) {
+- if (!crtc->active)
+- continue;
+-
+- pipe = crtc->pipe;
+-
+- /*
+- * At this point, only the pipes more space than before are
+- * left to re-allocate.
+- */
+- if (reallocated[pipe])
+- continue;
+-
+- skl_wm_flush_pipe(dev_priv, pipe, 3);
+- }
++ return false;
+ }
+
+ static int skl_update_pipe_wm(struct drm_crtc_state *cstate,
+@@ -4041,6 +3963,41 @@ pipes_modified(struct drm_atomic_state *state)
+ return ret;
+ }
+
++int
++skl_ddb_add_affected_planes(struct intel_crtc_state *cstate)
++{
++ struct drm_atomic_state *state = cstate->base.state;
++ struct drm_device *dev = state->dev;
++ struct drm_crtc *crtc = cstate->base.crtc;
++ struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
++ struct drm_i915_private *dev_priv = to_i915(dev);
++ struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
++ struct skl_ddb_allocation *new_ddb = &intel_state->wm_results.ddb;
++ struct skl_ddb_allocation *cur_ddb = &dev_priv->wm.skl_hw.ddb;
++ struct drm_plane_state *plane_state;
++ struct drm_plane *plane;
++ enum pipe pipe = intel_crtc->pipe;
++ int id;
++
++ WARN_ON(!drm_atomic_get_existing_crtc_state(state, crtc));
++
++ drm_for_each_plane_mask(plane, dev, crtc->state->plane_mask) {
++ id = skl_wm_plane_id(to_intel_plane(plane));
++
++ if (skl_ddb_entry_equal(&cur_ddb->plane[pipe][id],
++ &new_ddb->plane[pipe][id]) &&
++ skl_ddb_entry_equal(&cur_ddb->y_plane[pipe][id],
++ &new_ddb->y_plane[pipe][id]))
++ continue;
++
++ plane_state = drm_atomic_get_plane_state(state, plane);
++ if (IS_ERR(plane_state))
++ return PTR_ERR(plane_state);
++ }
++
++ return 0;
++}
++
+ static int
+ skl_compute_ddb(struct drm_atomic_state *state)
+ {
+@@ -4105,6 +4062,10 @@ skl_compute_ddb(struct drm_atomic_state *state)
+ if (ret)
+ return ret;
+
++ ret = skl_ddb_add_affected_planes(cstate);
++ if (ret)
++ return ret;
++
+ ret = drm_atomic_add_affected_planes(state, &intel_crtc->base);
+ if (ret)
+ return ret;
+@@ -4206,7 +4167,7 @@ static void skl_update_wm(struct drm_crtc *crtc)
+ struct skl_wm_values *hw_vals = &dev_priv->wm.skl_hw;
+ struct intel_crtc_state *cstate = to_intel_crtc_state(crtc->state);
+ struct skl_pipe_wm *pipe_wm = &cstate->wm.skl.optimal;
+- int pipe;
++ enum pipe pipe = intel_crtc->pipe;
+
+ if ((results->dirty_pipes & drm_crtc_mask(crtc)) == 0)
+ return;
+@@ -4215,15 +4176,22 @@ static void skl_update_wm(struct drm_crtc *crtc)
+
+ mutex_lock(&dev_priv->wm.wm_mutex);
+
+- skl_write_wm_values(dev_priv, results);
+- skl_flush_wm_values(dev_priv, results);
+-
+ /*
+- * Store the new configuration (but only for the pipes that have
+- * changed; the other values weren't recomputed).
++ * If this pipe isn't active already, we're going to be enabling it
++ * very soon. Since it's safe to update a pipe's ddb allocation while
++ * the pipe's shut off, just do so here. Already active pipes will have
++ * their watermarks updated once we update their planes.
+ */
+- for_each_pipe_masked(dev_priv, pipe, results->dirty_pipes)
+- skl_copy_wm_for_pipe(hw_vals, results, pipe);
++ if (crtc->state->active_changed) {
++ int plane;
++
++ for (plane = 0; plane < intel_num_planes(intel_crtc); plane++)
++ skl_write_plane_wm(intel_crtc, results, plane);
++
++ skl_write_cursor_wm(intel_crtc, results);
++ }
++
++ skl_copy_wm_for_pipe(hw_vals, results, pipe);
+
+ mutex_unlock(&dev_priv->wm.wm_mutex);
+ }
+diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
+index 7c08e4f..4178849 100644
+--- a/drivers/gpu/drm/i915/intel_sprite.c
++++ b/drivers/gpu/drm/i915/intel_sprite.c
+@@ -203,6 +203,9 @@ skl_update_plane(struct drm_plane *drm_plane,
+ struct intel_plane *intel_plane = to_intel_plane(drm_plane);
+ struct drm_framebuffer *fb = plane_state->base.fb;
+ struct drm_i915_gem_object *obj = intel_fb_obj(fb);
++ const struct skl_wm_values *wm = &dev_priv->wm.skl_results;
++ struct drm_crtc *crtc = crtc_state->base.crtc;
++ struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+ const int pipe = intel_plane->pipe;
+ const int plane = intel_plane->plane + 1;
+ u32 plane_ctl, stride_div, stride;
+@@ -238,6 +241,9 @@ skl_update_plane(struct drm_plane *drm_plane,
+ crtc_w--;
+ crtc_h--;
+
++ if (wm->dirty_pipes & drm_crtc_mask(crtc))
++ skl_write_plane_wm(intel_crtc, wm, plane);
++
+ if (key->flags) {
+ I915_WRITE(PLANE_KEYVAL(pipe, plane), key->min_value);
+ I915_WRITE(PLANE_KEYMAX(pipe, plane), key->max_value);
+@@ -308,6 +314,14 @@ skl_disable_plane(struct drm_plane *dplane, struct drm_crtc *crtc)
+ const int pipe = intel_plane->pipe;
+ const int plane = intel_plane->plane + 1;
+
++ /*
++ * We only populate skl_results on watermark updates, and if the
++ * plane's visiblity isn't actually changing neither is its watermarks.
++ */
++ if (!to_intel_plane_state(dplane->state)->visible)
++ skl_write_plane_wm(to_intel_crtc(crtc),
++ &dev_priv->wm.skl_results, plane);
++
+ I915_WRITE(PLANE_CTL(pipe, plane), 0);
+
+ I915_WRITE(PLANE_SURF(pipe, plane), 0);
+diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
+index ff80a81..ec28b15 100644
+--- a/drivers/gpu/drm/i915/intel_uncore.c
++++ b/drivers/gpu/drm/i915/intel_uncore.c
+@@ -796,10 +796,9 @@ __unclaimed_reg_debug(struct drm_i915_private *dev_priv,
+ const bool read,
+ const bool before)
+ {
+- if (WARN(check_for_unclaimed_mmio(dev_priv),
+- "Unclaimed register detected %s %s register 0x%x\n",
+- before ? "before" : "after",
+- read ? "reading" : "writing to",
++ if (WARN(check_for_unclaimed_mmio(dev_priv) && !before,
++ "Unclaimed %s register 0x%x\n",
++ read ? "read from" : "write to",
+ i915_mmio_reg_offset(reg)))
+ i915.mmio_debug--; /* Only report the first N failures */
+ }
+diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
+index 6a4b020..5a26eb4 100644
+--- a/drivers/gpu/drm/radeon/r600_dpm.c
++++ b/drivers/gpu/drm/radeon/r600_dpm.c
+@@ -156,19 +156,20 @@ u32 r600_dpm_get_vblank_time(struct radeon_device *rdev)
+ struct drm_device *dev = rdev->ddev;
+ struct drm_crtc *crtc;
+ struct radeon_crtc *radeon_crtc;
+- u32 line_time_us, vblank_lines;
++ u32 vblank_in_pixels;
+ u32 vblank_time_us = 0xffffffff; /* if the displays are off, vblank time is max */
+
+ if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
+ list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+ radeon_crtc = to_radeon_crtc(crtc);
+ if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
+- line_time_us = (radeon_crtc->hw_mode.crtc_htotal * 1000) /
+- radeon_crtc->hw_mode.clock;
+- vblank_lines = radeon_crtc->hw_mode.crtc_vblank_end -
+- radeon_crtc->hw_mode.crtc_vdisplay +
+- (radeon_crtc->v_border * 2);
+- vblank_time_us = vblank_lines * line_time_us;
++ vblank_in_pixels =
++ radeon_crtc->hw_mode.crtc_htotal *
++ (radeon_crtc->hw_mode.crtc_vblank_end -
++ radeon_crtc->hw_mode.crtc_vdisplay +
++ (radeon_crtc->v_border * 2));
++
++ vblank_time_us = vblank_in_pixels * 1000 / radeon_crtc->hw_mode.clock;
+ break;
+ }
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index a00dd2f..554ca71 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -661,8 +661,9 @@ bool radeon_card_posted(struct radeon_device *rdev)
+ {
+ uint32_t reg;
+
+- /* for pass through, always force asic_init */
+- if (radeon_device_is_virtual())
++ /* for pass through, always force asic_init for CI */
++ if (rdev->family >= CHIP_BONAIRE &&
++ radeon_device_is_virtual())
+ return false;
+
+ /* required for EFI mode on macbook2,1 which uses an r5xx asic */
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 1f78ec2..89bdf20 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -4112,7 +4112,7 @@ static int si_populate_smc_voltage_tables(struct radeon_device *rdev,
+ &rdev->pm.dpm.dyn_state.phase_shedding_limits_table)) {
+ si_populate_smc_voltage_table(rdev, &si_pi->vddc_phase_shed_table, table);
+
+- table->phaseMaskTable.lowMask[SISLANDS_SMC_VOLTAGEMASK_VDDC] =
++ table->phaseMaskTable.lowMask[SISLANDS_SMC_VOLTAGEMASK_VDDC_PHASE_SHEDDING] =
+ cpu_to_be32(si_pi->vddc_phase_shed_table.mask_low);
+
+ si_write_smc_soft_register(rdev, SI_SMC_SOFT_REGISTER_phase_shedding_delay,
+diff --git a/drivers/gpu/drm/radeon/sislands_smc.h b/drivers/gpu/drm/radeon/sislands_smc.h
+index 3c77983..966e3a5 100644
+--- a/drivers/gpu/drm/radeon/sislands_smc.h
++++ b/drivers/gpu/drm/radeon/sislands_smc.h
+@@ -194,6 +194,7 @@ typedef struct SISLANDS_SMC_SWSTATE SISLANDS_SMC_SWSTATE;
+ #define SISLANDS_SMC_VOLTAGEMASK_VDDC 0
+ #define SISLANDS_SMC_VOLTAGEMASK_MVDD 1
+ #define SISLANDS_SMC_VOLTAGEMASK_VDDCI 2
++#define SISLANDS_SMC_VOLTAGEMASK_VDDC_PHASE_SHEDDING 3
+ #define SISLANDS_SMC_VOLTAGEMASK_MAX 4
+
+ struct SISLANDS_SMC_VOLTAGEMASKTABLE
+diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
+index 428e249..f696b75 100644
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -122,9 +122,16 @@ to_vc4_dev(struct drm_device *dev)
+ struct vc4_bo {
+ struct drm_gem_cma_object base;
+
+- /* seqno of the last job to render to this BO. */
++ /* seqno of the last job to render using this BO. */
+ uint64_t seqno;
+
++ /* seqno of the last job to use the RCL to write to this BO.
++ *
++ * Note that this doesn't include binner overflow memory
++ * writes.
++ */
++ uint64_t write_seqno;
++
+ /* List entry for the BO's position in either
+ * vc4_exec_info->unref_list or vc4_dev->bo_cache.time_list
+ */
+@@ -216,6 +223,9 @@ struct vc4_exec_info {
+ /* Sequence number for this bin/render job. */
+ uint64_t seqno;
+
++ /* Latest write_seqno of any BO that binning depends on. */
++ uint64_t bin_dep_seqno;
++
+ /* Last current addresses the hardware was processing when the
+ * hangcheck timer checked on us.
+ */
+@@ -230,6 +240,13 @@ struct vc4_exec_info {
+ struct drm_gem_cma_object **bo;
+ uint32_t bo_count;
+
++ /* List of BOs that are being written by the RCL. Other than
++ * the binner temporary storage, this is all the BOs written
++ * by the job.
++ */
++ struct drm_gem_cma_object *rcl_write_bo[4];
++ uint32_t rcl_write_bo_count;
++
+ /* Pointers for our position in vc4->job_list */
+ struct list_head head;
+
+diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
+index b262c5c..ae1609e 100644
+--- a/drivers/gpu/drm/vc4/vc4_gem.c
++++ b/drivers/gpu/drm/vc4/vc4_gem.c
+@@ -471,6 +471,11 @@ vc4_update_bo_seqnos(struct vc4_exec_info *exec, uint64_t seqno)
+ list_for_each_entry(bo, &exec->unref_list, unref_head) {
+ bo->seqno = seqno;
+ }
++
++ for (i = 0; i < exec->rcl_write_bo_count; i++) {
++ bo = to_vc4_bo(&exec->rcl_write_bo[i]->base);
++ bo->write_seqno = seqno;
++ }
+ }
+
+ /* Queues a struct vc4_exec_info for execution. If no job is
+@@ -673,6 +678,14 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
+ goto fail;
+
+ ret = vc4_validate_shader_recs(dev, exec);
++ if (ret)
++ goto fail;
++
++ /* Block waiting on any previous rendering into the CS's VBO,
++ * IB, or textures, so that pixels are actually written by the
++ * time we try to read them.
++ */
++ ret = vc4_wait_for_seqno(dev, exec->bin_dep_seqno, ~0ull, true);
+
+ fail:
+ drm_free_large(temp);
+diff --git a/drivers/gpu/drm/vc4/vc4_render_cl.c b/drivers/gpu/drm/vc4/vc4_render_cl.c
+index 0f12418..08886a3 100644
+--- a/drivers/gpu/drm/vc4/vc4_render_cl.c
++++ b/drivers/gpu/drm/vc4/vc4_render_cl.c
+@@ -45,6 +45,8 @@ struct vc4_rcl_setup {
+
+ struct drm_gem_cma_object *rcl;
+ u32 next_offset;
++
++ u32 next_write_bo_index;
+ };
+
+ static inline void rcl_u8(struct vc4_rcl_setup *setup, u8 val)
+@@ -407,6 +409,8 @@ static int vc4_rcl_msaa_surface_setup(struct vc4_exec_info *exec,
+ if (!*obj)
+ return -EINVAL;
+
++ exec->rcl_write_bo[exec->rcl_write_bo_count++] = *obj;
++
+ if (surf->offset & 0xf) {
+ DRM_ERROR("MSAA write must be 16b aligned.\n");
+ return -EINVAL;
+@@ -417,7 +421,8 @@ static int vc4_rcl_msaa_surface_setup(struct vc4_exec_info *exec,
+
+ static int vc4_rcl_surface_setup(struct vc4_exec_info *exec,
+ struct drm_gem_cma_object **obj,
+- struct drm_vc4_submit_rcl_surface *surf)
++ struct drm_vc4_submit_rcl_surface *surf,
++ bool is_write)
+ {
+ uint8_t tiling = VC4_GET_FIELD(surf->bits,
+ VC4_LOADSTORE_TILE_BUFFER_TILING);
+@@ -440,6 +445,9 @@ static int vc4_rcl_surface_setup(struct vc4_exec_info *exec,
+ if (!*obj)
+ return -EINVAL;
+
++ if (is_write)
++ exec->rcl_write_bo[exec->rcl_write_bo_count++] = *obj;
++
+ if (surf->flags & VC4_SUBMIT_RCL_SURFACE_READ_IS_FULL_RES) {
+ if (surf == &exec->args->zs_write) {
+ DRM_ERROR("general zs write may not be a full-res.\n");
+@@ -542,6 +550,8 @@ vc4_rcl_render_config_surface_setup(struct vc4_exec_info *exec,
+ if (!*obj)
+ return -EINVAL;
+
++ exec->rcl_write_bo[exec->rcl_write_bo_count++] = *obj;
++
+ if (tiling > VC4_TILING_FORMAT_LT) {
+ DRM_ERROR("Bad tiling format\n");
+ return -EINVAL;
+@@ -599,15 +609,18 @@ int vc4_get_rcl(struct drm_device *dev, struct vc4_exec_info *exec)
+ if (ret)
+ return ret;
+
+- ret = vc4_rcl_surface_setup(exec, &setup.color_read, &args->color_read);
++ ret = vc4_rcl_surface_setup(exec, &setup.color_read, &args->color_read,
++ false);
+ if (ret)
+ return ret;
+
+- ret = vc4_rcl_surface_setup(exec, &setup.zs_read, &args->zs_read);
++ ret = vc4_rcl_surface_setup(exec, &setup.zs_read, &args->zs_read,
++ false);
+ if (ret)
+ return ret;
+
+- ret = vc4_rcl_surface_setup(exec, &setup.zs_write, &args->zs_write);
++ ret = vc4_rcl_surface_setup(exec, &setup.zs_write, &args->zs_write,
++ true);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/gpu/drm/vc4/vc4_validate.c b/drivers/gpu/drm/vc4/vc4_validate.c
+index 9ce1d0a..26503e3 100644
+--- a/drivers/gpu/drm/vc4/vc4_validate.c
++++ b/drivers/gpu/drm/vc4/vc4_validate.c
+@@ -267,6 +267,9 @@ validate_indexed_prim_list(VALIDATE_ARGS)
+ if (!ib)
+ return -EINVAL;
+
++ exec->bin_dep_seqno = max(exec->bin_dep_seqno,
++ to_vc4_bo(&ib->base)->write_seqno);
++
+ if (offset > ib->base.size ||
+ (ib->base.size - offset) / index_size < length) {
+ DRM_ERROR("IB access overflow (%d + %d*%d > %zd)\n",
+@@ -555,8 +558,7 @@ static bool
+ reloc_tex(struct vc4_exec_info *exec,
+ void *uniform_data_u,
+ struct vc4_texture_sample_info *sample,
+- uint32_t texture_handle_index)
+-
++ uint32_t texture_handle_index, bool is_cs)
+ {
+ struct drm_gem_cma_object *tex;
+ uint32_t p0 = *(uint32_t *)(uniform_data_u + sample->p_offset[0]);
+@@ -714,6 +716,11 @@ reloc_tex(struct vc4_exec_info *exec,
+
+ *validated_p0 = tex->paddr + p0;
+
++ if (is_cs) {
++ exec->bin_dep_seqno = max(exec->bin_dep_seqno,
++ to_vc4_bo(&tex->base)->write_seqno);
++ }
++
+ return true;
+ fail:
+ DRM_INFO("Texture p0 at %d: 0x%08x\n", sample->p_offset[0], p0);
+@@ -835,7 +842,8 @@ validate_gl_shader_rec(struct drm_device *dev,
+ if (!reloc_tex(exec,
+ uniform_data_u,
+ &validated_shader->texture_samples[tex],
+- texture_handles_u[tex])) {
++ texture_handles_u[tex],
++ i == 2)) {
+ return -EINVAL;
+ }
+ }
+@@ -867,6 +875,9 @@ validate_gl_shader_rec(struct drm_device *dev,
+ uint32_t stride = *(uint8_t *)(pkt_u + o + 5);
+ uint32_t max_index;
+
++ exec->bin_dep_seqno = max(exec->bin_dep_seqno,
++ to_vc4_bo(&vbo->base)->write_seqno);
++
+ if (state->addr & 0x8)
+ stride |= (*(uint32_t *)(pkt_u + 100 + i * 4)) & ~0xff;
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index dc5beff..8a15c4a 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -34,6 +34,24 @@
+
+ #define VMW_RES_HT_ORDER 12
+
++ /**
++ * enum vmw_resource_relocation_type - Relocation type for resources
++ *
++ * @vmw_res_rel_normal: Traditional relocation. The resource id in the
++ * command stream is replaced with the actual id after validation.
++ * @vmw_res_rel_nop: NOP relocation. The command is unconditionally replaced
++ * with a NOP.
++ * @vmw_res_rel_cond_nop: Conditional NOP relocation. If the resource id
++ * after validation is -1, the command is replaced with a NOP. Otherwise no
++ * action.
++ */
++enum vmw_resource_relocation_type {
++ vmw_res_rel_normal,
++ vmw_res_rel_nop,
++ vmw_res_rel_cond_nop,
++ vmw_res_rel_max
++};
++
+ /**
+ * struct vmw_resource_relocation - Relocation info for resources
+ *
+@@ -41,11 +59,13 @@
+ * @res: Non-ref-counted pointer to the resource.
+ * @offset: Offset of 4 byte entries into the command buffer where the
+ * id that needs fixup is located.
++ * @rel_type: Type of relocation.
+ */
+ struct vmw_resource_relocation {
+ struct list_head head;
+ const struct vmw_resource *res;
+- unsigned long offset;
++ u32 offset:29;
++ enum vmw_resource_relocation_type rel_type:3;
+ };
+
+ /**
+@@ -410,10 +430,13 @@ static int vmw_resource_context_res_add(struct vmw_private *dev_priv,
+ * @res: The resource.
+ * @offset: Offset into the command buffer currently being parsed where the
+ * id that needs fixup is located. Granularity is 4 bytes.
++ * @rel_type: Relocation type.
+ */
+ static int vmw_resource_relocation_add(struct list_head *list,
+ const struct vmw_resource *res,
+- unsigned long offset)
++ unsigned long offset,
++ enum vmw_resource_relocation_type
++ rel_type)
+ {
+ struct vmw_resource_relocation *rel;
+
+@@ -425,6 +448,7 @@ static int vmw_resource_relocation_add(struct list_head *list,
+
+ rel->res = res;
+ rel->offset = offset;
++ rel->rel_type = rel_type;
+ list_add_tail(&rel->head, list);
+
+ return 0;
+@@ -459,11 +483,23 @@ static void vmw_resource_relocations_apply(uint32_t *cb,
+ {
+ struct vmw_resource_relocation *rel;
+
++ /* Validate the struct vmw_resource_relocation member size */
++ BUILD_BUG_ON(SVGA_CB_MAX_SIZE >= (1 << 29));
++ BUILD_BUG_ON(vmw_res_rel_max >= (1 << 3));
++
+ list_for_each_entry(rel, list, head) {
+- if (likely(rel->res != NULL))
++ switch (rel->rel_type) {
++ case vmw_res_rel_normal:
+ cb[rel->offset] = rel->res->id;
+- else
++ break;
++ case vmw_res_rel_nop:
+ cb[rel->offset] = SVGA_3D_CMD_NOP;
++ break;
++ default:
++ if (rel->res->id == -1)
++ cb[rel->offset] = SVGA_3D_CMD_NOP;
++ break;
++ }
+ }
+ }
+
+@@ -655,7 +691,8 @@ static int vmw_cmd_res_reloc_add(struct vmw_private *dev_priv,
+ *p_val = NULL;
+ ret = vmw_resource_relocation_add(&sw_context->res_relocations,
+ res,
+- id_loc - sw_context->buf_start);
++ id_loc - sw_context->buf_start,
++ vmw_res_rel_normal);
+ if (unlikely(ret != 0))
+ return ret;
+
+@@ -721,7 +758,8 @@ vmw_cmd_res_check(struct vmw_private *dev_priv,
+
+ return vmw_resource_relocation_add
+ (&sw_context->res_relocations, res,
+- id_loc - sw_context->buf_start);
++ id_loc - sw_context->buf_start,
++ vmw_res_rel_normal);
+ }
+
+ ret = vmw_user_resource_lookup_handle(dev_priv,
+@@ -2144,7 +2182,8 @@ static int vmw_cmd_shader_define(struct vmw_private *dev_priv,
+
+ return vmw_resource_relocation_add(&sw_context->res_relocations,
+ NULL, &cmd->header.id -
+- sw_context->buf_start);
++ sw_context->buf_start,
++ vmw_res_rel_nop);
+
+ return 0;
+ }
+@@ -2189,7 +2228,8 @@ static int vmw_cmd_shader_destroy(struct vmw_private *dev_priv,
+
+ return vmw_resource_relocation_add(&sw_context->res_relocations,
+ NULL, &cmd->header.id -
+- sw_context->buf_start);
++ sw_context->buf_start,
++ vmw_res_rel_nop);
+
+ return 0;
+ }
+@@ -2848,8 +2888,7 @@ static int vmw_cmd_dx_cid_check(struct vmw_private *dev_priv,
+ * @header: Pointer to the command header in the command stream.
+ *
+ * Check that the view exists, and if it was not created using this
+- * command batch, make sure it's validated (present in the device) so that
+- * the remove command will not confuse the device.
++ * command batch, conditionally make this command a NOP.
+ */
+ static int vmw_cmd_dx_view_remove(struct vmw_private *dev_priv,
+ struct vmw_sw_context *sw_context,
+@@ -2877,10 +2916,15 @@ static int vmw_cmd_dx_view_remove(struct vmw_private *dev_priv,
+ return ret;
+
+ /*
+- * Add view to the validate list iff it was not created using this
+- * command batch.
++ * If the view wasn't created during this command batch, it might
++ * have been removed due to a context swapout, so add a
++ * relocation to conditionally make this command a NOP to avoid
++ * device errors.
+ */
+- return vmw_view_res_val_add(sw_context, view);
++ return vmw_resource_relocation_add(&sw_context->res_relocations,
++ view,
++ &cmd->header.id - sw_context->buf_start,
++ vmw_res_rel_cond_nop);
+ }
+
+ /**
+@@ -3848,14 +3892,14 @@ static void *vmw_execbuf_cmdbuf(struct vmw_private *dev_priv,
+ int ret;
+
+ *header = NULL;
+- if (!dev_priv->cman || kernel_commands)
+- return kernel_commands;
+-
+ if (command_size > SVGA_CB_MAX_SIZE) {
+ DRM_ERROR("Command buffer is too large.\n");
+ return ERR_PTR(-EINVAL);
+ }
+
++ if (!dev_priv->cman || kernel_commands)
++ return kernel_commands;
++
+ /* If possible, add a little space for fencing. */
+ cmdbuf_size = command_size + 512;
+ cmdbuf_size = min_t(size_t, cmdbuf_size, SVGA_CB_MAX_SIZE);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 4ed9a4f..e92b09d 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -64,6 +64,9 @@
+ #define USB_VENDOR_ID_AKAI 0x2011
+ #define USB_DEVICE_ID_AKAI_MPKMINI2 0x0715
+
++#define USB_VENDOR_ID_AKAI_09E8 0x09E8
++#define USB_DEVICE_ID_AKAI_09E8_MIDIMIX 0x0031
++
+ #define USB_VENDOR_ID_ALCOR 0x058f
+ #define USB_DEVICE_ID_ALCOR_USBRS232 0x9720
+
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index b4b8c6a..bb40008 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -56,6 +56,7 @@ static const struct hid_blacklist {
+
+ { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2, HID_QUIRK_NO_INIT_REPORTS },
++ { USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
+diff --git a/drivers/hwtracing/coresight/coresight-tmc.c b/drivers/hwtracing/coresight/coresight-tmc.c
+index 9e02ac9..3978cbb 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc.c
++++ b/drivers/hwtracing/coresight/coresight-tmc.c
+@@ -388,9 +388,6 @@ static int tmc_probe(struct amba_device *adev, const struct amba_id *id)
+ err_misc_register:
+ coresight_unregister(drvdata->csdev);
+ err_devm_kzalloc:
+- if (drvdata->config_type == TMC_CONFIG_TYPE_ETR)
+- dma_free_coherent(dev, drvdata->size,
+- drvdata->vaddr, drvdata->paddr);
+ return ret;
+ }
+
+diff --git a/drivers/iio/dac/ad5755.c b/drivers/iio/dac/ad5755.c
+index 0fde593..5f79682 100644
+--- a/drivers/iio/dac/ad5755.c
++++ b/drivers/iio/dac/ad5755.c
+@@ -655,7 +655,7 @@ static struct ad5755_platform_data *ad5755_parse_dt(struct device *dev)
+
+ devnr = 0;
+ for_each_child_of_node(np, pp) {
+- if (devnr > AD5755_NUM_CHANNELS) {
++ if (devnr >= AD5755_NUM_CHANNELS) {
+ dev_err(dev,
+ "There is to many channels defined in DT\n");
+ goto error_out;
+diff --git a/drivers/iio/light/us5182d.c b/drivers/iio/light/us5182d.c
+index 20c40f7..18cf2e2 100644
+--- a/drivers/iio/light/us5182d.c
++++ b/drivers/iio/light/us5182d.c
+@@ -894,7 +894,7 @@ static int us5182d_probe(struct i2c_client *client,
+ goto out_err;
+
+ if (data->default_continuous) {
+- pm_runtime_set_active(&client->dev);
++ ret = pm_runtime_set_active(&client->dev);
+ if (ret < 0)
+ goto out_err;
+ }
+diff --git a/drivers/infiniband/hw/hfi1/qp.c b/drivers/infiniband/hw/hfi1/qp.c
+index 4e4d831..c17c9dd 100644
+--- a/drivers/infiniband/hw/hfi1/qp.c
++++ b/drivers/infiniband/hw/hfi1/qp.c
+@@ -808,6 +808,13 @@ void *qp_priv_alloc(struct rvt_dev_info *rdi, struct rvt_qp *qp,
+ kfree(priv);
+ return ERR_PTR(-ENOMEM);
+ }
++ iowait_init(
++ &priv->s_iowait,
++ 1,
++ _hfi1_do_send,
++ iowait_sleep,
++ iowait_wakeup,
++ iowait_sdma_drained);
+ setup_timer(&priv->s_rnr_timer, hfi1_rc_rnr_retry, (unsigned long)qp);
+ qp->s_timer.function = hfi1_rc_timeout;
+ return priv;
+@@ -873,13 +880,6 @@ void notify_qp_reset(struct rvt_qp *qp)
+ {
+ struct hfi1_qp_priv *priv = qp->priv;
+
+- iowait_init(
+- &priv->s_iowait,
+- 1,
+- _hfi1_do_send,
+- iowait_sleep,
+- iowait_wakeup,
+- iowait_sdma_drained);
+ priv->r_adefered = 0;
+ clear_ahg(qp);
+ }
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index e19537c..bff8707a 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -1843,6 +1843,7 @@ static struct mlx5_ib_flow_handler *create_leftovers_rule(struct mlx5_ib_dev *de
+ &leftovers_specs[LEFTOVERS_UC].flow_attr,
+ dst);
+ if (IS_ERR(handler_ucast)) {
++ mlx5_del_flow_rule(handler->rule);
+ kfree(handler);
+ handler = handler_ucast;
+ } else {
+diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
+index bbf0a16..54bb655f 100644
+--- a/drivers/infiniband/hw/qib/qib.h
++++ b/drivers/infiniband/hw/qib/qib.h
+@@ -1131,7 +1131,6 @@ extern spinlock_t qib_devs_lock;
+ extern struct qib_devdata *qib_lookup(int unit);
+ extern u32 qib_cpulist_count;
+ extern unsigned long *qib_cpulist;
+-extern u16 qpt_mask;
+ extern unsigned qib_cc_table_size;
+
+ int qib_init(struct qib_devdata *, int);
+diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
+index f9b8cd2..99d31ef 100644
+--- a/drivers/infiniband/hw/qib/qib_qp.c
++++ b/drivers/infiniband/hw/qib/qib_qp.c
+@@ -41,14 +41,6 @@
+
+ #include "qib.h"
+
+-/*
+- * mask field which was present in now deleted qib_qpn_table
+- * is not present in rvt_qpn_table. Defining the same field
+- * as qpt_mask here instead of adding the mask field to
+- * rvt_qpn_table.
+- */
+-u16 qpt_mask;
+-
+ static inline unsigned mk_qpn(struct rvt_qpn_table *qpt,
+ struct rvt_qpn_map *map, unsigned off)
+ {
+@@ -57,7 +49,7 @@ static inline unsigned mk_qpn(struct rvt_qpn_table *qpt,
+
+ static inline unsigned find_next_offset(struct rvt_qpn_table *qpt,
+ struct rvt_qpn_map *map, unsigned off,
+- unsigned n)
++ unsigned n, u16 qpt_mask)
+ {
+ if (qpt_mask) {
+ off++;
+@@ -179,6 +171,7 @@ int qib_alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt,
+ struct qib_ibdev *verbs_dev = container_of(rdi, struct qib_ibdev, rdi);
+ struct qib_devdata *dd = container_of(verbs_dev, struct qib_devdata,
+ verbs_dev);
++ u16 qpt_mask = dd->qpn_mask;
+
+ if (type == IB_QPT_SMI || type == IB_QPT_GSI) {
+ unsigned n;
+@@ -215,7 +208,7 @@ int qib_alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt,
+ goto bail;
+ }
+ offset = find_next_offset(qpt, map, offset,
+- dd->n_krcv_queues);
++ dd->n_krcv_queues, qpt_mask);
+ qpn = mk_qpn(qpt, map, offset);
+ /*
+ * This test differs from alloc_pidmap().
+diff --git a/drivers/infiniband/hw/qib/qib_verbs.c b/drivers/infiniband/hw/qib/qib_verbs.c
+index fd1dfbc..b2b845f 100644
+--- a/drivers/infiniband/hw/qib/qib_verbs.c
++++ b/drivers/infiniband/hw/qib/qib_verbs.c
+@@ -1606,8 +1606,6 @@ int qib_register_ib_device(struct qib_devdata *dd)
+ /* Only need to initialize non-zero fields. */
+ setup_timer(&dev->mem_timer, mem_timer, (unsigned long)dev);
+
+- qpt_mask = dd->qpn_mask;
+-
+ INIT_LIST_HEAD(&dev->piowait);
+ INIT_LIST_HEAD(&dev->dmawait);
+ INIT_LIST_HEAD(&dev->txwait);
+diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
+index 870b4f2..5911c53 100644
+--- a/drivers/infiniband/sw/rdmavt/qp.c
++++ b/drivers/infiniband/sw/rdmavt/qp.c
+@@ -501,12 +501,9 @@ static void rvt_remove_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp)
+ */
+ static void rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp,
+ enum ib_qp_type type)
+- __releases(&qp->s_lock)
+- __releases(&qp->s_hlock)
+- __releases(&qp->r_lock)
+- __acquires(&qp->r_lock)
+- __acquires(&qp->s_hlock)
+- __acquires(&qp->s_lock)
++ __must_hold(&qp->r_lock)
++ __must_hold(&qp->s_hlock)
++ __must_hold(&qp->s_lock)
+ {
+ if (qp->state != IB_QPS_RESET) {
+ qp->state = IB_QPS_RESET;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
+index 618f184..c65e17f 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_client.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
+@@ -1009,7 +1009,6 @@ int i40e_unregister_client(struct i40e_client *client)
+ if (!i40e_client_is_registered(client)) {
+ pr_info("i40e: Client %s has not been registered\n",
+ client->name);
+- mutex_unlock(&i40e_client_mutex);
+ ret = -ENODEV;
+ goto out;
+ }
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index dad15b6..c74d164 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -7990,45 +7990,34 @@ static int i40e_setup_misc_vector(struct i40e_pf *pf)
+ static int i40e_config_rss_aq(struct i40e_vsi *vsi, const u8 *seed,
+ u8 *lut, u16 lut_size)
+ {
+- struct i40e_aqc_get_set_rss_key_data rss_key;
+ struct i40e_pf *pf = vsi->back;
+ struct i40e_hw *hw = &pf->hw;
+- bool pf_lut = false;
+- u8 *rss_lut;
+- int ret, i;
+-
+- memcpy(&rss_key, seed, sizeof(rss_key));
+-
+- rss_lut = kzalloc(pf->rss_table_size, GFP_KERNEL);
+- if (!rss_lut)
+- return -ENOMEM;
+-
+- /* Populate the LUT with max no. of queues in round robin fashion */
+- for (i = 0; i < vsi->rss_table_size; i++)
+- rss_lut[i] = i % vsi->rss_size;
++ int ret = 0;
+
+- ret = i40e_aq_set_rss_key(hw, vsi->id, &rss_key);
+- if (ret) {
+- dev_info(&pf->pdev->dev,
+- "Cannot set RSS key, err %s aq_err %s\n",
+- i40e_stat_str(&pf->hw, ret),
+- i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));
+- goto config_rss_aq_out;
++ if (seed) {
++ struct i40e_aqc_get_set_rss_key_data *seed_dw =
++ (struct i40e_aqc_get_set_rss_key_data *)seed;
++ ret = i40e_aq_set_rss_key(hw, vsi->id, seed_dw);
++ if (ret) {
++ dev_info(&pf->pdev->dev,
++ "Cannot set RSS key, err %s aq_err %s\n",
++ i40e_stat_str(hw, ret),
++ i40e_aq_str(hw, hw->aq.asq_last_status));
++ return ret;
++ }
+ }
++ if (lut) {
++ bool pf_lut = vsi->type == I40E_VSI_MAIN ? true : false;
+
+- if (vsi->type == I40E_VSI_MAIN)
+- pf_lut = true;
+-
+- ret = i40e_aq_set_rss_lut(hw, vsi->id, pf_lut, rss_lut,
+- vsi->rss_table_size);
+- if (ret)
+- dev_info(&pf->pdev->dev,
+- "Cannot set RSS lut, err %s aq_err %s\n",
+- i40e_stat_str(&pf->hw, ret),
+- i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));
+-
+-config_rss_aq_out:
+- kfree(rss_lut);
++ ret = i40e_aq_set_rss_lut(hw, vsi->id, pf_lut, lut, lut_size);
++ if (ret) {
++ dev_info(&pf->pdev->dev,
++ "Cannot set RSS lut, err %s aq_err %s\n",
++ i40e_stat_str(hw, ret),
++ i40e_aq_str(hw, hw->aq.asq_last_status));
++ return ret;
++ }
++ }
+ return ret;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
+index 24c8d65..09ca634 100644
+--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
+@@ -2394,6 +2394,8 @@ static void ath10k_htt_txrx_compl_task(unsigned long ptr)
+ skb_queue_splice_init(&htt->rx_in_ord_compl_q, &rx_ind_q);
+ spin_unlock_irqrestore(&htt->rx_in_ord_compl_q.lock, flags);
+
++ ath10k_mac_tx_push_pending(ar);
++
+ spin_lock_irqsave(&htt->tx_fetch_ind_q.lock, flags);
+ skb_queue_splice_init(&htt->tx_fetch_ind_q, &tx_ind_q);
+ spin_unlock_irqrestore(&htt->tx_fetch_ind_q.lock, flags);
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 0bbd0a0..146365b 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -3777,7 +3777,9 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw,
+ enum ath10k_hw_txrx_mode txmode;
+ enum ath10k_mac_tx_path txpath;
+ struct sk_buff *skb;
++ struct ieee80211_hdr *hdr;
+ size_t skb_len;
++ bool is_mgmt, is_presp;
+ int ret;
+
+ spin_lock_bh(&ar->htt.tx_lock);
+@@ -3801,6 +3803,22 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw,
+ skb_len = skb->len;
+ txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
+ txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode);
++ is_mgmt = (txpath == ATH10K_MAC_TX_HTT_MGMT);
++
++ if (is_mgmt) {
++ hdr = (struct ieee80211_hdr *)skb->data;
++ is_presp = ieee80211_is_probe_resp(hdr->frame_control);
++
++ spin_lock_bh(&ar->htt.tx_lock);
++ ret = ath10k_htt_tx_mgmt_inc_pending(htt, is_mgmt, is_presp);
++
++ if (ret) {
++ ath10k_htt_tx_dec_pending(htt);
++ spin_unlock_bh(&ar->htt.tx_lock);
++ return ret;
++ }
++ spin_unlock_bh(&ar->htt.tx_lock);
++ }
+
+ ret = ath10k_mac_tx(ar, vif, sta, txmode, txpath, skb);
+ if (unlikely(ret)) {
+@@ -3808,6 +3826,8 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw,
+
+ spin_lock_bh(&ar->htt.tx_lock);
+ ath10k_htt_tx_dec_pending(htt);
++ if (is_mgmt)
++ ath10k_htt_tx_mgmt_dec_pending(htt);
+ spin_unlock_bh(&ar->htt.tx_lock);
+
+ return ret;
+@@ -6538,7 +6558,7 @@ static int ath10k_get_survey(struct ieee80211_hw *hw, int idx,
+ goto exit;
+ }
+
+- ath10k_mac_update_bss_chan_survey(ar, survey->channel);
++ ath10k_mac_update_bss_chan_survey(ar, &sband->channels[idx]);
+
+ spin_lock_bh(&ar->data_lock);
+ memcpy(survey, ar_survey, sizeof(*survey));
+diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
+index b29a86a..28ff5cb 100644
+--- a/drivers/net/wireless/ath/ath10k/txrx.c
++++ b/drivers/net/wireless/ath/ath10k/txrx.c
+@@ -119,8 +119,6 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt,
+ ieee80211_tx_status(htt->ar->hw, msdu);
+ /* we do not own the msdu anymore */
+
+- ath10k_mac_tx_push_pending(ar);
+-
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
+index 3ef4688..f67cc19 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.h
++++ b/drivers/net/wireless/ath/ath10k/wmi.h
+@@ -180,6 +180,7 @@ enum wmi_service {
+ WMI_SERVICE_MESH_NON_11S,
+ WMI_SERVICE_PEER_STATS,
+ WMI_SERVICE_RESTRT_CHNL_SUPPORT,
++ WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
+ WMI_SERVICE_TX_MODE_PUSH_ONLY,
+ WMI_SERVICE_TX_MODE_PUSH_PULL,
+ WMI_SERVICE_TX_MODE_DYNAMIC,
+@@ -305,6 +306,7 @@ enum wmi_10_4_service {
+ WMI_10_4_SERVICE_RESTRT_CHNL_SUPPORT,
+ WMI_10_4_SERVICE_PEER_STATS,
+ WMI_10_4_SERVICE_MESH_11S,
++ WMI_10_4_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
+ WMI_10_4_SERVICE_TX_MODE_PUSH_ONLY,
+ WMI_10_4_SERVICE_TX_MODE_PUSH_PULL,
+ WMI_10_4_SERVICE_TX_MODE_DYNAMIC,
+@@ -402,6 +404,7 @@ static inline char *wmi_service_name(int service_id)
+ SVCSTR(WMI_SERVICE_MESH_NON_11S);
+ SVCSTR(WMI_SERVICE_PEER_STATS);
+ SVCSTR(WMI_SERVICE_RESTRT_CHNL_SUPPORT);
++ SVCSTR(WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT);
+ SVCSTR(WMI_SERVICE_TX_MODE_PUSH_ONLY);
+ SVCSTR(WMI_SERVICE_TX_MODE_PUSH_PULL);
+ SVCSTR(WMI_SERVICE_TX_MODE_DYNAMIC);
+@@ -652,6 +655,8 @@ static inline void wmi_10_4_svc_map(const __le32 *in, unsigned long *out,
+ WMI_SERVICE_PEER_STATS, len);
+ SVCMAP(WMI_10_4_SERVICE_MESH_11S,
+ WMI_SERVICE_MESH_11S, len);
++ SVCMAP(WMI_10_4_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
++ WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT, len);
+ SVCMAP(WMI_10_4_SERVICE_TX_MODE_PUSH_ONLY,
+ WMI_SERVICE_TX_MODE_PUSH_ONLY, len);
+ SVCMAP(WMI_10_4_SERVICE_TX_MODE_PUSH_PULL,
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+index 43f8f7d..adba3b0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+@@ -564,11 +564,16 @@ static void iwl_set_hw_address_from_csr(struct iwl_trans *trans,
+ __le32 mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_STRAP));
+ __le32 mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_STRAP));
+
+- /* If OEM did not fuse address - get it from OTP */
+- if (!mac_addr0 && !mac_addr1) {
+- mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP));
+- mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP));
+- }
++ iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
++ /*
++ * If the OEM fused a valid address, use it instead of the one in the
++ * OTP
++ */
++ if (is_valid_ether_addr(data->hw_addr))
++ return;
++
++ mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP));
++ mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP));
+
+ iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 7e0cdbf..794c574 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -1214,9 +1214,12 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
+ }
+
+ /* TODO: read the budget from BIOS / Platform NVM */
+- if (iwl_mvm_is_ctdp_supported(mvm) && mvm->cooling_dev.cur_state > 0)
++ if (iwl_mvm_is_ctdp_supported(mvm) && mvm->cooling_dev.cur_state > 0) {
+ ret = iwl_mvm_ctdp_command(mvm, CTDP_CMD_OPERATION_START,
+ mvm->cooling_dev.cur_state);
++ if (ret)
++ goto error;
++ }
+ #else
+ /* Initialize tx backoffs to the minimal possible */
+ iwl_mvm_tt_tx_backoff(mvm, 0);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+index 69c42ce..d742d27 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+@@ -539,6 +539,11 @@ void iwl_mvm_mac_ctxt_release(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+ iwl_mvm_disable_txq(mvm, IWL_MVM_OFFCHANNEL_QUEUE,
+ IWL_MVM_OFFCHANNEL_QUEUE,
+ IWL_MAX_TID_COUNT, 0);
++ else
++ iwl_mvm_disable_txq(mvm,
++ IWL_MVM_DQA_P2P_DEVICE_QUEUE,
++ vif->hw_queue[0], IWL_MAX_TID_COUNT,
++ 0);
+
+ break;
+ case NL80211_IFTYPE_AP:
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index df6c32c..afb7eb6 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -598,9 +598,10 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
+
+ mvm_sta = iwl_mvm_sta_from_mac80211(sta);
+
+- /* not a data packet */
+- if (!ieee80211_is_data_qos(hdr->frame_control) ||
+- is_multicast_ether_addr(hdr->addr1))
++ /* not a data packet or a bar */
++ if (!ieee80211_is_back_req(hdr->frame_control) &&
++ (!ieee80211_is_data_qos(hdr->frame_control) ||
++ is_multicast_ether_addr(hdr->addr1)))
+ return false;
+
+ if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
+@@ -624,6 +625,11 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
+
+ spin_lock_bh(&buffer->lock);
+
++ if (ieee80211_is_back_req(hdr->frame_control)) {
++ iwl_mvm_release_frames(mvm, sta, napi, buffer, nssn);
++ goto drop;
++ }
++
+ /*
+ * If there was a significant jump in the nssn - adjust.
+ * If the SN is smaller than the NSSN it might need to first go into
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index 3130b9c..e933c12 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -576,9 +576,7 @@ static int iwl_mvm_scd_queue_redirect(struct iwl_mvm *mvm, int queue, int tid,
+ ret);
+
+ /* Make sure the SCD wrptr is correctly set before reconfiguring */
+- iwl_trans_txq_enable(mvm->trans, queue, iwl_mvm_ac_to_tx_fifo[ac],
+- cmd.sta_id, tid, LINK_QUAL_AGG_FRAME_LIMIT_DEF,
+- ssn, wdg_timeout);
++ iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn, NULL, wdg_timeout);
+
+ /* TODO: Work-around SCD bug when moving back by multiples of 0x40 */
+
+@@ -1270,9 +1268,31 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
+ ret = iwl_mvm_drain_sta(mvm, mvm_sta, false);
+
+ /* If DQA is supported - the queues can be disabled now */
+- if (iwl_mvm_is_dqa_supported(mvm))
++ if (iwl_mvm_is_dqa_supported(mvm)) {
++ u8 reserved_txq = mvm_sta->reserved_queue;
++ enum iwl_mvm_queue_status *status;
++
+ iwl_mvm_disable_sta_queues(mvm, vif, mvm_sta);
+
++ /*
++ * If no traffic has gone through the reserved TXQ - it
++ * is still marked as IWL_MVM_QUEUE_RESERVED, and
++ * should be manually marked as free again
++ */
++ spin_lock_bh(&mvm->queue_info_lock);
++ status = &mvm->queue_info[reserved_txq].status;
++ if (WARN((*status != IWL_MVM_QUEUE_RESERVED) &&
++ (*status != IWL_MVM_QUEUE_FREE),
++ "sta_id %d reserved txq %d status %d",
++ mvm_sta->sta_id, reserved_txq, *status)) {
++ spin_unlock_bh(&mvm->queue_info_lock);
++ return -EINVAL;
++ }
++
++ *status = IWL_MVM_QUEUE_FREE;
++ spin_unlock_bh(&mvm->queue_info_lock);
++ }
++
+ if (vif->type == NL80211_IFTYPE_STATION &&
+ mvmvif->ap_sta_id == mvm_sta->sta_id) {
+ /* if associated - we can't remove the AP STA now */
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index b3a87a3..a0c1e3d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -903,9 +903,13 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
+ tid = IWL_MAX_TID_COUNT;
+ }
+
+- if (iwl_mvm_is_dqa_supported(mvm))
++ if (iwl_mvm_is_dqa_supported(mvm)) {
+ txq_id = mvmsta->tid_data[tid].txq_id;
+
++ if (ieee80211_is_mgmt(fc))
++ tx_cmd->tid_tspec = IWL_TID_NON_QOS;
++ }
++
+ /* Copy MAC header from skb into command buffer */
+ memcpy(tx_cmd->hdr, hdr, hdrlen);
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
+index 1c7b006..b89596c 100644
+--- a/drivers/net/wireless/marvell/mwifiex/join.c
++++ b/drivers/net/wireless/marvell/mwifiex/join.c
+@@ -669,9 +669,8 @@ int mwifiex_ret_802_11_associate(struct mwifiex_private *priv,
+ priv->assoc_rsp_size = min(le16_to_cpu(resp->size) - S_DS_GEN,
+ sizeof(priv->assoc_rsp_buf));
+
+- memcpy(priv->assoc_rsp_buf, &resp->params, priv->assoc_rsp_size);
+-
+ assoc_rsp->a_id = cpu_to_le16(aid);
++ memcpy(priv->assoc_rsp_buf, &resp->params, priv->assoc_rsp_size);
+
+ if (status_code) {
+ priv->adapter->dbg.num_cmd_assoc_failure++;
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_event.c b/drivers/net/wireless/marvell/mwifiex/sta_event.c
+index a422f33..7e394d4 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c
+@@ -708,7 +708,11 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
+
+ case EVENT_EXT_SCAN_REPORT:
+ mwifiex_dbg(adapter, EVENT, "event: EXT_SCAN Report\n");
+- if (adapter->ext_scan && !priv->scan_aborting)
++ /* We intend to skip this event during suspend, but handle
++ * it in interface disabled case
++ */
++ if (adapter->ext_scan && (!priv->scan_aborting ||
++ !netif_running(priv->netdev)))
+ ret = mwifiex_handle_event_ext_scan_report(priv,
+ adapter->event_skb->data);
+
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
+index 7cf26c6..6005e14 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
+@@ -831,8 +831,10 @@ int rt2x00usb_probe(struct usb_interface *usb_intf,
+ rt2x00dev->anchor = devm_kmalloc(&usb_dev->dev,
+ sizeof(struct usb_anchor),
+ GFP_KERNEL);
+- if (!rt2x00dev->anchor)
++ if (!rt2x00dev->anchor) {
++ retval = -ENOMEM;
+ goto exit_free_reg;
++ }
+
+ init_usb_anchor(rt2x00dev->anchor);
+ return 0;
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index 935866f..a8b6949 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -217,6 +217,8 @@ long nvdimm_clear_poison(struct device *dev, phys_addr_t phys,
+ return rc;
+ if (cmd_rc < 0)
+ return cmd_rc;
++
++ nvdimm_clear_from_poison_list(nvdimm_bus, phys, len);
+ return clear_err.cleared;
+ }
+ EXPORT_SYMBOL_GPL(nvdimm_clear_poison);
+diff --git a/drivers/nvdimm/core.c b/drivers/nvdimm/core.c
+index 4d7bbd2..7ceba08 100644
+--- a/drivers/nvdimm/core.c
++++ b/drivers/nvdimm/core.c
+@@ -547,11 +547,12 @@ void nvdimm_badblocks_populate(struct nd_region *nd_region,
+ }
+ EXPORT_SYMBOL_GPL(nvdimm_badblocks_populate);
+
+-static int add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
++static int add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length,
++ gfp_t flags)
+ {
+ struct nd_poison *pl;
+
+- pl = kzalloc(sizeof(*pl), GFP_KERNEL);
++ pl = kzalloc(sizeof(*pl), flags);
+ if (!pl)
+ return -ENOMEM;
+
+@@ -567,7 +568,7 @@ static int bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
+ struct nd_poison *pl;
+
+ if (list_empty(&nvdimm_bus->poison_list))
+- return add_poison(nvdimm_bus, addr, length);
++ return add_poison(nvdimm_bus, addr, length, GFP_KERNEL);
+
+ /*
+ * There is a chance this is a duplicate, check for those first.
+@@ -587,7 +588,7 @@ static int bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
+ * as any overlapping ranges will get resolved when the list is consumed
+ * and converted to badblocks
+ */
+- return add_poison(nvdimm_bus, addr, length);
++ return add_poison(nvdimm_bus, addr, length, GFP_KERNEL);
+ }
+
+ int nvdimm_bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
+@@ -602,6 +603,70 @@ int nvdimm_bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
+ }
+ EXPORT_SYMBOL_GPL(nvdimm_bus_add_poison);
+
++void nvdimm_clear_from_poison_list(struct nvdimm_bus *nvdimm_bus,
++ phys_addr_t start, unsigned int len)
++{
++ struct list_head *poison_list = &nvdimm_bus->poison_list;
++ u64 clr_end = start + len - 1;
++ struct nd_poison *pl, *next;
++
++ nvdimm_bus_lock(&nvdimm_bus->dev);
++ WARN_ON_ONCE(list_empty(poison_list));
++
++ /*
++ * [start, clr_end] is the poison interval being cleared.
++ * [pl->start, pl_end] is the poison_list entry we're comparing
++ * the above interval against. The poison list entry may need
++ * to be modified (update either start or length), deleted, or
++ * split into two based on the overlap characteristics
++ */
++
++ list_for_each_entry_safe(pl, next, poison_list, list) {
++ u64 pl_end = pl->start + pl->length - 1;
++
++ /* Skip intervals with no intersection */
++ if (pl_end < start)
++ continue;
++ if (pl->start > clr_end)
++ continue;
++ /* Delete completely overlapped poison entries */
++ if ((pl->start >= start) && (pl_end <= clr_end)) {
++ list_del(&pl->list);
++ kfree(pl);
++ continue;
++ }
++ /* Adjust start point of partially cleared entries */
++ if ((start <= pl->start) && (clr_end > pl->start)) {
++ pl->length -= clr_end - pl->start + 1;
++ pl->start = clr_end + 1;
++ continue;
++ }
++ /* Adjust pl->length for partial clearing at the tail end */
++ if ((pl->start < start) && (pl_end <= clr_end)) {
++ /* pl->start remains the same */
++ pl->length = start - pl->start;
++ continue;
++ }
++ /*
++ * If clearing in the middle of an entry, we split it into
++ * two by modifying the current entry to represent one half of
++ * the split, and adding a new entry for the second half.
++ */
++ if ((pl->start < start) && (pl_end > clr_end)) {
++ u64 new_start = clr_end + 1;
++ u64 new_len = pl_end - new_start + 1;
++
++ /* Add new entry covering the right half */
++ add_poison(nvdimm_bus, new_start, new_len, GFP_NOIO);
++ /* Adjust this entry to cover the left half */
++ pl->length = start - pl->start;
++ continue;
++ }
++ }
++ nvdimm_bus_unlock(&nvdimm_bus->dev);
++}
++EXPORT_SYMBOL_GPL(nvdimm_clear_from_poison_list);
++
+ #ifdef CONFIG_BLK_DEV_INTEGRITY
+ int nd_integrity_init(struct gendisk *disk, unsigned long meta_size)
+ {
+diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
+index ef9893f..4f5e567 100644
+--- a/drivers/pci/host/pci-aardvark.c
++++ b/drivers/pci/host/pci-aardvark.c
+@@ -848,7 +848,7 @@ static int advk_pcie_parse_request_of_pci_ranges(struct advk_pcie *pcie)
+ int err, res_valid = 0;
+ struct device *dev = &pcie->pdev->dev;
+ struct device_node *np = dev->of_node;
+- struct resource_entry *win;
++ struct resource_entry *win, *tmp;
+ resource_size_t iobase;
+
+ INIT_LIST_HEAD(&pcie->resources);
+@@ -862,7 +862,7 @@ static int advk_pcie_parse_request_of_pci_ranges(struct advk_pcie *pcie)
+ if (err)
+ goto out_release_res;
+
+- resource_list_for_each_entry(win, &pcie->resources) {
++ resource_list_for_each_entry_safe(win, tmp, &pcie->resources) {
+ struct resource *res = win->res;
+
+ switch (resource_type(res)) {
+@@ -874,9 +874,11 @@ static int advk_pcie_parse_request_of_pci_ranges(struct advk_pcie *pcie)
+ lower_32_bits(res->start),
+ OB_PCIE_IO);
+ err = pci_remap_iospace(res, iobase);
+- if (err)
++ if (err) {
+ dev_warn(dev, "error %d: failed to map resource %pR\n",
+ err, res);
++ resource_list_destroy_entry(win);
++ }
+ break;
+ case IORESOURCE_MEM:
+ advk_pcie_set_ob_win(pcie, 0,
+diff --git a/drivers/pci/host/pci-host-common.c b/drivers/pci/host/pci-host-common.c
+index 9d9d34e..61eb4d4 100644
+--- a/drivers/pci/host/pci-host-common.c
++++ b/drivers/pci/host/pci-host-common.c
+@@ -29,7 +29,7 @@ static int gen_pci_parse_request_of_pci_ranges(struct device *dev,
+ int err, res_valid = 0;
+ struct device_node *np = dev->of_node;
+ resource_size_t iobase;
+- struct resource_entry *win;
++ struct resource_entry *win, *tmp;
+
+ err = of_pci_get_host_bridge_resources(np, 0, 0xff, resources, &iobase);
+ if (err)
+@@ -39,15 +39,17 @@ static int gen_pci_parse_request_of_pci_ranges(struct device *dev,
+ if (err)
+ return err;
+
+- resource_list_for_each_entry(win, resources) {
++ resource_list_for_each_entry_safe(win, tmp, resources) {
+ struct resource *res = win->res;
+
+ switch (resource_type(res)) {
+ case IORESOURCE_IO:
+ err = pci_remap_iospace(res, iobase);
+- if (err)
++ if (err) {
+ dev_warn(dev, "error %d: failed to map resource %pR\n",
+ err, res);
++ resource_list_destroy_entry(win);
++ }
+ break;
+ case IORESOURCE_MEM:
+ res_valid |= !(res->flags & IORESOURCE_PREFETCH);
+diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
+index 84d650d..7ec1e80 100644
+--- a/drivers/pci/host/pci-tegra.c
++++ b/drivers/pci/host/pci-tegra.c
+@@ -621,7 +621,11 @@ static int tegra_pcie_setup(int nr, struct pci_sys_data *sys)
+ if (err < 0)
+ return err;
+
+- pci_add_resource_offset(&sys->resources, &pcie->pio, sys->io_offset);
++ err = pci_remap_iospace(&pcie->pio, pcie->io.start);
++ if (!err)
++ pci_add_resource_offset(&sys->resources, &pcie->pio,
++ sys->io_offset);
++
+ pci_add_resource_offset(&sys->resources, &pcie->mem, sys->mem_offset);
+ pci_add_resource_offset(&sys->resources, &pcie->prefetch,
+ sys->mem_offset);
+@@ -631,7 +635,6 @@ static int tegra_pcie_setup(int nr, struct pci_sys_data *sys)
+ if (err < 0)
+ return err;
+
+- pci_remap_iospace(&pcie->pio, pcie->io.start);
+ return 1;
+ }
+
+diff --git a/drivers/pci/host/pci-versatile.c b/drivers/pci/host/pci-versatile.c
+index f2344057..b7dc070 100644
+--- a/drivers/pci/host/pci-versatile.c
++++ b/drivers/pci/host/pci-versatile.c
+@@ -74,7 +74,7 @@ static int versatile_pci_parse_request_of_pci_ranges(struct device *dev,
+ int err, mem = 1, res_valid = 0;
+ struct device_node *np = dev->of_node;
+ resource_size_t iobase;
+- struct resource_entry *win;
++ struct resource_entry *win, *tmp;
+
+ err = of_pci_get_host_bridge_resources(np, 0, 0xff, res, &iobase);
+ if (err)
+@@ -84,15 +84,17 @@ static int versatile_pci_parse_request_of_pci_ranges(struct device *dev,
+ if (err)
+ goto out_release_res;
+
+- resource_list_for_each_entry(win, res) {
++ resource_list_for_each_entry_safe(win, tmp, res) {
+ struct resource *res = win->res;
+
+ switch (resource_type(res)) {
+ case IORESOURCE_IO:
+ err = pci_remap_iospace(res, iobase);
+- if (err)
++ if (err) {
+ dev_warn(dev, "error %d: failed to map resource %pR\n",
+ err, res);
++ resource_list_destroy_entry(win);
++ }
+ break;
+ case IORESOURCE_MEM:
+ res_valid |= !(res->flags & IORESOURCE_PREFETCH);
+diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
+index 12afce1..2a500f2 100644
+--- a/drivers/pci/host/pcie-designware.c
++++ b/drivers/pci/host/pcie-designware.c
+@@ -436,7 +436,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ struct resource *cfg_res;
+ int i, ret;
+ LIST_HEAD(res);
+- struct resource_entry *win;
++ struct resource_entry *win, *tmp;
+
+ cfg_res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "config");
+ if (cfg_res) {
+@@ -457,17 +457,20 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ goto error;
+
+ /* Get the I/O and memory ranges from DT */
+- resource_list_for_each_entry(win, &res) {
++ resource_list_for_each_entry_safe(win, tmp, &res) {
+ switch (resource_type(win->res)) {
+ case IORESOURCE_IO:
+- pp->io = win->res;
+- pp->io->name = "I/O";
+- pp->io_size = resource_size(pp->io);
+- pp->io_bus_addr = pp->io->start - win->offset;
+- ret = pci_remap_iospace(pp->io, pp->io_base);
+- if (ret)
++ ret = pci_remap_iospace(win->res, pp->io_base);
++ if (ret) {
+ dev_warn(pp->dev, "error %d: failed to map resource %pR\n",
+- ret, pp->io);
++ ret, win->res);
++ resource_list_destroy_entry(win);
++ } else {
++ pp->io = win->res;
++ pp->io->name = "I/O";
++ pp->io_size = resource_size(pp->io);
++ pp->io_bus_addr = pp->io->start - win->offset;
++ }
+ break;
+ case IORESOURCE_MEM:
+ pp->mem = win->res;
+diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c
+index 65db7a2..5f7fcc9 100644
+--- a/drivers/pci/host/pcie-rcar.c
++++ b/drivers/pci/host/pcie-rcar.c
+@@ -945,7 +945,7 @@ static int rcar_pcie_parse_request_of_pci_ranges(struct rcar_pcie *pci)
+ struct device *dev = pci->dev;
+ struct device_node *np = dev->of_node;
+ resource_size_t iobase;
+- struct resource_entry *win;
++ struct resource_entry *win, *tmp;
+
+ err = of_pci_get_host_bridge_resources(np, 0, 0xff, &pci->resources, &iobase);
+ if (err)
+@@ -955,14 +955,17 @@ static int rcar_pcie_parse_request_of_pci_ranges(struct rcar_pcie *pci)
+ if (err)
+ goto out_release_res;
+
+- resource_list_for_each_entry(win, &pci->resources) {
++ resource_list_for_each_entry_safe(win, tmp, &pci->resources) {
+ struct resource *res = win->res;
+
+ if (resource_type(res) == IORESOURCE_IO) {
+ err = pci_remap_iospace(res, iobase);
+- if (err)
++ if (err) {
+ dev_warn(dev, "error %d: failed to map resource %pR\n",
+ err, res);
++
++ resource_list_destroy_entry(win);
++ }
+ }
+ }
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
+index 51c42d7..775c883 100644
+--- a/drivers/pinctrl/qcom/pinctrl-msm.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
+@@ -156,7 +156,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev,
+ spin_lock_irqsave(&pctrl->lock, flags);
+
+ val = readl(pctrl->regs + g->ctl_reg);
+- val &= mask;
++ val &= ~mask;
+ val |= i << g->mux_bit;
+ writel(val, pctrl->regs + g->ctl_reg);
+
+diff --git a/drivers/power/bq24257_charger.c b/drivers/power/bq24257_charger.c
+index 1fea2c7..6fc31bd 100644
+--- a/drivers/power/bq24257_charger.c
++++ b/drivers/power/bq24257_charger.c
+@@ -1068,6 +1068,12 @@ static int bq24257_probe(struct i2c_client *client,
+ return ret;
+ }
+
++ ret = bq24257_power_supply_init(bq);
++ if (ret < 0) {
++ dev_err(dev, "Failed to register power supply\n");
++ return ret;
++ }
++
+ ret = devm_request_threaded_irq(dev, client->irq, NULL,
+ bq24257_irq_handler_thread,
+ IRQF_TRIGGER_FALLING |
+@@ -1078,12 +1084,6 @@ static int bq24257_probe(struct i2c_client *client,
+ return ret;
+ }
+
+- ret = bq24257_power_supply_init(bq);
+- if (ret < 0) {
+- dev_err(dev, "Failed to register power supply\n");
+- return ret;
+- }
+-
+ ret = sysfs_create_group(&bq->charger->dev.kobj, &bq24257_attr_group);
+ if (ret < 0) {
+ dev_err(dev, "Can't create sysfs entries\n");
+diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c
+index 6b1577c..285b400 100644
+--- a/drivers/s390/char/con3270.c
++++ b/drivers/s390/char/con3270.c
+@@ -124,7 +124,12 @@ con3270_create_status(struct con3270 *cp)
+ static void
+ con3270_update_string(struct con3270 *cp, struct string *s, int nr)
+ {
+- if (s->len >= cp->view.cols - 5)
++ if (s->len < 4) {
++ /* This indicates a bug, but printing a warning would
++ * cause a deadlock. */
++ return;
++ }
++ if (s->string[s->len - 4] != TO_RA)
+ return;
+ raw3270_buffer_address(cp->view.dev, s->string + s->len - 3,
+ cp->view.cols * (nr + 1));
+@@ -460,11 +465,11 @@ con3270_cline_end(struct con3270 *cp)
+ cp->cline->len + 4 : cp->view.cols;
+ s = con3270_alloc_string(cp, size);
+ memcpy(s->string, cp->cline->string, cp->cline->len);
+- if (s->len < cp->view.cols - 5) {
++ if (cp->cline->len < cp->view.cols - 5) {
+ s->string[s->len - 4] = TO_RA;
+ s->string[s->len - 1] = 0;
+ } else {
+- while (--size > cp->cline->len)
++ while (--size >= cp->cline->len)
+ s->string[size] = cp->view.ascebc[' '];
+ }
+ /* Replace cline with allocated line s and reset cline. */
+diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
+index 940e725..1167469 100644
+--- a/drivers/s390/cio/chsc.c
++++ b/drivers/s390/cio/chsc.c
+@@ -95,12 +95,13 @@ struct chsc_ssd_area {
+ int chsc_get_ssd_info(struct subchannel_id schid, struct chsc_ssd_info *ssd)
+ {
+ struct chsc_ssd_area *ssd_area;
++ unsigned long flags;
+ int ccode;
+ int ret;
+ int i;
+ int mask;
+
+- spin_lock_irq(&chsc_page_lock);
++ spin_lock_irqsave(&chsc_page_lock, flags);
+ memset(chsc_page, 0, PAGE_SIZE);
+ ssd_area = chsc_page;
+ ssd_area->request.length = 0x0010;
+@@ -144,7 +145,7 @@ int chsc_get_ssd_info(struct subchannel_id schid, struct chsc_ssd_info *ssd)
+ ssd->fla[i] = ssd_area->fla[i];
+ }
+ out:
+- spin_unlock_irq(&chsc_page_lock);
++ spin_unlock_irqrestore(&chsc_page_lock, flags);
+ return ret;
+ }
+
+@@ -832,9 +833,10 @@ int __chsc_do_secm(struct channel_subsystem *css, int enable)
+ u32 fmt : 4;
+ u32 : 16;
+ } __attribute__ ((packed)) *secm_area;
++ unsigned long flags;
+ int ret, ccode;
+
+- spin_lock_irq(&chsc_page_lock);
++ spin_lock_irqsave(&chsc_page_lock, flags);
+ memset(chsc_page, 0, PAGE_SIZE);
+ secm_area = chsc_page;
+ secm_area->request.length = 0x0050;
+@@ -864,7 +866,7 @@ int __chsc_do_secm(struct channel_subsystem *css, int enable)
+ CIO_CRW_EVENT(2, "chsc: secm failed (rc=%04x)\n",
+ secm_area->response.code);
+ out:
+- spin_unlock_irq(&chsc_page_lock);
++ spin_unlock_irqrestore(&chsc_page_lock, flags);
+ return ret;
+ }
+
+@@ -992,6 +994,7 @@ chsc_initialize_cmg_chars(struct channel_path *chp, u8 cmcv,
+
+ int chsc_get_channel_measurement_chars(struct channel_path *chp)
+ {
++ unsigned long flags;
+ int ccode, ret;
+
+ struct {
+@@ -1021,7 +1024,7 @@ int chsc_get_channel_measurement_chars(struct channel_path *chp)
+ if (!css_chsc_characteristics.scmc || !css_chsc_characteristics.secm)
+ return -EINVAL;
+
+- spin_lock_irq(&chsc_page_lock);
++ spin_lock_irqsave(&chsc_page_lock, flags);
+ memset(chsc_page, 0, PAGE_SIZE);
+ scmc_area = chsc_page;
+ scmc_area->request.length = 0x0010;
+@@ -1053,7 +1056,7 @@ int chsc_get_channel_measurement_chars(struct channel_path *chp)
+ chsc_initialize_cmg_chars(chp, scmc_area->cmcv,
+ (struct cmg_chars *) &scmc_area->data);
+ out:
+- spin_unlock_irq(&chsc_page_lock);
++ spin_unlock_irqrestore(&chsc_page_lock, flags);
+ return ret;
+ }
+
+@@ -1134,6 +1137,7 @@ struct css_chsc_char css_chsc_characteristics;
+ int __init
+ chsc_determine_css_characteristics(void)
+ {
++ unsigned long flags;
+ int result;
+ struct {
+ struct chsc_header request;
+@@ -1146,7 +1150,7 @@ chsc_determine_css_characteristics(void)
+ u32 chsc_char[508];
+ } __attribute__ ((packed)) *scsc_area;
+
+- spin_lock_irq(&chsc_page_lock);
++ spin_lock_irqsave(&chsc_page_lock, flags);
+ memset(chsc_page, 0, PAGE_SIZE);
+ scsc_area = chsc_page;
+ scsc_area->request.length = 0x0010;
+@@ -1168,7 +1172,7 @@ chsc_determine_css_characteristics(void)
+ CIO_CRW_EVENT(2, "chsc: scsc failed (rc=%04x)\n",
+ scsc_area->response.code);
+ exit:
+- spin_unlock_irq(&chsc_page_lock);
++ spin_unlock_irqrestore(&chsc_page_lock, flags);
+ return result;
+ }
+
+diff --git a/drivers/scsi/cxlflash/main.c b/drivers/scsi/cxlflash/main.c
+index 661bb94..228b99e 100644
+--- a/drivers/scsi/cxlflash/main.c
++++ b/drivers/scsi/cxlflash/main.c
+@@ -823,17 +823,6 @@ static void notify_shutdown(struct cxlflash_cfg *cfg, bool wait)
+ }
+
+ /**
+- * cxlflash_shutdown() - shutdown handler
+- * @pdev: PCI device associated with the host.
+- */
+-static void cxlflash_shutdown(struct pci_dev *pdev)
+-{
+- struct cxlflash_cfg *cfg = pci_get_drvdata(pdev);
+-
+- notify_shutdown(cfg, false);
+-}
+-
+-/**
+ * cxlflash_remove() - PCI entry point to tear down host
+ * @pdev: PCI device associated with the host.
+ *
+@@ -844,6 +833,11 @@ static void cxlflash_remove(struct pci_dev *pdev)
+ struct cxlflash_cfg *cfg = pci_get_drvdata(pdev);
+ ulong lock_flags;
+
++ if (!pci_is_enabled(pdev)) {
++ pr_debug("%s: Device is disabled\n", __func__);
++ return;
++ }
++
+ /* If a Task Management Function is active, wait for it to complete
+ * before continuing with remove.
+ */
+@@ -2685,7 +2679,7 @@ static struct pci_driver cxlflash_driver = {
+ .id_table = cxlflash_pci_table,
+ .probe = cxlflash_probe,
+ .remove = cxlflash_remove,
+- .shutdown = cxlflash_shutdown,
++ .shutdown = cxlflash_remove,
+ .err_handler = &cxlflash_err_handler,
+ };
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index cd91a68..4cb7990 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -4701,7 +4701,7 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
+ le16_to_cpu(mpi_reply->DevHandle));
+ mpt3sas_trigger_scsi(ioc, data.skey, data.asc, data.ascq);
+
+- if (!(ioc->logging_level & MPT_DEBUG_REPLY) &&
++ if ((ioc->logging_level & MPT_DEBUG_REPLY) &&
+ ((scmd->sense_buffer[2] == UNIT_ATTENTION) ||
+ (scmd->sense_buffer[2] == MEDIUM_ERROR) ||
+ (scmd->sense_buffer[2] == HARDWARE_ERROR)))
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 9e9dadb..eec5e3f 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -760,7 +760,6 @@ static int dspi_remove(struct platform_device *pdev)
+ /* Disconnect from the SPI framework */
+ clk_disable_unprepare(dspi->clk);
+ spi_unregister_master(dspi->master);
+- spi_master_put(dspi->master);
+
+ return 0;
+ }
+diff --git a/drivers/staging/android/ion/Kconfig b/drivers/staging/android/ion/Kconfig
+index 19c1572..800245e 100644
+--- a/drivers/staging/android/ion/Kconfig
++++ b/drivers/staging/android/ion/Kconfig
+@@ -36,6 +36,7 @@ config ION_TEGRA
+ config ION_HISI
+ tristate "Ion for Hisilicon"
+ depends on ARCH_HISI && ION
++ select ION_OF
+ help
+ Choose this option if you wish to use ion on Hisilicon Platform.
+
+diff --git a/drivers/staging/ks7010/ks_hostif.c b/drivers/staging/ks7010/ks_hostif.c
+index a8822fe..f4cee81 100644
+--- a/drivers/staging/ks7010/ks_hostif.c
++++ b/drivers/staging/ks7010/ks_hostif.c
+@@ -69,16 +69,20 @@ inline u32 get_DWORD(struct ks_wlan_private *priv)
+ return data;
+ }
+
+-void ks_wlan_hw_wakeup_task(struct work_struct *work)
++static void ks_wlan_hw_wakeup_task(struct work_struct *work)
+ {
+ struct ks_wlan_private *priv =
+ container_of(work, struct ks_wlan_private, ks_wlan_wakeup_task);
+ int ps_status = atomic_read(&priv->psstatus.status);
++ long time_left;
+
+ if (ps_status == PS_SNOOZE) {
+ ks_wlan_hw_wakeup_request(priv);
+- if (!wait_for_completion_interruptible_timeout(&priv->psstatus.wakeup_wait, HZ / 50)) { /* 20ms timeout */
+- DPRINTK(1, "wake up timeout !!!\n");
++ time_left = wait_for_completion_interruptible_timeout(
++ &priv->psstatus.wakeup_wait,
++ msecs_to_jiffies(20));
++ if (time_left <= 0) {
++ DPRINTK(1, "wake up timeout or interrupted !!!\n");
+ schedule_work(&priv->ks_wlan_wakeup_task);
+ return;
+ }
+@@ -1505,7 +1509,7 @@ void hostif_infrastructure_set_request(struct ks_wlan_private *priv)
+ ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL, NULL);
+ }
+
+-void hostif_infrastructure_set2_request(struct ks_wlan_private *priv)
++static void hostif_infrastructure_set2_request(struct ks_wlan_private *priv)
+ {
+ struct hostif_infrastructure_set2_request_t *pp;
+ uint16_t capability;
+diff --git a/drivers/staging/rtl8188eu/core/rtw_cmd.c b/drivers/staging/rtl8188eu/core/rtw_cmd.c
+index 7748523..32d3a9c 100644
+--- a/drivers/staging/rtl8188eu/core/rtw_cmd.c
++++ b/drivers/staging/rtl8188eu/core/rtw_cmd.c
+@@ -670,13 +670,13 @@ u8 rtw_addbareq_cmd(struct adapter *padapter, u8 tid, u8 *addr)
+ u8 res = _SUCCESS;
+
+
+- ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
++ ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
+ if (!ph2c) {
+ res = _FAIL;
+ goto exit;
+ }
+
+- paddbareq_parm = kzalloc(sizeof(struct addBaReq_parm), GFP_KERNEL);
++ paddbareq_parm = kzalloc(sizeof(struct addBaReq_parm), GFP_ATOMIC);
+ if (!paddbareq_parm) {
+ kfree(ph2c);
+ res = _FAIL;
+diff --git a/drivers/staging/sm750fb/ddk750_mode.c b/drivers/staging/sm750fb/ddk750_mode.c
+index ccb4e06..e29d4bd 100644
+--- a/drivers/staging/sm750fb/ddk750_mode.c
++++ b/drivers/staging/sm750fb/ddk750_mode.c
+@@ -63,7 +63,7 @@ static unsigned long displayControlAdjust_SM750LE(mode_parameter_t *pModeParam,
+ dispControl |= (CRT_DISPLAY_CTRL_CRTSELECT | CRT_DISPLAY_CTRL_RGBBIT);
+
+ /* Set bit 14 of display controller */
+- dispControl = DISPLAY_CTRL_CLOCK_PHASE;
++ dispControl |= DISPLAY_CTRL_CLOCK_PHASE;
+
+ POKE32(CRT_DISPLAY_CTRL, dispControl);
+
+diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c
+index 915facb..e1134a4 100644
+--- a/drivers/uio/uio_dmem_genirq.c
++++ b/drivers/uio/uio_dmem_genirq.c
+@@ -229,7 +229,7 @@ static int uio_dmem_genirq_probe(struct platform_device *pdev)
+ ++uiomem;
+ }
+
+- priv->dmem_region_start = i;
++ priv->dmem_region_start = uiomem - &uioinfo->mem[0];
+ priv->num_dmem_regions = pdata->num_dynamic_regions;
+
+ for (i = 0; i < pdata->num_dynamic_regions; ++i) {
+diff --git a/fs/9p/acl.c b/fs/9p/acl.c
+index 5b6a174..b3c2cc7 100644
+--- a/fs/9p/acl.c
++++ b/fs/9p/acl.c
+@@ -276,32 +276,26 @@ static int v9fs_xattr_set_acl(const struct xattr_handler *handler,
+ switch (handler->flags) {
+ case ACL_TYPE_ACCESS:
+ if (acl) {
+- umode_t mode = inode->i_mode;
+- retval = posix_acl_equiv_mode(acl, &mode);
+- if (retval < 0)
++ struct iattr iattr;
++
++ retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl);
++ if (retval)
+ goto err_out;
+- else {
+- struct iattr iattr;
+- if (retval == 0) {
+- /*
+- * ACL can be represented
+- * by the mode bits. So don't
+- * update ACL.
+- */
+- acl = NULL;
+- value = NULL;
+- size = 0;
+- }
+- /* Updte the mode bits */
+- iattr.ia_mode = ((mode & S_IALLUGO) |
+- (inode->i_mode & ~S_IALLUGO));
+- iattr.ia_valid = ATTR_MODE;
+- /* FIXME should we update ctime ?
+- * What is the following setxattr update the
+- * mode ?
++ if (!acl) {
++ /*
++ * ACL can be represented
++ * by the mode bits. So don't
++ * update ACL.
+ */
+- v9fs_vfs_setattr_dotl(dentry, &iattr);
++ value = NULL;
++ size = 0;
+ }
++ iattr.ia_valid = ATTR_MODE;
++ /* FIXME should we update ctime ?
++ * What is the following setxattr update the
++ * mode ?
++ */
++ v9fs_vfs_setattr_dotl(dentry, &iattr);
+ }
+ break;
+ case ACL_TYPE_DEFAULT:
+diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
+index 53bb7af..247b8df 100644
+--- a/fs/btrfs/acl.c
++++ b/fs/btrfs/acl.c
+@@ -79,11 +79,9 @@ static int __btrfs_set_acl(struct btrfs_trans_handle *trans,
+ case ACL_TYPE_ACCESS:
+ name = XATTR_NAME_POSIX_ACL_ACCESS;
+ if (acl) {
+- ret = posix_acl_equiv_mode(acl, &inode->i_mode);
+- if (ret < 0)
++ ret = posix_acl_update_mode(inode, &inode->i_mode, &acl);
++ if (ret)
+ return ret;
+- if (ret == 0)
+- acl = NULL;
+ }
+ ret = 0;
+ break;
+diff --git a/fs/ceph/acl.c b/fs/ceph/acl.c
+index 4f67227..d0b6b342 100644
+--- a/fs/ceph/acl.c
++++ b/fs/ceph/acl.c
+@@ -95,11 +95,9 @@ int ceph_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+ case ACL_TYPE_ACCESS:
+ name = XATTR_NAME_POSIX_ACL_ACCESS;
+ if (acl) {
+- ret = posix_acl_equiv_mode(acl, &new_mode);
+- if (ret < 0)
++ ret = posix_acl_update_mode(inode, &new_mode, &acl);
++ if (ret)
+ goto out;
+- if (ret == 0)
+- acl = NULL;
+ }
+ break;
+ case ACL_TYPE_DEFAULT:
+diff --git a/fs/ext2/acl.c b/fs/ext2/acl.c
+index 42f1d18..e725aa0 100644
+--- a/fs/ext2/acl.c
++++ b/fs/ext2/acl.c
+@@ -190,15 +190,11 @@ ext2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+ case ACL_TYPE_ACCESS:
+ name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS;
+ if (acl) {
+- error = posix_acl_equiv_mode(acl, &inode->i_mode);
+- if (error < 0)
++ error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
++ if (error)
+ return error;
+- else {
+- inode->i_ctime = CURRENT_TIME_SEC;
+- mark_inode_dirty(inode);
+- if (error == 0)
+- acl = NULL;
+- }
++ inode->i_ctime = CURRENT_TIME_SEC;
++ mark_inode_dirty(inode);
+ }
+ break;
+
+diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c
+index c6601a4..dfa5199 100644
+--- a/fs/ext4/acl.c
++++ b/fs/ext4/acl.c
+@@ -193,15 +193,11 @@ __ext4_set_acl(handle_t *handle, struct inode *inode, int type,
+ case ACL_TYPE_ACCESS:
+ name_index = EXT4_XATTR_INDEX_POSIX_ACL_ACCESS;
+ if (acl) {
+- error = posix_acl_equiv_mode(acl, &inode->i_mode);
+- if (error < 0)
++ error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
++ if (error)
+ return error;
+- else {
+- inode->i_ctime = ext4_current_time(inode);
+- ext4_mark_inode_dirty(handle, inode);
+- if (error == 0)
+- acl = NULL;
+- }
++ inode->i_ctime = ext4_current_time(inode);
++ ext4_mark_inode_dirty(handle, inode);
+ }
+ break;
+
+diff --git a/fs/f2fs/acl.c b/fs/f2fs/acl.c
+index 4dcc9e2..3134424 100644
+--- a/fs/f2fs/acl.c
++++ b/fs/f2fs/acl.c
+@@ -210,12 +210,10 @@ static int __f2fs_set_acl(struct inode *inode, int type,
+ case ACL_TYPE_ACCESS:
+ name_index = F2FS_XATTR_INDEX_POSIX_ACL_ACCESS;
+ if (acl) {
+- error = posix_acl_equiv_mode(acl, &inode->i_mode);
+- if (error < 0)
++ error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
++ if (error)
+ return error;
+ set_acl_inode(inode, inode->i_mode);
+- if (error == 0)
+- acl = NULL;
+ }
+ break;
+
+diff --git a/fs/gfs2/acl.c b/fs/gfs2/acl.c
+index 363ba9e..2524807 100644
+--- a/fs/gfs2/acl.c
++++ b/fs/gfs2/acl.c
+@@ -92,17 +92,11 @@ int __gfs2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+ if (type == ACL_TYPE_ACCESS) {
+ umode_t mode = inode->i_mode;
+
+- error = posix_acl_equiv_mode(acl, &mode);
+- if (error < 0)
++ error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
++ if (error)
+ return error;
+-
+- if (error == 0)
+- acl = NULL;
+-
+- if (mode != inode->i_mode) {
+- inode->i_mode = mode;
++ if (mode != inode->i_mode)
+ mark_inode_dirty(inode);
+- }
+ }
+
+ if (acl) {
+diff --git a/fs/hfsplus/posix_acl.c b/fs/hfsplus/posix_acl.c
+index ab7ea25..9b92058 100644
+--- a/fs/hfsplus/posix_acl.c
++++ b/fs/hfsplus/posix_acl.c
+@@ -65,8 +65,8 @@ int hfsplus_set_posix_acl(struct inode *inode, struct posix_acl *acl,
+ case ACL_TYPE_ACCESS:
+ xattr_name = XATTR_NAME_POSIX_ACL_ACCESS;
+ if (acl) {
+- err = posix_acl_equiv_mode(acl, &inode->i_mode);
+- if (err < 0)
++ err = posix_acl_update_mode(inode, &inode->i_mode, &acl);
++ if (err)
+ return err;
+ }
+ err = 0;
+diff --git a/fs/jffs2/acl.c b/fs/jffs2/acl.c
+index bc2693d..2a0f2a1 100644
+--- a/fs/jffs2/acl.c
++++ b/fs/jffs2/acl.c
+@@ -233,9 +233,10 @@ int jffs2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+ case ACL_TYPE_ACCESS:
+ xprefix = JFFS2_XPREFIX_ACL_ACCESS;
+ if (acl) {
+- umode_t mode = inode->i_mode;
+- rc = posix_acl_equiv_mode(acl, &mode);
+- if (rc < 0)
++ umode_t mode;
++
++ rc = posix_acl_update_mode(inode, &mode, &acl);
++ if (rc)
+ return rc;
+ if (inode->i_mode != mode) {
+ struct iattr attr;
+@@ -247,8 +248,6 @@ int jffs2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+ if (rc < 0)
+ return rc;
+ }
+- if (rc == 0)
+- acl = NULL;
+ }
+ break;
+ case ACL_TYPE_DEFAULT:
+diff --git a/fs/jfs/acl.c b/fs/jfs/acl.c
+index 21fa92b..3a1e155 100644
+--- a/fs/jfs/acl.c
++++ b/fs/jfs/acl.c
+@@ -78,13 +78,11 @@ static int __jfs_set_acl(tid_t tid, struct inode *inode, int type,
+ case ACL_TYPE_ACCESS:
+ ea_name = XATTR_NAME_POSIX_ACL_ACCESS;
+ if (acl) {
+- rc = posix_acl_equiv_mode(acl, &inode->i_mode);
+- if (rc < 0)
++ rc = posix_acl_update_mode(inode, &inode->i_mode, &acl);
++ if (rc)
+ return rc;
+ inode->i_ctime = CURRENT_TIME;
+ mark_inode_dirty(inode);
+- if (rc == 0)
+- acl = NULL;
+ }
+ break;
+ case ACL_TYPE_DEFAULT:
+diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
+index 2162434..164307b 100644
+--- a/fs/ocfs2/acl.c
++++ b/fs/ocfs2/acl.c
+@@ -241,13 +241,11 @@ int ocfs2_set_acl(handle_t *handle,
+ case ACL_TYPE_ACCESS:
+ name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS;
+ if (acl) {
+- umode_t mode = inode->i_mode;
+- ret = posix_acl_equiv_mode(acl, &mode);
+- if (ret < 0)
+- return ret;
++ umode_t mode;
+
+- if (ret == 0)
+- acl = NULL;
++ ret = posix_acl_update_mode(inode, &mode, &acl);
++ if (ret)
++ return ret;
+
+ ret = ocfs2_acl_set_mode(inode, di_bh,
+ handle, mode);
+diff --git a/fs/orangefs/acl.c b/fs/orangefs/acl.c
+index 28f2195..7a37544 100644
+--- a/fs/orangefs/acl.c
++++ b/fs/orangefs/acl.c
+@@ -73,14 +73,11 @@ int orangefs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+ case ACL_TYPE_ACCESS:
+ name = XATTR_NAME_POSIX_ACL_ACCESS;
+ if (acl) {
+- umode_t mode = inode->i_mode;
+- /*
+- * can we represent this with the traditional file
+- * mode permission bits?
+- */
+- error = posix_acl_equiv_mode(acl, &mode);
+- if (error < 0) {
+- gossip_err("%s: posix_acl_equiv_mode err: %d\n",
++ umode_t mode;
++
++ error = posix_acl_update_mode(inode, &mode, &acl);
++ if (error) {
++ gossip_err("%s: posix_acl_update_mode err: %d\n",
+ __func__,
+ error);
+ return error;
+@@ -90,8 +87,6 @@ int orangefs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+ SetModeFlag(orangefs_inode);
+ inode->i_mode = mode;
+ mark_inode_dirty_sync(inode);
+- if (error == 0)
+- acl = NULL;
+ }
+ break;
+ case ACL_TYPE_DEFAULT:
+diff --git a/fs/posix_acl.c b/fs/posix_acl.c
+index 59d47ab0..bfc3ec3 100644
+--- a/fs/posix_acl.c
++++ b/fs/posix_acl.c
+@@ -626,6 +626,37 @@ posix_acl_create(struct inode *dir, umode_t *mode,
+ }
+ EXPORT_SYMBOL_GPL(posix_acl_create);
+
++/**
++ * posix_acl_update_mode - update mode in set_acl
++ *
++ * Update the file mode when setting an ACL: compute the new file permission
++ * bits based on the ACL. In addition, if the ACL is equivalent to the new
++ * file mode, set *acl to NULL to indicate that no ACL should be set.
++ *
++ * As with chmod, clear the setgit bit if the caller is not in the owning group
++ * or capable of CAP_FSETID (see inode_change_ok).
++ *
++ * Called from set_acl inode operations.
++ */
++int posix_acl_update_mode(struct inode *inode, umode_t *mode_p,
++ struct posix_acl **acl)
++{
++ umode_t mode = inode->i_mode;
++ int error;
++
++ error = posix_acl_equiv_mode(*acl, &mode);
++ if (error < 0)
++ return error;
++ if (error == 0)
++ *acl = NULL;
++ if (!in_group_p(inode->i_gid) &&
++ !capable_wrt_inode_uidgid(inode, CAP_FSETID))
++ mode &= ~S_ISGID;
++ *mode_p = mode;
++ return 0;
++}
++EXPORT_SYMBOL(posix_acl_update_mode);
++
+ /*
+ * Fix up the uids and gids in posix acl extended attributes in place.
+ */
+diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c
+index dbed42f..2737668 100644
+--- a/fs/reiserfs/xattr_acl.c
++++ b/fs/reiserfs/xattr_acl.c
+@@ -242,13 +242,9 @@ __reiserfs_set_acl(struct reiserfs_transaction_handle *th, struct inode *inode,
+ case ACL_TYPE_ACCESS:
+ name = XATTR_NAME_POSIX_ACL_ACCESS;
+ if (acl) {
+- error = posix_acl_equiv_mode(acl, &inode->i_mode);
+- if (error < 0)
++ error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
++ if (error)
+ return error;
+- else {
+- if (error == 0)
+- acl = NULL;
+- }
+ }
+ break;
+ case ACL_TYPE_DEFAULT:
+diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
+index b6e527b..8a0dec8 100644
+--- a/fs/xfs/xfs_acl.c
++++ b/fs/xfs/xfs_acl.c
+@@ -257,16 +257,11 @@ xfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+ return error;
+
+ if (type == ACL_TYPE_ACCESS) {
+- umode_t mode = inode->i_mode;
+- error = posix_acl_equiv_mode(acl, &mode);
+-
+- if (error <= 0) {
+- acl = NULL;
+-
+- if (error < 0)
+- return error;
+- }
++ umode_t mode;
+
++ error = posix_acl_update_mode(inode, &mode, &acl);
++ if (error)
++ return error;
+ error = xfs_set_mode(inode, mode);
+ if (error)
+ return error;
+diff --git a/include/drm/drmP.h b/include/drm/drmP.h
+index d377865..988903a 100644
+--- a/include/drm/drmP.h
++++ b/include/drm/drmP.h
+@@ -938,7 +938,8 @@ static inline int drm_debugfs_remove_files(const struct drm_info_list *files,
+ #endif
+
+ extern struct dma_buf *drm_gem_prime_export(struct drm_device *dev,
+- struct drm_gem_object *obj, int flags);
++ struct drm_gem_object *obj,
++ int flags);
+ extern int drm_gem_prime_handle_to_fd(struct drm_device *dev,
+ struct drm_file *file_priv, uint32_t handle, uint32_t flags,
+ int *prime_fd);
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index c26d463..fe99e6f 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -450,8 +450,8 @@ static inline pgoff_t basepage_index(struct page *page)
+ return __basepage_index(page);
+ }
+
+-extern void dissolve_free_huge_pages(unsigned long start_pfn,
+- unsigned long end_pfn);
++extern int dissolve_free_huge_pages(unsigned long start_pfn,
++ unsigned long end_pfn);
+ static inline bool hugepage_migration_supported(struct hstate *h)
+ {
+ #ifdef CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION
+@@ -518,7 +518,7 @@ static inline pgoff_t basepage_index(struct page *page)
+ {
+ return page->index;
+ }
+-#define dissolve_free_huge_pages(s, e) do {} while (0)
++#define dissolve_free_huge_pages(s, e) 0
+ #define hugepage_migration_supported(h) false
+
+ static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
+diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h
+index b519e13..bbfce62 100644
+--- a/include/linux/libnvdimm.h
++++ b/include/linux/libnvdimm.h
+@@ -129,6 +129,8 @@ static inline struct nd_blk_region_desc *to_blk_region_desc(
+ }
+
+ int nvdimm_bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length);
++void nvdimm_clear_from_poison_list(struct nvdimm_bus *nvdimm_bus,
++ phys_addr_t start, unsigned int len);
+ struct nvdimm_bus *nvdimm_bus_register(struct device *parent,
+ struct nvdimm_bus_descriptor *nfit_desc);
+ void nvdimm_bus_unregister(struct nvdimm_bus *nvdimm_bus);
+diff --git a/include/linux/posix_acl.h b/include/linux/posix_acl.h
+index d5d3d74..bf1046d 100644
+--- a/include/linux/posix_acl.h
++++ b/include/linux/posix_acl.h
+@@ -93,6 +93,7 @@ extern int set_posix_acl(struct inode *, int, struct posix_acl *);
+ extern int posix_acl_chmod(struct inode *, umode_t);
+ extern int posix_acl_create(struct inode *, umode_t *, struct posix_acl **,
+ struct posix_acl **);
++extern int posix_acl_update_mode(struct inode *, umode_t *, struct posix_acl **);
+
+ extern int simple_set_acl(struct inode *, struct posix_acl *, int);
+ extern int simple_acl_create(struct inode *, struct inode *);
+diff --git a/kernel/irq/generic-chip.c b/kernel/irq/generic-chip.c
+index abd286a..a4775f3 100644
+--- a/kernel/irq/generic-chip.c
++++ b/kernel/irq/generic-chip.c
+@@ -411,8 +411,29 @@ int irq_map_generic_chip(struct irq_domain *d, unsigned int virq,
+ }
+ EXPORT_SYMBOL_GPL(irq_map_generic_chip);
+
++static void irq_unmap_generic_chip(struct irq_domain *d, unsigned int virq)
++{
++ struct irq_data *data = irq_domain_get_irq_data(d, virq);
++ struct irq_domain_chip_generic *dgc = d->gc;
++ unsigned int hw_irq = data->hwirq;
++ struct irq_chip_generic *gc;
++ int irq_idx;
++
++ gc = irq_get_domain_generic_chip(d, hw_irq);
++ if (!gc)
++ return;
++
++ irq_idx = hw_irq % dgc->irqs_per_chip;
++
++ clear_bit(irq_idx, &gc->installed);
++ irq_domain_set_info(d, virq, hw_irq, &no_irq_chip, NULL, NULL, NULL,
++ NULL);
++
++}
++
+ struct irq_domain_ops irq_generic_chip_ops = {
+ .map = irq_map_generic_chip,
++ .unmap = irq_unmap_generic_chip,
+ .xlate = irq_domain_xlate_onetwocell,
+ };
+ EXPORT_SYMBOL_GPL(irq_generic_chip_ops);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 603bdd0..770d83e 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1437,22 +1437,32 @@ static int free_pool_huge_page(struct hstate *h, nodemask_t *nodes_allowed,
+
+ /*
+ * Dissolve a given free hugepage into free buddy pages. This function does
+- * nothing for in-use (including surplus) hugepages.
++ * nothing for in-use (including surplus) hugepages. Returns -EBUSY if the
++ * number of free hugepages would be reduced below the number of reserved
++ * hugepages.
+ */
+-static void dissolve_free_huge_page(struct page *page)
++static int dissolve_free_huge_page(struct page *page)
+ {
++ int rc = 0;
++
+ spin_lock(&hugetlb_lock);
+ if (PageHuge(page) && !page_count(page)) {
+ struct page *head = compound_head(page);
+ struct hstate *h = page_hstate(head);
+ int nid = page_to_nid(head);
++ if (h->free_huge_pages - h->resv_huge_pages == 0) {
++ rc = -EBUSY;
++ goto out;
++ }
+ list_del(&head->lru);
+ h->free_huge_pages--;
+ h->free_huge_pages_node[nid]--;
+ h->max_huge_pages--;
+ update_and_free_page(h, head);
+ }
++out:
+ spin_unlock(&hugetlb_lock);
++ return rc;
+ }
+
+ /*
+@@ -1460,16 +1470,28 @@ static void dissolve_free_huge_page(struct page *page)
+ * make specified memory blocks removable from the system.
+ * Note that this will dissolve a free gigantic hugepage completely, if any
+ * part of it lies within the given range.
++ * Also note that if dissolve_free_huge_page() returns with an error, all
++ * free hugepages that were dissolved before that error are lost.
+ */
+-void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
++int dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
+ {
+ unsigned long pfn;
++ struct page *page;
++ int rc = 0;
+
+ if (!hugepages_supported())
+- return;
++ return rc;
++
++ for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order) {
++ page = pfn_to_page(pfn);
++ if (PageHuge(page) && !page_count(page)) {
++ rc = dissolve_free_huge_page(page);
++ if (rc)
++ break;
++ }
++ }
+
+- for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order)
+- dissolve_free_huge_page(pfn_to_page(pfn));
++ return rc;
+ }
+
+ /*
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 9d29ba0..9629273 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -1945,7 +1945,9 @@ static int __ref __offline_pages(unsigned long start_pfn,
+ * dissolve free hugepages in the memory block before doing offlining
+ * actually in order to make hugetlbfs's object counting consistent.
+ */
+- dissolve_free_huge_pages(start_pfn, end_pfn);
++ ret = dissolve_free_huge_pages(start_pfn, end_pfn);
++ if (ret)
++ goto failed_removal;
+ /* check again */
+ offlined_pages = check_pages_isolated(start_pfn, end_pfn);
+ if (offlined_pages < 0) {
+diff --git a/sound/soc/intel/boards/bxt_da7219_max98357a.c b/sound/soc/intel/boards/bxt_da7219_max98357a.c
+index 3774b11..49b65d4 100644
+--- a/sound/soc/intel/boards/bxt_da7219_max98357a.c
++++ b/sound/soc/intel/boards/bxt_da7219_max98357a.c
+@@ -255,7 +255,7 @@ static struct snd_soc_ops broxton_da7219_ops = {
+ /* broxton digital audio interface glue - connects codec <--> CPU */
+ static struct snd_soc_dai_link broxton_dais[] = {
+ /* Front End DAI links */
+- [BXT_DPCM_AUDIO_PB]
++ [BXT_DPCM_AUDIO_PB] =
+ {
+ .name = "Bxt Audio Port",
+ .stream_name = "Audio",
+@@ -271,7 +271,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
+ .dpcm_playback = 1,
+ .ops = &broxton_da7219_fe_ops,
+ },
+- [BXT_DPCM_AUDIO_CP]
++ [BXT_DPCM_AUDIO_CP] =
+ {
+ .name = "Bxt Audio Capture Port",
+ .stream_name = "Audio Record",
+@@ -286,7 +286,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
+ .dpcm_capture = 1,
+ .ops = &broxton_da7219_fe_ops,
+ },
+- [BXT_DPCM_AUDIO_REF_CP]
++ [BXT_DPCM_AUDIO_REF_CP] =
+ {
+ .name = "Bxt Audio Reference cap",
+ .stream_name = "Refcap",
+@@ -300,7 +300,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
+ .nonatomic = 1,
+ .dynamic = 1,
+ },
+- [BXT_DPCM_AUDIO_HDMI1_PB]
++ [BXT_DPCM_AUDIO_HDMI1_PB] =
+ {
+ .name = "Bxt HDMI Port1",
+ .stream_name = "Hdmi1",
+@@ -313,7 +313,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
+ .nonatomic = 1,
+ .dynamic = 1,
+ },
+- [BXT_DPCM_AUDIO_HDMI2_PB]
++ [BXT_DPCM_AUDIO_HDMI2_PB] =
+ {
+ .name = "Bxt HDMI Port2",
+ .stream_name = "Hdmi2",
+@@ -326,7 +326,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
+ .nonatomic = 1,
+ .dynamic = 1,
+ },
+- [BXT_DPCM_AUDIO_HDMI3_PB]
++ [BXT_DPCM_AUDIO_HDMI3_PB] =
+ {
+ .name = "Bxt HDMI Port3",
+ .stream_name = "Hdmi3",
+diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c
+index 253d7bf..d610bdca 100644
+--- a/sound/soc/intel/boards/bxt_rt298.c
++++ b/sound/soc/intel/boards/bxt_rt298.c
+@@ -271,7 +271,7 @@ static const struct snd_soc_ops broxton_rt286_fe_ops = {
+ /* broxton digital audio interface glue - connects codec <--> CPU */
+ static struct snd_soc_dai_link broxton_rt298_dais[] = {
+ /* Front End DAI links */
+- [BXT_DPCM_AUDIO_PB]
++ [BXT_DPCM_AUDIO_PB] =
+ {
+ .name = "Bxt Audio Port",
+ .stream_name = "Audio",
+@@ -286,7 +286,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
+ .dpcm_playback = 1,
+ .ops = &broxton_rt286_fe_ops,
+ },
+- [BXT_DPCM_AUDIO_CP]
++ [BXT_DPCM_AUDIO_CP] =
+ {
+ .name = "Bxt Audio Capture Port",
+ .stream_name = "Audio Record",
+@@ -300,7 +300,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
+ .dpcm_capture = 1,
+ .ops = &broxton_rt286_fe_ops,
+ },
+- [BXT_DPCM_AUDIO_REF_CP]
++ [BXT_DPCM_AUDIO_REF_CP] =
+ {
+ .name = "Bxt Audio Reference cap",
+ .stream_name = "refcap",
+@@ -313,7 +313,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
+ .nonatomic = 1,
+ .dynamic = 1,
+ },
+- [BXT_DPCM_AUDIO_DMIC_CP]
++ [BXT_DPCM_AUDIO_DMIC_CP] =
+ {
+ .name = "Bxt Audio DMIC cap",
+ .stream_name = "dmiccap",
+@@ -327,7 +327,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
+ .dynamic = 1,
+ .ops = &broxton_dmic_ops,
+ },
+- [BXT_DPCM_AUDIO_HDMI1_PB]
++ [BXT_DPCM_AUDIO_HDMI1_PB] =
+ {
+ .name = "Bxt HDMI Port1",
+ .stream_name = "Hdmi1",
+@@ -340,7 +340,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
+ .nonatomic = 1,
+ .dynamic = 1,
+ },
+- [BXT_DPCM_AUDIO_HDMI2_PB]
++ [BXT_DPCM_AUDIO_HDMI2_PB] =
+ {
+ .name = "Bxt HDMI Port2",
+ .stream_name = "Hdmi2",
+@@ -353,7 +353,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
+ .nonatomic = 1,
+ .dynamic = 1,
+ },
+- [BXT_DPCM_AUDIO_HDMI3_PB]
++ [BXT_DPCM_AUDIO_HDMI3_PB] =
+ {
+ .name = "Bxt HDMI Port3",
+ .stream_name = "Hdmi3",
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index d908ff8..801082f 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -823,6 +823,7 @@ static int dapm_create_or_share_kcontrol(struct snd_soc_dapm_widget *w,
+ case snd_soc_dapm_switch:
+ case snd_soc_dapm_mixer:
+ case snd_soc_dapm_pga:
++ case snd_soc_dapm_out_drv:
+ wname_in_long_name = true;
+ kcname_in_long_name = true;
+ break;
+@@ -3049,6 +3050,9 @@ int snd_soc_dapm_get_volsw(struct snd_kcontrol *kcontrol,
+ }
+ mutex_unlock(&card->dapm_mutex);
+
++ if (ret)
++ return ret;
++
+ if (invert)
+ ucontrol->value.integer.value[0] = max - val;
+ else
+@@ -3200,7 +3204,7 @@ int snd_soc_dapm_put_enum_double(struct snd_kcontrol *kcontrol,
+ if (e->shift_l != e->shift_r) {
+ if (item[1] > e->items)
+ return -EINVAL;
+- val |= snd_soc_enum_item_to_val(e, item[1]) << e->shift_l;
++ val |= snd_soc_enum_item_to_val(e, item[1]) << e->shift_r;
+ mask |= e->mask << e->shift_r;
+ }
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index ee7f15a..3406907 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -1475,6 +1475,7 @@ static int soc_tplg_dapm_widget_create(struct soc_tplg *tplg,
+ if (widget == NULL) {
+ dev_err(tplg->dev, "ASoC: failed to create widget %s controls\n",
+ w->name);
++ ret = -ENOMEM;
+ goto hdr_err;
+ }
+
+diff --git a/tools/perf/perf-sys.h b/tools/perf/perf-sys.h
+index 7ed72a4..e4b717e 100644
+--- a/tools/perf/perf-sys.h
++++ b/tools/perf/perf-sys.h
+@@ -20,7 +20,6 @@
+ #endif
+
+ #ifdef __powerpc__
+-#include "../../arch/powerpc/include/uapi/asm/unistd.h"
+ #define CPUINFO_PROC {"cpu"}
+ #endif
+
+diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
+index 13d4143..7aee954 100644
+--- a/tools/perf/ui/browsers/hists.c
++++ b/tools/perf/ui/browsers/hists.c
+@@ -1091,7 +1091,6 @@ static int __hpp__slsmg_color_printf(struct perf_hpp *hpp, const char *fmt, ...)
+ ret = scnprintf(hpp->buf, hpp->size, fmt, len, percent);
+ ui_browser__printf(arg->b, "%s", hpp->buf);
+
+- advance_hpp(hpp, ret);
+ return ret;
+ }
+
+@@ -2046,6 +2045,7 @@ void hist_browser__init(struct hist_browser *browser,
+ struct hists *hists)
+ {
+ struct perf_hpp_fmt *fmt;
++ struct perf_hpp_list_node *node;
+
+ browser->hists = hists;
+ browser->b.refresh = hist_browser__refresh;
+@@ -2058,6 +2058,11 @@ void hist_browser__init(struct hist_browser *browser,
+ perf_hpp__reset_width(fmt, hists);
+ ++browser->b.columns;
+ }
++ /* hierarchy entries have their own hpp list */
++ list_for_each_entry(node, &hists->hpp_formats, list) {
++ perf_hpp_list__for_each_format(&node->hpp, fmt)
++ perf_hpp__reset_width(fmt, hists);
++ }
+ }
+
+ struct hist_browser *hist_browser__new(struct hists *hists)
+diff --git a/tools/perf/ui/stdio/hist.c b/tools/perf/ui/stdio/hist.c
+index f04a631..d0cae75 100644
+--- a/tools/perf/ui/stdio/hist.c
++++ b/tools/perf/ui/stdio/hist.c
+@@ -628,14 +628,6 @@ hists__fprintf_hierarchy_headers(struct hists *hists,
+ struct perf_hpp *hpp,
+ FILE *fp)
+ {
+- struct perf_hpp_list_node *fmt_node;
+- struct perf_hpp_fmt *fmt;
+-
+- list_for_each_entry(fmt_node, &hists->hpp_formats, list) {
+- perf_hpp_list__for_each_format(&fmt_node->hpp, fmt)
+- perf_hpp__reset_width(fmt, hists);
+- }
+-
+ return print_hierarchy_header(hists, hpp, symbol_conf.field_sep, fp);
+ }
+
+@@ -714,6 +706,7 @@ size_t hists__fprintf(struct hists *hists, bool show_header, int max_rows,
+ bool use_callchain)
+ {
+ struct perf_hpp_fmt *fmt;
++ struct perf_hpp_list_node *node;
+ struct rb_node *nd;
+ size_t ret = 0;
+ const char *sep = symbol_conf.field_sep;
+@@ -726,6 +719,11 @@ size_t hists__fprintf(struct hists *hists, bool show_header, int max_rows,
+
+ hists__for_each_format(hists, fmt)
+ perf_hpp__reset_width(fmt, hists);
++ /* hierarchy entries have their own hpp list */
++ list_for_each_entry(node, &hists->hpp_formats, list) {
++ perf_hpp_list__for_each_format(&node->hpp, fmt)
++ perf_hpp__reset_width(fmt, hists);
++ }
+
+ if (symbol_conf.col_width_list_str)
+ perf_hpp__set_user_width(symbol_conf.col_width_list_str);
+diff --git a/tools/perf/util/data-convert-bt.c b/tools/perf/util/data-convert-bt.c
+index 4f979bb..7123f4d 100644
+--- a/tools/perf/util/data-convert-bt.c
++++ b/tools/perf/util/data-convert-bt.c
+@@ -437,7 +437,7 @@ add_bpf_output_values(struct bt_ctf_event_class *event_class,
+ int ret;
+
+ if (nr_elements * sizeof(u32) != raw_size)
+- pr_warning("Incorrect raw_size (%u) in bpf output event, skip %lu bytes\n",
++ pr_warning("Incorrect raw_size (%u) in bpf output event, skip %zu bytes\n",
+ raw_size, nr_elements * sizeof(u32) - raw_size);
+
+ len_type = bt_ctf_event_class_get_field_by_name(event_class, "raw_len");
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index a811c13..f77b316 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -1113,9 +1113,8 @@ int dso__load_sym(struct dso *dso, struct map *map,
+ * For misannotated, zeroed, ASM function sizes.
+ */
+ if (nr > 0) {
+- if (!symbol_conf.allow_aliases)
+- symbols__fixup_duplicate(&dso->symbols[map->type]);
+ symbols__fixup_end(&dso->symbols[map->type]);
++ symbols__fixup_duplicate(&dso->symbols[map->type]);
+ if (kmap) {
+ /*
+ * We need to fixup this here too because we create new
+diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
+index 37e8d20..f29f336 100644
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -152,6 +152,9 @@ void symbols__fixup_duplicate(struct rb_root *symbols)
+ struct rb_node *nd;
+ struct symbol *curr, *next;
+
++ if (symbol_conf.allow_aliases)
++ return;
++
+ nd = rb_first(symbols);
+
+ while (nd) {
+@@ -1234,8 +1237,8 @@ int __dso__load_kallsyms(struct dso *dso, const char *filename,
+ if (kallsyms__delta(map, filename, &delta))
+ return -1;
+
+- symbols__fixup_duplicate(&dso->symbols[map->type]);
+ symbols__fixup_end(&dso->symbols[map->type]);
++ symbols__fixup_duplicate(&dso->symbols[map->type]);
+
+ if (dso->kernel == DSO_TYPE_GUEST_KERNEL)
+ dso->symtab_type = DSO_BINARY_TYPE__GUEST_KALLSYMS;
diff --git a/4.7.10/4420_grsecurity-3.1-4.7.10-201611011946.patch b/4.8.6/4420_grsecurity-3.1-4.8.6-201611091800.patch
index 15bb765..3336ca8 100644
--- a/4.7.10/4420_grsecurity-3.1-4.7.10-201611011946.patch
+++ b/4.8.6/4420_grsecurity-3.1-4.8.6-201611091800.patch
@@ -1,24 +1,8 @@
-diff --git a/.gitignore b/.gitignore
-index 0c320bf..2be25f7 100644
---- a/.gitignore
-+++ b/.gitignore
-@@ -37,6 +37,7 @@ modules.builtin
- Module.symvers
- *.dwo
- *.su
-+*.c.[012]*.*
-
- #
- # Top-level generic files
diff --git a/Documentation/dontdiff b/Documentation/dontdiff
-index 8ea834f..1855a02 100644
+index 5385cba..607c6a0 100644
--- a/Documentation/dontdiff
+++ b/Documentation/dontdiff
-@@ -3,9 +3,11 @@
- *.bc
- *.bin
- *.bz2
-+*.c.[012]*.*
+@@ -7,6 +7,7 @@
*.cis
*.cpio
*.csp
@@ -26,7 +10,7 @@ index 8ea834f..1855a02 100644
*.dsp
*.dvi
*.elf
-@@ -15,6 +17,7 @@
+@@ -16,6 +17,7 @@
*.gcov
*.gen.S
*.gif
@@ -34,7 +18,7 @@ index 8ea834f..1855a02 100644
*.grep
*.grp
*.gz
-@@ -51,14 +54,17 @@
+@@ -52,14 +54,17 @@
*.tab.h
*.tex
*.ver
@@ -53,7 +37,7 @@ index 8ea834f..1855a02 100644
.*.d
.mm
53c700_d.h
-@@ -72,9 +78,11 @@ Image
+@@ -73,9 +78,11 @@ Image
Module.markers
Module.symvers
PENDING
@@ -65,7 +49,7 @@ index 8ea834f..1855a02 100644
aconf
af_names.h
aic7*reg.h*
-@@ -83,6 +91,7 @@ aic7*seq.h*
+@@ -84,6 +91,7 @@ aic7*seq.h*
aicasm
aicdb.h*
altivec*.c
@@ -73,7 +57,7 @@ index 8ea834f..1855a02 100644
asm-offsets.h
asm_offsets.h
autoconf.h*
-@@ -95,32 +104,40 @@ bounds.h
+@@ -96,11 +104,14 @@ bounds.h
bsetup
btfixupprep
build
@@ -88,10 +72,8 @@ index 8ea834f..1855a02 100644
comp*.log
compile.h*
conf
- config
- config-*
+@@ -109,19 +120,23 @@ config-*
config_data.h*
-+config.c
config.mak
config.mak.autogen
+config.tmp
@@ -114,7 +96,7 @@ index 8ea834f..1855a02 100644
fixdep
flask.h
fore200e_mkfirm
-@@ -128,12 +145,15 @@ fore200e_pca_fw.c*
+@@ -129,12 +144,15 @@ fore200e_pca_fw.c*
gconf
gconf.glade.h
gen-devlist
@@ -130,7 +112,7 @@ index 8ea834f..1855a02 100644
hpet_example
hugepage-mmap
hugepage-shm
-@@ -148,14 +168,14 @@ int32.c
+@@ -149,14 +167,14 @@ int32.c
int4.c
int8.c
kallsyms
@@ -147,7 +129,7 @@ index 8ea834f..1855a02 100644
logo_*.c
logo_*_clut224.c
logo_*_mono.c
-@@ -166,12 +186,14 @@ machtypes.h
+@@ -167,12 +185,14 @@ machtypes.h
map
map_hugetlb
mconf
@@ -162,7 +144,7 @@ index 8ea834f..1855a02 100644
mkprep
mkregtable
mktables
-@@ -187,6 +209,8 @@ oui.c*
+@@ -188,6 +208,8 @@ oui.c*
page-types
parse.c
parse.h
@@ -171,7 +153,7 @@ index 8ea834f..1855a02 100644
patches*
pca200e.bin
pca200e_ecd.bin2
-@@ -196,6 +220,7 @@ perf-archive
+@@ -197,6 +219,7 @@ perf-archive
piggyback
piggy.gzip
piggy.S
@@ -179,7 +161,7 @@ index 8ea834f..1855a02 100644
pnmtologo
ppc_defs.h*
pss_boot.h
-@@ -205,7 +230,12 @@ r200_reg_safe.h
+@@ -206,7 +229,12 @@ r200_reg_safe.h
r300_reg_safe.h
r420_reg_safe.h
r600_reg_safe.h
@@ -192,7 +174,7 @@ index 8ea834f..1855a02 100644
relocs
rlim_names.h
rn50_reg_safe.h
-@@ -215,8 +245,17 @@ series
+@@ -216,8 +244,17 @@ series
setup
setup.bin
setup.elf
@@ -210,7 +192,7 @@ index 8ea834f..1855a02 100644
split-include
syscalltab.h
tables.c
-@@ -226,6 +265,7 @@ tftpboot.img
+@@ -227,6 +264,7 @@ tftpboot.img
timeconst.h
times.h*
trix_boot.h
@@ -218,7 +200,7 @@ index 8ea834f..1855a02 100644
utsrelease.h*
vdso-syms.lds
vdso.lds
-@@ -237,13 +277,17 @@ vdso32.lds
+@@ -238,13 +276,17 @@ vdso32.lds
vdso32.so.dbg
vdso64.lds
vdso64.so.dbg
@@ -236,7 +218,7 @@ index 8ea834f..1855a02 100644
vmlinuz
voffset.h
vsyscall.lds
-@@ -251,9 +295,12 @@ vsyscall_32.lds
+@@ -252,9 +294,12 @@ vsyscall_32.lds
wanxlfw.inc
uImage
unifdef
@@ -250,7 +232,7 @@ index 8ea834f..1855a02 100644
+zconf.lex.c
zoffset.h
diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
-index 13f888a..250729b 100644
+index 385a5ef..51d7fba 100644
--- a/Documentation/kbuild/makefiles.txt
+++ b/Documentation/kbuild/makefiles.txt
@@ -23,10 +23,11 @@ This document describes the Linux kernel Makefiles.
@@ -269,7 +251,7 @@ index 13f888a..250729b 100644
=== 5 Kbuild clean infrastructure
-@@ -643,7 +644,29 @@ Both possibilities are described in the following.
+@@ -644,7 +645,29 @@ Both possibilities are described in the following.
Finally, the two .o files are linked to the executable, lxdialog.
Note: The syntax <executable>-y is not permitted for host-programs.
@@ -300,7 +282,7 @@ index 13f888a..250729b 100644
kbuild offers support for host programs written in C++. This was
introduced solely to support kconfig, and is not recommended
-@@ -666,7 +689,7 @@ Both possibilities are described in the following.
+@@ -667,7 +690,7 @@ Both possibilities are described in the following.
qconf-cxxobjs := qconf.o
qconf-objs := check.o
@@ -309,7 +291,7 @@ index 13f888a..250729b 100644
When compiling host programs, it is possible to set specific flags.
The programs will always be compiled utilising $(HOSTCC) passed
-@@ -694,7 +717,7 @@ Both possibilities are described in the following.
+@@ -695,7 +718,7 @@ Both possibilities are described in the following.
When linking qconf, it will be passed the extra option
"-L$(QTDIR)/lib".
@@ -318,7 +300,7 @@ index 13f888a..250729b 100644
Kbuild will only build host-programs when they are referenced
as a prerequisite.
-@@ -725,7 +748,7 @@ Both possibilities are described in the following.
+@@ -726,7 +749,7 @@ Both possibilities are described in the following.
This will tell kbuild to build lxdialog even if not referenced in
any rule.
@@ -328,10 +310,10 @@ index 13f888a..250729b 100644
A typical pattern in a Kbuild file looks like this:
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index 82b42c9..7151845 100644
+index 46726d4..36138ff 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
-@@ -1341,6 +1341,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+@@ -1368,6 +1368,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
[KNL] Should the hard-lockup detector generate
backtraces on all cpus.
Format: <integer>
@@ -344,7 +326,7 @@ index 82b42c9..7151845 100644
hashdist= [KNL,NUMA] Large hashes allocated during boot
are distributed across NUMA nodes. Defaults on
-@@ -2556,6 +2562,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+@@ -2591,6 +2597,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
noexec=on: enable non-executable mappings (default)
noexec=off: disable non-executable mappings
@@ -355,7 +337,7 @@ index 82b42c9..7151845 100644
nosmap [X86]
Disable SMAP (Supervisor Mode Access Prevention)
even if it is supported by processor.
-@@ -2862,6 +2872,35 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+@@ -2895,6 +2905,35 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
the specified number of seconds. This is to be used if
your oopses keep scrolling off the screen.
@@ -392,7 +374,7 @@ index 82b42c9..7151845 100644
pcd. [PARIDE]
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
-index a3683ce..5ec8bf4 100644
+index ffab8b5..b8fcd61 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -42,6 +42,7 @@ show up in /proc/sys/kernel:
@@ -403,7 +385,7 @@ index a3683ce..5ec8bf4 100644
- modprobe ==> Documentation/debugging-modules.txt
- modules_disabled
- msg_next_id [ sysv ipc ]
-@@ -408,6 +409,20 @@ This flag controls the L2 cache of G3 processor boards. If
+@@ -409,6 +410,20 @@ This flag controls the L2 cache of G3 processor boards. If
==============================================================
@@ -425,7 +407,7 @@ index a3683ce..5ec8bf4 100644
A toggle value indicating if modules are allowed to be loaded
diff --git a/Makefile b/Makefile
-index 219ab6d..79d7414 100644
+index b249529..d525945 100644
--- a/Makefile
+++ b/Makefile
@@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -439,25 +421,16 @@ index 219ab6d..79d7414 100644
ifeq ($(shell $(HOSTCC) -v 2>&1 | grep -c "clang version"), 1)
HOSTCFLAGS += -Wno-unused-value -Wno-unused-parameter \
-@@ -554,7 +556,7 @@ ifeq ($(KBUILD_EXTMOD),)
- # in parallel
- PHONY += scripts
- scripts: scripts_basic include/config/auto.conf include/config/tristate.conf \
-- asm-generic
-+ asm-generic gcc-plugins
- $(Q)$(MAKE) $(build)=$(@)
-
- # Objects we will link into vmlinux / subdirs we need to visit
-@@ -634,6 +636,8 @@ endif
- # Tell gcc to never replace conditional load with a non-conditional one
- KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0)
-
-+include scripts/Makefile.gcc-plugins
-+
- ifdef CONFIG_READABLE_ASM
- # Disable optimizations that make assembler listings hard to read.
- # reorder blocks reorders the control in the function
-@@ -735,7 +739,7 @@ KBUILD_CFLAGS += $(call cc-option, -gsplit-dwarf, -g)
+@@ -621,6 +623,8 @@ include arch/$(SRCARCH)/Makefile
+
+ KBUILD_CFLAGS += $(call cc-option,-fno-delete-null-pointer-checks,)
+ KBUILD_CFLAGS += $(call cc-disable-warning,maybe-uninitialized,)
++KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
++KBUILD_AFLAGS += $(call cc-option,-fno-PIE)
+
+ ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+ KBUILD_CFLAGS += -Os
+@@ -715,7 +719,7 @@ KBUILD_CFLAGS += $(call cc-option, -gsplit-dwarf, -g)
else
KBUILD_CFLAGS += -g
endif
@@ -466,7 +439,7 @@ index 219ab6d..79d7414 100644
endif
ifdef CONFIG_DEBUG_INFO_DWARF4
KBUILD_CFLAGS += $(call cc-option, -gdwarf-4,)
-@@ -910,7 +914,7 @@ export mod_sign_cmd
+@@ -890,7 +894,7 @@ export mod_sign_cmd
ifeq ($(KBUILD_EXTMOD),)
@@ -475,16 +448,7 @@ index 219ab6d..79d7414 100644
vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
$(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-@@ -1029,7 +1033,7 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
-
- archprepare: archheaders archscripts prepare1 scripts_basic
-
--prepare0: archprepare
-+prepare0: archprepare gcc-plugins
- $(Q)$(MAKE) $(build)=.
-
- # All the preparing..
-@@ -1248,7 +1252,10 @@ MRPROPER_FILES += .config .config.old .version .old_version \
+@@ -1256,7 +1260,10 @@ MRPROPER_FILES += .config .config.old .version .old_version \
Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS \
signing_key.pem signing_key.priv signing_key.x509 \
x509.genkey extra_certificates signing_key.x509.keyid \
@@ -496,7 +460,7 @@ index 219ab6d..79d7414 100644
# clean - Delete most, but leave enough to build external modules
#
-@@ -1287,7 +1294,7 @@ distclean: mrproper
+@@ -1295,7 +1302,7 @@ distclean: mrproper
@find $(srctree) $(RCS_FIND_IGNORE) \
\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
@@ -505,44 +469,24 @@ index 219ab6d..79d7414 100644
-type f -print | xargs rm -f
-@@ -1510,6 +1517,7 @@ clean: $(clean-dirs)
- -o -name '.*.d' -o -name '.*.tmp' -o -name '*.mod.c' \
- -o -name '*.symtypes' -o -name 'modules.order' \
- -o -name modules.builtin -o -name '.tmp_*.o.*' \
-+ -o -name '*.c.[012]*.*' \
- -o -name '*.gcno' \) -type f -print | xargs rm -f
-
- # Generate tags for editors
diff --git a/arch/Kconfig b/arch/Kconfig
-index 1599629..1ef557b 100644
+index fd6e971..35d7bbf 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
-@@ -357,6 +357,20 @@ config SECCOMP_FILTER
-
- See Documentation/prctl/seccomp_filter.txt for details.
-
-+config HAVE_GCC_PLUGINS
-+ bool
-+ help
-+ An arch should select this symbol if it supports building with
-+ GCC plugins.
-+
-+menuconfig GCC_PLUGINS
-+ bool "GCC plugins"
-+ depends on HAVE_GCC_PLUGINS
+@@ -355,7 +355,7 @@ config HAVE_GCC_PLUGINS
+ menuconfig GCC_PLUGINS
+ bool "GCC plugins"
+ depends on HAVE_GCC_PLUGINS
+- depends on !COMPILE_TEST
+ default y
-+ help
-+ GCC plugins are loadable modules that provide extra features to the
-+ compiler. They are useful for runtime instrumentation and static analysis.
-+
- config HAVE_CC_STACKPROTECTOR
- bool
help
+ GCC plugins are loadable modules that provide extra features to the
+ compiler. They are useful for runtime instrumentation and static analysis.
diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
-index 572b228..e03acdd 100644
+index 498933a..78d2b22 100644
--- a/arch/alpha/include/asm/atomic.h
+++ b/arch/alpha/include/asm/atomic.h
-@@ -251,4 +251,14 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
+@@ -308,4 +308,14 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
#define atomic_dec(v) atomic_sub(1,(v))
#define atomic64_dec(v) atomic64_sub(1,(v))
@@ -709,7 +653,7 @@ index ffb93f49..ced8233 100644
return addr;
}
diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
-index 4a905bd..0a4da53 100644
+index 83e9eee..db02682 100644
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -52,6 +52,124 @@ __load_new_mm_context(struct mm_struct *next_mm)
@@ -881,18 +825,10 @@ index 0d3e59f..4418d65 100644
Counts number of I and D TLB Misses and exports them via Debugfs
The counters can be cleared via Debugfs as well
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
-index 90542db..769febf 100644
+index a9c4e48..75bc9c9 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
-@@ -54,6 +54,7 @@ config ARM
- select HAVE_FTRACE_MCOUNT_RECORD if (!XIP_KERNEL)
- select HAVE_FUNCTION_GRAPH_TRACER if (!THUMB2_KERNEL)
- select HAVE_FUNCTION_TRACER if (!XIP_KERNEL)
-+ select HAVE_GCC_PLUGINS
- select HAVE_GENERIC_DMA_COHERENT
- select HAVE_HW_BREAKPOINT if (PERF_EVENTS && (CPU_V6 || CPU_V6K || CPU_V7))
- select HAVE_IDE if PCI || ISA || PCMCIA
-@@ -1581,6 +1582,7 @@ config AEABI
+@@ -1621,6 +1621,7 @@ config AEABI
config OABI_COMPAT
bool "Allow old ABI binaries to run with this kernel (EXPERIMENTAL)"
depends on AEABI && !THUMB2_KERNEL
@@ -900,7 +836,7 @@ index 90542db..769febf 100644
help
This option preserves the old syscall interface along with the
new (ARM EABI) one. It also provides a compatibility layer to
-@@ -1649,6 +1651,7 @@ config HIGHPTE
+@@ -1689,6 +1690,7 @@ config HIGHPTE
config CPU_SW_DOMAIN_PAN
bool "Enable use of CPU domains to implement privileged no-access"
depends on MMU && !ARM_LPAE
@@ -908,7 +844,7 @@ index 90542db..769febf 100644
default y
help
Increase kernel security by ensuring that normal kernel accesses
-@@ -1725,7 +1728,7 @@ config ALIGNMENT_TRAP
+@@ -1765,7 +1767,7 @@ config ALIGNMENT_TRAP
config UACCESS_WITH_MEMCPY
bool "Use kernel mem{cpy,set}() for {copy_to,clear}_user()"
@@ -917,7 +853,7 @@ index 90542db..769febf 100644
default y if CPU_FEROCEON
help
Implement faster copy_to_user and clear_user methods for CPU
-@@ -1980,6 +1983,7 @@ config KEXEC
+@@ -2020,6 +2022,7 @@ config KEXEC
depends on (!SMP || PM_SLEEP_SMP)
depends on !CPU_V7M
select KEXEC_CORE
@@ -925,7 +861,7 @@ index 90542db..769febf 100644
help
kexec is a system call that implements the ability to shutdown your
current kernel, and to start another kernel. It is like a reboot
-@@ -2024,7 +2028,7 @@ config EFI_STUB
+@@ -2064,7 +2067,7 @@ config EFI_STUB
config EFI
bool "UEFI runtime support"
@@ -935,7 +871,7 @@ index 90542db..769febf 100644
select EFI_PARAMS_FROM_FDT
select EFI_STUB
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
-index 19a3dcf..4a81b0e 100644
+index a9693b6..87d8936 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -7,6 +7,7 @@ config ARM_PTDUMP
@@ -959,8 +895,236 @@ index d50430c..01cc53b 100644
# -fstack-protector-strong triggers protection checks in this code,
# but it is being used too early to link to meaningful stack_chk logic.
nossp_flags := $(call cc-option, -fno-stack-protector)
+diff --git a/arch/arm/crypto/sha1_glue.c b/arch/arm/crypto/sha1_glue.c
+index 6fc73bf..d0af3c7b 100644
+--- a/arch/arm/crypto/sha1_glue.c
++++ b/arch/arm/crypto/sha1_glue.c
+@@ -27,8 +27,8 @@
+
+ #include "sha1.h"
+
+-asmlinkage void sha1_block_data_order(u32 *digest,
+- const unsigned char *data, unsigned int rounds);
++asmlinkage void sha1_block_data_order(struct sha1_state *digest,
++ const u8 *data, int rounds);
+
+ int sha1_update_arm(struct shash_desc *desc, const u8 *data,
+ unsigned int len)
+@@ -36,22 +36,20 @@ int sha1_update_arm(struct shash_desc *desc, const u8 *data,
+ /* make sure casting to sha1_block_fn() is safe */
+ BUILD_BUG_ON(offsetof(struct sha1_state, state) != 0);
+
+- return sha1_base_do_update(desc, data, len,
+- (sha1_block_fn *)sha1_block_data_order);
++ return sha1_base_do_update(desc, data, len, sha1_block_data_order);
+ }
+ EXPORT_SYMBOL_GPL(sha1_update_arm);
+
+ static int sha1_final(struct shash_desc *desc, u8 *out)
+ {
+- sha1_base_do_finalize(desc, (sha1_block_fn *)sha1_block_data_order);
++ sha1_base_do_finalize(desc, sha1_block_data_order);
+ return sha1_base_finish(desc, out);
+ }
+
+ int sha1_finup_arm(struct shash_desc *desc, const u8 *data,
+ unsigned int len, u8 *out)
+ {
+- sha1_base_do_update(desc, data, len,
+- (sha1_block_fn *)sha1_block_data_order);
++ sha1_base_do_update(desc, data, len, sha1_block_data_order);
+ return sha1_final(desc, out);
+ }
+ EXPORT_SYMBOL_GPL(sha1_finup_arm);
+diff --git a/arch/arm/crypto/sha1_neon_glue.c b/arch/arm/crypto/sha1_neon_glue.c
+index 4e22f12..49902aa 100644
+--- a/arch/arm/crypto/sha1_neon_glue.c
++++ b/arch/arm/crypto/sha1_neon_glue.c
+@@ -31,8 +31,8 @@
+
+ #include "sha1.h"
+
+-asmlinkage void sha1_transform_neon(void *state_h, const char *data,
+- unsigned int rounds);
++asmlinkage void sha1_transform_neon(struct sha1_state *state_h, const u8 *data,
++ int rounds);
+
+ static int sha1_neon_update(struct shash_desc *desc, const u8 *data,
+ unsigned int len)
+@@ -45,7 +45,7 @@ static int sha1_neon_update(struct shash_desc *desc, const u8 *data,
+
+ kernel_neon_begin();
+ sha1_base_do_update(desc, data, len,
+- (sha1_block_fn *)sha1_transform_neon);
++ sha1_transform_neon);
+ kernel_neon_end();
+
+ return 0;
+@@ -60,8 +60,8 @@ static int sha1_neon_finup(struct shash_desc *desc, const u8 *data,
+ kernel_neon_begin();
+ if (len)
+ sha1_base_do_update(desc, data, len,
+- (sha1_block_fn *)sha1_transform_neon);
+- sha1_base_do_finalize(desc, (sha1_block_fn *)sha1_transform_neon);
++ sha1_transform_neon);
++ sha1_base_do_finalize(desc, sha1_transform_neon);
+ kernel_neon_end();
+
+ return sha1_base_finish(desc, out);
+diff --git a/arch/arm/crypto/sha256_glue.c b/arch/arm/crypto/sha256_glue.c
+index a84e869..53a0c61 100644
+--- a/arch/arm/crypto/sha256_glue.c
++++ b/arch/arm/crypto/sha256_glue.c
+@@ -30,8 +30,8 @@
+
+ #include "sha256_glue.h"
+
+-asmlinkage void sha256_block_data_order(u32 *digest, const void *data,
+- unsigned int num_blks);
++asmlinkage void sha256_block_data_order(struct sha256_state *digest, const u8 *data,
++ int num_blks);
+
+ int crypto_sha256_arm_update(struct shash_desc *desc, const u8 *data,
+ unsigned int len)
+@@ -39,23 +39,20 @@ int crypto_sha256_arm_update(struct shash_desc *desc, const u8 *data,
+ /* make sure casting to sha256_block_fn() is safe */
+ BUILD_BUG_ON(offsetof(struct sha256_state, state) != 0);
+
+- return sha256_base_do_update(desc, data, len,
+- (sha256_block_fn *)sha256_block_data_order);
++ return sha256_base_do_update(desc, data, len, sha256_block_data_order);
+ }
+ EXPORT_SYMBOL(crypto_sha256_arm_update);
+
+ static int sha256_final(struct shash_desc *desc, u8 *out)
+ {
+- sha256_base_do_finalize(desc,
+- (sha256_block_fn *)sha256_block_data_order);
++ sha256_base_do_finalize(desc, sha256_block_data_order);
+ return sha256_base_finish(desc, out);
+ }
+
+ int crypto_sha256_arm_finup(struct shash_desc *desc, const u8 *data,
+ unsigned int len, u8 *out)
+ {
+- sha256_base_do_update(desc, data, len,
+- (sha256_block_fn *)sha256_block_data_order);
++ sha256_base_do_update(desc, data, len, sha256_block_data_order);
+ return sha256_final(desc, out);
+ }
+ EXPORT_SYMBOL(crypto_sha256_arm_finup);
+diff --git a/arch/arm/crypto/sha256_neon_glue.c b/arch/arm/crypto/sha256_neon_glue.c
+index 39ccd65..f9511cb 100644
+--- a/arch/arm/crypto/sha256_neon_glue.c
++++ b/arch/arm/crypto/sha256_neon_glue.c
+@@ -26,8 +26,8 @@
+
+ #include "sha256_glue.h"
+
+-asmlinkage void sha256_block_data_order_neon(u32 *digest, const void *data,
+- unsigned int num_blks);
++asmlinkage void sha256_block_data_order_neon(struct sha256_state *digest, const u8 *data,
++ int num_blks);
+
+ static int sha256_update(struct shash_desc *desc, const u8 *data,
+ unsigned int len)
+@@ -39,8 +39,7 @@ static int sha256_update(struct shash_desc *desc, const u8 *data,
+ return crypto_sha256_arm_update(desc, data, len);
+
+ kernel_neon_begin();
+- sha256_base_do_update(desc, data, len,
+- (sha256_block_fn *)sha256_block_data_order_neon);
++ sha256_base_do_update(desc, data, len, sha256_block_data_order_neon);
+ kernel_neon_end();
+
+ return 0;
+@@ -54,10 +53,8 @@ static int sha256_finup(struct shash_desc *desc, const u8 *data,
+
+ kernel_neon_begin();
+ if (len)
+- sha256_base_do_update(desc, data, len,
+- (sha256_block_fn *)sha256_block_data_order_neon);
+- sha256_base_do_finalize(desc,
+- (sha256_block_fn *)sha256_block_data_order_neon);
++ sha256_base_do_update(desc, data, len, sha256_block_data_order_neon);
++ sha256_base_do_finalize(desc, sha256_block_data_order_neon);
+ kernel_neon_end();
+
+ return sha256_base_finish(desc, out);
+diff --git a/arch/arm/crypto/sha512-glue.c b/arch/arm/crypto/sha512-glue.c
+index 269a394..c7a91f1 100644
+--- a/arch/arm/crypto/sha512-glue.c
++++ b/arch/arm/crypto/sha512-glue.c
+@@ -28,27 +28,24 @@ MODULE_ALIAS_CRYPTO("sha512");
+ MODULE_ALIAS_CRYPTO("sha384-arm");
+ MODULE_ALIAS_CRYPTO("sha512-arm");
+
+-asmlinkage void sha512_block_data_order(u64 *state, u8 const *src, int blocks);
++asmlinkage void sha512_block_data_order(struct sha512_state *state, u8 const *src, int blocks);
+
+ int sha512_arm_update(struct shash_desc *desc, const u8 *data,
+ unsigned int len)
+ {
+- return sha512_base_do_update(desc, data, len,
+- (sha512_block_fn *)sha512_block_data_order);
++ return sha512_base_do_update(desc, data, len, sha512_block_data_order);
+ }
+
+ int sha512_arm_final(struct shash_desc *desc, u8 *out)
+ {
+- sha512_base_do_finalize(desc,
+- (sha512_block_fn *)sha512_block_data_order);
++ sha512_base_do_finalize(desc, sha512_block_data_order);
+ return sha512_base_finish(desc, out);
+ }
+
+ int sha512_arm_finup(struct shash_desc *desc, const u8 *data,
+ unsigned int len, u8 *out)
+ {
+- sha512_base_do_update(desc, data, len,
+- (sha512_block_fn *)sha512_block_data_order);
++ sha512_base_do_update(desc, data, len, sha512_block_data_order);
+ return sha512_arm_final(desc, out);
+ }
+
+diff --git a/arch/arm/crypto/sha512-neon-glue.c b/arch/arm/crypto/sha512-neon-glue.c
+index 3269368..9fcbc00 100644
+--- a/arch/arm/crypto/sha512-neon-glue.c
++++ b/arch/arm/crypto/sha512-neon-glue.c
+@@ -22,7 +22,7 @@
+ MODULE_ALIAS_CRYPTO("sha384-neon");
+ MODULE_ALIAS_CRYPTO("sha512-neon");
+
+-asmlinkage void sha512_block_data_order_neon(u64 *state, u8 const *src,
++asmlinkage void sha512_block_data_order_neon(struct sha512_state *state, u8 const *src,
+ int blocks);
+
+ static int sha512_neon_update(struct shash_desc *desc, const u8 *data,
+@@ -35,8 +35,7 @@ static int sha512_neon_update(struct shash_desc *desc, const u8 *data,
+ return sha512_arm_update(desc, data, len);
+
+ kernel_neon_begin();
+- sha512_base_do_update(desc, data, len,
+- (sha512_block_fn *)sha512_block_data_order_neon);
++ sha512_base_do_update(desc, data, len, sha512_block_data_order_neon);
+ kernel_neon_end();
+
+ return 0;
+@@ -50,10 +49,8 @@ static int sha512_neon_finup(struct shash_desc *desc, const u8 *data,
+
+ kernel_neon_begin();
+ if (len)
+- sha512_base_do_update(desc, data, len,
+- (sha512_block_fn *)sha512_block_data_order_neon);
+- sha512_base_do_finalize(desc,
+- (sha512_block_fn *)sha512_block_data_order_neon);
++ sha512_base_do_update(desc, data, len, sha512_block_data_order_neon);
++ sha512_base_do_finalize(desc, sha512_block_data_order_neon);
+ kernel_neon_end();
+
+ return sha512_base_finish(desc, out);
diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
-index 9e10c45..e4cd000 100644
+index 66d0e21..8fa3237 100644
--- a/arch/arm/include/asm/atomic.h
+++ b/arch/arm/include/asm/atomic.h
@@ -18,17 +18,41 @@
@@ -1005,7 +1169,7 @@ index 9e10c45..e4cd000 100644
#if __LINUX_ARM_ARCH__ >= 6
-@@ -38,38 +62,64 @@
+@@ -38,45 +62,74 @@
* to ensure that the update happens.
*/
@@ -1018,7 +1182,7 @@ index 9e10c45..e4cd000 100644
+ "3:\n"
+#define __OVERFLOW_POST_RETURN \
+ " bvc 3f\n" \
-+ " mov %0, %1\n" \
++ " mov %1, %0\n" \
+ "2: " REFCOUNT_TRAP_INSN "\n"\
+ "3:\n"
+#define __OVERFLOW_EXTABLE \
@@ -1030,7 +1194,7 @@ index 9e10c45..e4cd000 100644
+#define __OVERFLOW_EXTABLE
+#endif
+
-+#define __ATOMIC_OP(op, suffix, c_op, asm_op, post_op, extable) \
++#define __ATOMIC_OP(op, suffix, c_op, asm_op) \
+static inline void atomic_##op##suffix(int i, atomic##suffix##_t *v) \
{ \
unsigned long tmp; \
@@ -1041,12 +1205,12 @@ index 9e10c45..e4cd000 100644
+ __asm__ __volatile__("@ atomic_" #op #suffix "\n" \
"1: ldrex %0, [%3]\n" \
" " #asm_op " %0, %0, %4\n" \
-+ post_op \
++ __OVERFLOW_POST \
" strex %1, %0, [%3]\n" \
" teq %1, #0\n" \
-" bne 1b" \
+" bne 1b\n" \
-+ extable \
++ __OVERFLOW_EXTABLE \
: "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) \
: "r" (&v->counter), "Ir" (i) \
: "cc"); \
@@ -1054,13 +1218,14 @@ index 9e10c45..e4cd000 100644
-#define ATOMIC_OP_RETURN(op, c_op, asm_op) \
-static inline int atomic_##op##_return_relaxed(int i, atomic_t *v) \
-+#define ATOMIC_OP(op, c_op, asm_op) __ATOMIC_OP(op, _unchecked, c_op, asm_op, , )\
-+ __ATOMIC_OP(op, , c_op, asm_op##s, __OVERFLOW_POST, __OVERFLOW_EXTABLE)
++#define ATOMIC_OP(op, c_op, asm_op) __ATOMIC_OP(op, _unchecked, c_op, asm_op)\
++ __ATOMIC_OP(op, , c_op, asm_op##s)
+
-+#define __ATOMIC_OP_RETURN(op, suffix, c_op, asm_op, post_op, extable) \
++#define __ATOMIC_OP_RETURN(op, suffix, c_op, asm_op) \
+static inline int atomic_##op##_return##suffix##_relaxed(int i, atomic##suffix##_t *v)\
{ \
- unsigned long tmp; \
+- unsigned long tmp; \
++ int tmp; \
int result; \
\
prefetchw(&v->counter); \
@@ -1068,30 +1233,39 @@ index 9e10c45..e4cd000 100644
- __asm__ __volatile__("@ atomic_" #op "_return\n" \
+ __asm__ __volatile__("@ atomic_" #op "_return" #suffix "\n" \
"1: ldrex %0, [%3]\n" \
- " " #asm_op " %0, %0, %4\n" \
-+ post_op \
- " strex %1, %0, [%3]\n" \
- " teq %1, #0\n" \
+-" " #asm_op " %0, %0, %4\n" \
+-" strex %1, %0, [%3]\n" \
+-" teq %1, #0\n" \
-" bne 1b" \
+- : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) \
++" " #asm_op " %1, %0, %4\n" \
++ __OVERFLOW_POST_RETURN \
++" strex %0, %1, [%3]\n" \
++" teq %0, #0\n" \
+" bne 1b\n" \
-+ extable \
- : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) \
++ __OVERFLOW_EXTABLE \
++ : "=&r" (tmp), "=&r" (result), "+Qo" (v->counter) \
: "r" (&v->counter), "Ir" (i) \
: "cc"); \
-@@ -78,8 +128,12 @@ static inline int atomic_##op##_return_relaxed(int i, atomic_t *v) \
+ \
+ return result; \
+ }
+
++#define ATOMIC_OP_RETURN(op, c_op, asm_op) __ATOMIC_OP_RETURN(op, _unchecked, c_op, asm_op)\
++ __ATOMIC_OP_RETURN(op, , c_op, asm_op##s)
++
+ #define ATOMIC_FETCH_OP(op, c_op, asm_op) \
+ static inline int atomic_fetch_##op##_relaxed(int i, atomic_t *v) \
+ { \
+@@ -99,6 +152,7 @@ static inline int atomic_fetch_##op##_relaxed(int i, atomic_t *v) \
}
#define atomic_add_return_relaxed atomic_add_return_relaxed
+#define atomic_add_return_unchecked_relaxed atomic_add_return_unchecked_relaxed
#define atomic_sub_return_relaxed atomic_sub_return_relaxed
-
-+#define ATOMIC_OP_RETURN(op, c_op, asm_op) __ATOMIC_OP_RETURN(op, _unchecked, c_op, asm_op, , )\
-+ __ATOMIC_OP_RETURN(op, , c_op, asm_op##s, __OVERFLOW_POST_RETURN, __OVERFLOW_EXTABLE)
-+
- static inline int atomic_cmpxchg_relaxed(atomic_t *ptr, int old, int new)
- {
- int oldval;
-@@ -113,12 +167,24 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
+ #define atomic_fetch_add_relaxed atomic_fetch_add_relaxed
+ #define atomic_fetch_sub_relaxed atomic_fetch_sub_relaxed
+@@ -141,12 +195,17 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
__asm__ __volatile__ ("@ atomic_add_unless\n"
"1: ldrex %0, [%4]\n"
" teq %0, %5\n"
@@ -1100,26 +1274,19 @@ index 9e10c45..e4cd000 100644
+" beq 4f\n"
+" adds %1, %0, %6\n"
+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" bvc 3f\n"
-+"2: " REFCOUNT_TRAP_INSN "\n"
-+"3:\n"
-+#endif
++ __OVERFLOW_POST
+
" strex %2, %1, [%4]\n"
" teq %2, #0\n"
" bne 1b\n"
-"2:"
-+"4:"
+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ _ASM_EXTABLE(2b, 4b)
-+#endif
++ __OVERFLOW_EXTABLE
+
: "=&r" (oldval), "=&r" (newval), "=&r" (tmp), "+Qo" (v->counter)
: "r" (&v->counter), "r" (u), "r" (a)
: "cc");
-@@ -129,14 +195,36 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
+@@ -157,14 +216,36 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
return oldval;
}
@@ -1158,7 +1325,7 @@ index 9e10c45..e4cd000 100644
{ \
unsigned long flags; \
\
-@@ -145,8 +233,11 @@ static inline void atomic_##op(int i, atomic_t *v) \
+@@ -173,8 +254,11 @@ static inline void atomic_##op(int i, atomic_t *v) \
raw_local_irq_restore(flags); \
} \
@@ -1172,7 +1339,7 @@ index 9e10c45..e4cd000 100644
{ \
unsigned long flags; \
int val; \
-@@ -159,6 +250,9 @@ static inline int atomic_##op##_return(int i, atomic_t *v) \
+@@ -201,6 +285,9 @@ static inline int atomic_fetch_##op(int i, atomic_t *v) \
return val; \
}
@@ -1182,7 +1349,7 @@ index 9e10c45..e4cd000 100644
static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
{
int ret;
-@@ -173,6 +267,11 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
+@@ -215,6 +302,11 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
return ret;
}
@@ -1194,9 +1361,9 @@ index 9e10c45..e4cd000 100644
static inline int __atomic_add_unless(atomic_t *v, int a, int u)
{
int c, old;
-@@ -201,16 +300,29 @@ ATOMIC_OP(xor, ^=, eor)
-
+@@ -250,16 +342,29 @@ ATOMIC_OPS(xor, ^=, eor)
#undef ATOMIC_OPS
+ #undef ATOMIC_FETCH_OP
#undef ATOMIC_OP_RETURN
+#undef __ATOMIC_OP_RETURN
#undef ATOMIC_OP
@@ -1224,7 +1391,7 @@ index 9e10c45..e4cd000 100644
#define atomic_dec_return_relaxed(v) (atomic_sub_return_relaxed(1, v))
#define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
-@@ -221,6 +333,14 @@ typedef struct {
+@@ -270,6 +375,14 @@ typedef struct {
long long counter;
} atomic64_t;
@@ -1239,7 +1406,7 @@ index 9e10c45..e4cd000 100644
#define ATOMIC64_INIT(i) { (i) }
#ifdef CONFIG_ARM_LPAE
-@@ -237,6 +357,19 @@ static inline long long atomic64_read(const atomic64_t *v)
+@@ -286,6 +399,19 @@ static inline long long atomic64_read(const atomic64_t *v)
return result;
}
@@ -1259,7 +1426,7 @@ index 9e10c45..e4cd000 100644
static inline void atomic64_set(atomic64_t *v, long long i)
{
__asm__ __volatile__("@ atomic64_set\n"
-@@ -245,6 +378,15 @@ static inline void atomic64_set(atomic64_t *v, long long i)
+@@ -294,6 +420,15 @@ static inline void atomic64_set(atomic64_t *v, long long i)
: "r" (&v->counter), "r" (i)
);
}
@@ -1275,7 +1442,7 @@ index 9e10c45..e4cd000 100644
#else
static inline long long atomic64_read(const atomic64_t *v)
{
-@@ -259,6 +401,19 @@ static inline long long atomic64_read(const atomic64_t *v)
+@@ -308,6 +443,19 @@ static inline long long atomic64_read(const atomic64_t *v)
return result;
}
@@ -1295,7 +1462,7 @@ index 9e10c45..e4cd000 100644
static inline void atomic64_set(atomic64_t *v, long long i)
{
long long tmp;
-@@ -273,43 +428,73 @@ static inline void atomic64_set(atomic64_t *v, long long i)
+@@ -322,50 +470,82 @@ static inline void atomic64_set(atomic64_t *v, long long i)
: "r" (&v->counter), "r" (i)
: "cc");
}
@@ -1318,15 +1485,14 @@ index 9e10c45..e4cd000 100644
-#define ATOMIC64_OP(op, op1, op2) \
-static inline void atomic64_##op(long long i, atomic64_t *v) \
-+#undef __OVERFLOW_POST_RETURN
-+#define __OVERFLOW_POST_RETURN \
++#define __OVERFLOW_POST_RETURN64 \
+ " bvc 3f\n" \
-+" mov %0, %1\n" \
-+" mov %H0, %H1\n" \
++" mov %Q1, %Q0\n" \
++" mov %R1, %R0\n" \
+ "2: " REFCOUNT_TRAP_INSN "\n"\
+ "3:\n"
+
-+#define __ATOMIC64_OP(op, suffix, op1, op2, post_op, extable) \
++#define __ATOMIC64_OP(op, suffix, op1, op2) \
+static inline void atomic64_##op##suffix(long long i, atomic64##suffix##_t *v)\
{ \
long long result; \
@@ -1338,77 +1504,81 @@ index 9e10c45..e4cd000 100644
"1: ldrexd %0, %H0, [%3]\n" \
" " #op1 " %Q0, %Q0, %Q4\n" \
" " #op2 " %R0, %R0, %R4\n" \
-+ post_op \
++ __OVERFLOW_POST \
" strexd %1, %0, %H0, [%3]\n" \
" teq %1, #0\n" \
-" bne 1b" \
+" bne 1b\n" \
-+ extable \
++ __OVERFLOW_EXTABLE \
: "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) \
: "r" (&v->counter), "r" (i) \
: "cc"); \
} \
-#define ATOMIC64_OP_RETURN(op, op1, op2) \
-+#define ATOMIC64_OP(op, op1, op2) __ATOMIC64_OP(op, _unchecked, op1, op2, , ) \
-+ __ATOMIC64_OP(op, , op1, op2##s, __OVERFLOW_POST, __OVERFLOW_EXTABLE)
++#define ATOMIC64_OP(op, op1, op2) __ATOMIC64_OP(op, _unchecked, op1, op2) \
++ __ATOMIC64_OP(op, , op1, op2##s)
+
-+#define __ATOMIC64_OP_RETURN(op, suffix, op1, op2, post_op, extable) \
++#define __ATOMIC64_OP_RETURN(op, suffix, op1, op2) \
static inline long long \
-atomic64_##op##_return_relaxed(long long i, atomic64_t *v) \
+atomic64_##op##_return##suffix##_relaxed(long long i, atomic64##suffix##_t *v) \
{ \
long long result; \
- unsigned long tmp; \
+- unsigned long tmp; \
++ long long tmp; \
\
prefetchw(&v->counter); \
\
- __asm__ __volatile__("@ atomic64_" #op "_return\n" \
+ __asm__ __volatile__("@ atomic64_" #op "_return" #suffix "\n" \
"1: ldrexd %0, %H0, [%3]\n" \
- " " #op1 " %Q0, %Q0, %Q4\n" \
- " " #op2 " %R0, %R0, %R4\n" \
-+ post_op \
- " strexd %1, %0, %H0, [%3]\n" \
- " teq %1, #0\n" \
+-" " #op1 " %Q0, %Q0, %Q4\n" \
+-" " #op2 " %R0, %R0, %R4\n" \
+-" strexd %1, %0, %H0, [%3]\n" \
+-" teq %1, #0\n" \
-" bne 1b" \
+- : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) \
++" " #op1 " %Q1, %Q0, %Q4\n" \
++" " #op2 " %R1, %R0, %R4\n" \
++ __OVERFLOW_POST_RETURN64 \
++" strexd %0, %1, %H1, [%3]\n" \
++" teq %0, #0\n" \
+" bne 1b\n" \
-+ extable \
- : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) \
++ __OVERFLOW_EXTABLE \
++ : "=&r" (tmp), "=&r" (result), "+Qo" (v->counter) \
: "r" (&v->counter), "r" (i) \
: "cc"); \
-@@ -317,6 +502,9 @@ atomic64_##op##_return_relaxed(long long i, atomic64_t *v) \
+ \
return result; \
}
-+#define ATOMIC64_OP_RETURN(op, op1, op2) __ATOMIC64_OP_RETURN(op, _unchecked, op1, op2, , ) \
-+ __ATOMIC64_OP_RETURN(op, , op1, op2##s, __OVERFLOW_POST_RETURN, __OVERFLOW_EXTABLE)
++#define ATOMIC64_OP_RETURN(op, op1, op2) __ATOMIC64_OP_RETURN(op, _unchecked, op1, op2) \
++ __ATOMIC64_OP_RETURN(op, , op1, op2##s)
+
- #define ATOMIC64_OPS(op, op1, op2) \
- ATOMIC64_OP(op, op1, op2) \
- ATOMIC64_OP_RETURN(op, op1, op2)
-@@ -325,6 +513,7 @@ ATOMIC64_OPS(add, adds, adc)
+ #define ATOMIC64_FETCH_OP(op, op1, op2) \
+ static inline long long \
+ atomic64_fetch_##op##_relaxed(long long i, atomic64_t *v) \
+@@ -398,6 +578,7 @@ ATOMIC64_OPS(add, adds, adc)
ATOMIC64_OPS(sub, subs, sbc)
#define atomic64_add_return_relaxed atomic64_add_return_relaxed
+#define atomic64_add_return_unchecked_relaxed atomic64_add_return_unchecked_relaxed
#define atomic64_sub_return_relaxed atomic64_sub_return_relaxed
-
- #define atomic64_andnot atomic64_andnot
-@@ -336,7 +525,12 @@ ATOMIC64_OP(xor, eor, eor)
-
+ #define atomic64_fetch_add_relaxed atomic64_fetch_add_relaxed
+ #define atomic64_fetch_sub_relaxed atomic64_fetch_sub_relaxed
+@@ -422,7 +603,10 @@ ATOMIC64_OPS(xor, eor, eor)
#undef ATOMIC64_OPS
+ #undef ATOMIC64_FETCH_OP
#undef ATOMIC64_OP_RETURN
+#undef __ATOMIC64_OP_RETURN
#undef ATOMIC64_OP
+#undef __ATOMIC64_OP
-+#undef __OVERFLOW_EXTABLE
+#undef __OVERFLOW_POST_RETURN
-+#undef __OVERFLOW_POST
static inline long long
atomic64_cmpxchg_relaxed(atomic64_t *ptr, long long old, long long new)
-@@ -362,6 +556,13 @@ atomic64_cmpxchg_relaxed(atomic64_t *ptr, long long old, long long new)
+@@ -448,6 +632,13 @@ atomic64_cmpxchg_relaxed(atomic64_t *ptr, long long old, long long new)
}
#define atomic64_cmpxchg_relaxed atomic64_cmpxchg_relaxed
@@ -1422,7 +1592,7 @@ index 9e10c45..e4cd000 100644
static inline long long atomic64_xchg_relaxed(atomic64_t *ptr, long long new)
{
long long result;
-@@ -382,24 +583,44 @@ static inline long long atomic64_xchg_relaxed(atomic64_t *ptr, long long new)
+@@ -468,25 +659,36 @@ static inline long long atomic64_xchg_relaxed(atomic64_t *ptr, long long new)
}
#define atomic64_xchg_relaxed atomic64_xchg_relaxed
@@ -1442,38 +1612,33 @@ index 9e10c45..e4cd000 100644
prefetchw(&v->counter);
__asm__ __volatile__("@ atomic64_dec_if_positive\n"
--"1: ldrexd %0, %H0, [%3]\n"
+ "1: ldrexd %0, %H0, [%3]\n"
-" subs %Q0, %Q0, #1\n"
-" sbc %R0, %R0, #0\n"
-+"1: ldrexd %1, %H1, [%3]\n"
-+" subs %Q0, %Q1, #1\n"
-+" sbcs %R0, %R1, #0\n"
+-" teq %R0, #0\n"
+-" bmi 2f\n"
+-" strexd %1, %0, %H0, [%3]\n"
+-" teq %1, #0\n"
++" subs %Q1, %Q0, #1\n"
++" sbcs %R1, %R0, #0\n"
+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" bvc 3f\n"
-+" mov %Q0, %Q1\n"
-+" mov %R0, %R1\n"
-+"2: " REFCOUNT_TRAP_INSN "\n"
-+"3:\n"
-+#endif
++ __OVERFLOW_POST_RETURN64
+
- " teq %R0, #0\n"
--" bmi 2f\n"
++" teq %R1, #0\n"
+" bmi 4f\n"
- " strexd %1, %0, %H0, [%3]\n"
- " teq %1, #0\n"
++" strexd %0, %1, %H1, [%3]\n"
++" teq %0, #0\n"
" bne 1b\n"
-"2:"
-+"4:\n"
+- : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ _ASM_EXTABLE(2b, 4b)
-+#endif
++ __OVERFLOW_EXTABLE
+
- : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
++ : "=&r" (tmp), "=&r" (result), "+Qo" (v->counter)
: "r" (&v->counter)
: "cc");
-@@ -423,13 +644,25 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
+
+@@ -509,13 +711,18 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
" teq %0, %5\n"
" teqeq %H0, %H5\n"
" moveq %1, #0\n"
@@ -1483,27 +1648,26 @@ index 9e10c45..e4cd000 100644
-" adc %R0, %R0, %R6\n"
+" adcs %R0, %R0, %R6\n"
+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" bvc 3f\n"
-+"2: " REFCOUNT_TRAP_INSN "\n"
-+"3:\n"
-+#endif
++ __OVERFLOW_POST
+
" strexd %2, %0, %H0, [%4]\n"
" teq %2, #0\n"
" bne 1b\n"
-"2:"
-+"4:\n"
+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ _ASM_EXTABLE(2b, 4b)
-+#endif
++ __OVERFLOW_EXTABLE
+
: "=&r" (val), "+r" (ret), "=&r" (tmp), "+Qo" (v->counter)
: "r" (&v->counter), "r" (u), "r" (a)
: "cc");
-@@ -442,10 +675,13 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
+@@ -526,12 +733,19 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
+ return ret;
+ }
++#undef __OVERFLOW_EXTABLE
++#undef __OVERFLOW_POST_RETURN64
++#undef __OVERFLOW_POST
++
#define atomic64_add_negative(a, v) (atomic64_add_return((a), (v)) < 0)
#define atomic64_inc(v) atomic64_add(1LL, (v))
+#define atomic64_inc_unchecked(v) atomic64_add_unchecked(1LL, (v))
@@ -1825,7 +1989,7 @@ index 4355f0e..cd9168e 100644
#ifdef MULTI_USER
extern struct cpu_user_fns cpu_user;
diff --git a/arch/arm/include/asm/pgalloc.h b/arch/arm/include/asm/pgalloc.h
-index 20febb3..8d498e1 100644
+index b2902a5..da11e4d 100644
--- a/arch/arm/include/asm/pgalloc.h
+++ b/arch/arm/include/asm/pgalloc.h
@@ -17,6 +17,7 @@
@@ -1877,7 +2041,7 @@ index 20febb3..8d498e1 100644
pmdval_t prot)
{
diff --git a/arch/arm/include/asm/pgtable-2level-hwdef.h b/arch/arm/include/asm/pgtable-2level-hwdef.h
-index d0131ee..23a0939 100644
+index 3f82e9d..2a85e8b 100644
--- a/arch/arm/include/asm/pgtable-2level-hwdef.h
+++ b/arch/arm/include/asm/pgtable-2level-hwdef.h
@@ -28,7 +28,7 @@
@@ -1897,7 +2061,7 @@ index d0131ee..23a0939 100644
#define PMD_SECT_UNCACHED (_AT(pmdval_t, 0))
#define PMD_SECT_BUFFERED (PMD_SECT_BUFFERABLE)
-@@ -69,6 +70,7 @@
+@@ -70,6 +71,7 @@
* - extended small page/tiny page
*/
#define PTE_EXT_XN (_AT(pteval_t, 1) << 0) /* v6 */
@@ -1945,7 +2109,7 @@ index 2a029bc..a0524c7 100644
#define L_PTE_DIRTY_HIGH (1 << (55 - 32))
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
-index d622040..fcebd79 100644
+index a8d656d..2febb8a 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -33,6 +33,9 @@
@@ -2028,7 +2192,7 @@ index d622040..fcebd79 100644
*/
#define _L_PTE_DEFAULT L_PTE_PRESENT | L_PTE_YOUNG
-@@ -306,7 +354,7 @@ static inline pte_t pte_mknexec(pte_t pte)
+@@ -308,7 +356,7 @@ static inline pte_t pte_mknexec(pte_t pte)
static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
{
const pteval_t mask = L_PTE_XN | L_PTE_RDONLY | L_PTE_USER |
@@ -2117,6 +2281,18 @@ index 776757d..a552c1d 100644
/*
* Change these and you break ASM code in entry-common.S
+diff --git a/arch/arm/include/asm/timex.h b/arch/arm/include/asm/timex.h
+index f6fcc67..5895d62 100644
+--- a/arch/arm/include/asm/timex.h
++++ b/arch/arm/include/asm/timex.h
+@@ -13,6 +13,7 @@
+ #define _ASMARM_TIMEX_H
+
+ typedef unsigned long cycles_t;
++extern int read_current_timer(unsigned long *timer_val);
+ #define get_cycles() ({ cycles_t c; read_current_timer(&c) ? 0 : c; })
+
+ #endif
diff --git a/arch/arm/include/asm/tls.h b/arch/arm/include/asm/tls.h
index 5f833f7..76e6644 100644
--- a/arch/arm/include/asm/tls.h
@@ -2140,7 +2316,7 @@ index 5f833f7..76e6644 100644
}
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
-index 35c9db8..400e490 100644
+index a93c0f9..5c31bbb 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -18,6 +18,7 @@
@@ -2254,10 +2430,10 @@ index 35c9db8..400e490 100644
-
-#define segment_eq(a, b) ((a) == (b))
-
- #define __addr_ok(addr) ({ \
- unsigned long flag; \
- __asm__("cmp %2, %0; movlo %0, #0" \
-@@ -302,6 +333,7 @@ static inline void set_fs(mm_segment_t fs)
+ /* We use 33-bit arithmetic here... */
+ #define __range_ok(addr, size) ({ \
+ unsigned long flag, roksum; \
+@@ -268,6 +299,7 @@ static inline void set_fs(mm_segment_t fs)
#endif /* CONFIG_MMU */
@@ -2265,7 +2441,7 @@ index 35c9db8..400e490 100644
#define access_ok(type, addr, size) (__range_ok(addr, size) == 0)
#define user_addr_max() \
-@@ -490,39 +522,46 @@ do { \
+@@ -474,10 +506,10 @@ do { \
#ifdef CONFIG_MMU
@@ -2277,13 +2453,8 @@ index 35c9db8..400e490 100644
+static inline unsigned long __must_check __size_overflow(3)
__copy_from_user(void *to, const void __user *from, unsigned long n)
{
-- unsigned int __ua_flags = uaccess_save_and_enable();
-+ unsigned int __ua_flags;
-+
-+ check_object_size(to, n, false);
-+ __ua_flags = uaccess_save_and_enable();
- n = arm_copy_from_user(to, from, n);
- uaccess_restore(__ua_flags);
+ unsigned int __ua_flags;
+@@ -489,9 +521,9 @@ __copy_from_user(void *to, const void __user *from, unsigned long n)
return n;
}
@@ -2295,20 +2466,7 @@ index 35c9db8..400e490 100644
__copy_to_user_std(void __user *to, const void *from, unsigned long n);
static inline unsigned long __must_check
- __copy_to_user(void __user *to, const void *from, unsigned long n)
- {
- #ifndef CONFIG_UACCESS_WITH_MEMCPY
-- unsigned int __ua_flags = uaccess_save_and_enable();
-+ unsigned int __ua_flags;
-+
-+ check_object_size(from, n, true);
-+ __ua_flags = uaccess_save_and_enable();
- n = arm_copy_to_user(to, from, n);
- uaccess_restore(__ua_flags);
- return n;
- #else
-+ check_object_size(from, n, true);
- return arm_copy_to_user(to, from, n);
+@@ -511,9 +543,9 @@ __copy_to_user(void __user *to, const void *from, unsigned long n)
#endif
}
@@ -2320,7 +2478,7 @@ index 35c9db8..400e490 100644
__clear_user_std(void __user *addr, unsigned long n);
static inline unsigned long __must_check
-@@ -542,6 +581,9 @@ __clear_user(void __user *addr, unsigned long n)
+@@ -533,6 +565,9 @@ __clear_user(void __user *addr, unsigned long n)
static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
{
@@ -2330,7 +2488,7 @@ index 35c9db8..400e490 100644
if (access_ok(VERIFY_READ, from, n))
n = __copy_from_user(to, from, n);
else /* security hole - plug it */
-@@ -551,6 +593,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
+@@ -542,6 +577,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
{
@@ -2367,7 +2525,7 @@ index 7e45f69..2c047db 100644
EXPORT_SYMBOL(__csum_ipv6_magic);
diff --git a/arch/arm/kernel/cpuidle.c b/arch/arm/kernel/cpuidle.c
-index a44b268e..eea8f58 100644
+index 7dccc96..84da243 100644
--- a/arch/arm/kernel/cpuidle.c
+++ b/arch/arm/kernel/cpuidle.c
@@ -19,7 +19,7 @@ extern struct of_cpuidle_method __cpuidle_method_of_table[];
@@ -2396,7 +2554,7 @@ index 9f43ba0..1cee475 100644
desc.type = MT_DEVICE_WC;
else
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
-index e255050..51e1b59 100644
+index 9f157e7..8e3f857 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -50,6 +50,87 @@
@@ -2494,7 +2652,7 @@ index e255050..51e1b59 100644
+
+ pax_enter_kernel
+
- sub sp, sp, #S_FRAME_SIZE
+ sub sp, sp, #PT_REGS_SIZE
ARM( stmib sp, {r1 - lr} )
THUMB( stmia sp, {r0 - r12} )
THUMB( str sp, [sp, #S_SP] )
@@ -2510,7 +2668,7 @@ index e255050..51e1b59 100644
+
+ pax_enter_kernel
+
- sub sp, sp, #(S_FRAME_SIZE + 8 + \stack_hole - 4)
+ sub sp, sp, #(SVC_REGS_SIZE + \stack_hole - 4)
#ifdef CONFIG_THUMB2_KERNEL
SPFIX( str r0, [sp] ) @ temporarily saved
@@ -167,7 +255,12 @@ ENDPROC(__und_invalid)
@@ -2519,24 +2677,24 @@ index e255050..51e1b59 100644
mov r6, #-1 @ "" "" "" ""
+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
+ @ offset sp by 8 as done in pax_enter_kernel
-+ add r2, sp, #(S_FRAME_SIZE + 8 + \stack_hole + 4)
++ add r2, sp, #(SVC_REGS_SIZE + \stack_hole + 4)
+#else
- add r2, sp, #(S_FRAME_SIZE + 8 + \stack_hole - 4)
+ add r2, sp, #(SVC_REGS_SIZE + \stack_hole - 4)
+#endif
SPFIX( addeq r2, r2, #4 )
str r3, [sp, #-4]! @ save the "real" r0 copied
@ from the exception stack
-@@ -376,6 +469,9 @@ ENDPROC(__fiq_abt)
+@@ -382,6 +475,9 @@ ENDPROC(__fiq_abt)
.macro usr_entry, trace=1, uaccess=1
UNWIND(.fnstart )
UNWIND(.cantunwind ) @ don't unwind the user space
+
+ pax_enter_kernel_user
+
- sub sp, sp, #S_FRAME_SIZE
+ sub sp, sp, #PT_REGS_SIZE
ARM( stmib sp, {r1 - r12} )
THUMB( stmia sp, {r0 - r12} )
-@@ -489,7 +585,9 @@ __und_usr:
+@@ -495,7 +591,9 @@ __und_usr:
tst r3, #PSR_T_BIT @ Thumb mode?
bne __und_usr_thumb
sub r4, r2, #4 @ ARM instr at LR - 4
@@ -2546,7 +2704,7 @@ index e255050..51e1b59 100644
ARM_BE8(rev r0, r0) @ little endian instruction
uaccess_disable ip
-@@ -525,11 +623,15 @@ __und_usr_thumb:
+@@ -531,11 +629,15 @@ __und_usr_thumb:
*/
.arch armv6t2
#endif
@@ -2562,7 +2720,7 @@ index e255050..51e1b59 100644
ARM_BE8(rev16 r0, r0) @ little endian instruction
uaccess_disable ip
add r2, r2, #2 @ r2 is PC + 2, make it PC + 4
-@@ -560,7 +662,8 @@ ENDPROC(__und_usr)
+@@ -566,7 +668,8 @@ ENDPROC(__und_usr)
*/
.pushsection .text.fixup, "ax"
.align 2
@@ -2572,7 +2730,7 @@ index e255050..51e1b59 100644
ret r9
.popsection
.pushsection __ex_table,"a"
-@@ -782,7 +885,7 @@ ENTRY(__switch_to)
+@@ -788,7 +891,7 @@ ENTRY(__switch_to)
THUMB( str lr, [ip], #4 )
ldr r4, [r2, #TI_TP_VALUE]
ldr r5, [r2, #TI_TP_VALUE + 4]
@@ -2581,7 +2739,7 @@ index e255050..51e1b59 100644
mrc p15, 0, r6, c3, c0, 0 @ Get domain register
str r6, [r1, #TI_CPU_DOMAIN] @ Save old domain register
ldr r6, [r2, #TI_CPU_DOMAIN]
-@@ -793,7 +896,7 @@ ENTRY(__switch_to)
+@@ -799,7 +902,7 @@ ENTRY(__switch_to)
ldr r8, =__stack_chk_guard
ldr r7, [r7, #TSK_STACK_CANARY]
#endif
@@ -2591,7 +2749,7 @@ index e255050..51e1b59 100644
#endif
mov r5, r0
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
-index 30a7228..d071196 100644
+index 10c3283..c47cdf5 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -11,18 +11,46 @@
@@ -2680,7 +2838,7 @@ index 30a7228..d071196 100644
#if defined(CONFIG_OABI_COMPAT)
diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
-index 0d22ad2..d776aa0 100644
+index 6391728..6bf90b8 100644
--- a/arch/arm/kernel/entry-header.S
+++ b/arch/arm/kernel/entry-header.S
@@ -196,6 +196,59 @@
@@ -2743,9 +2901,9 @@ index 0d22ad2..d776aa0 100644
.macro svc_exit, rpsr, irq = 0
.if \irq != 0
-@@ -217,6 +270,8 @@
- .endif
+@@ -219,6 +272,8 @@
uaccess_restore
+ str r1, [tsk, #TI_ADDR_LIMIT]
+ pax_exit_kernel
+
@@ -2867,10 +3025,10 @@ index 69bda1a..755113a 100644
if (waddr != addr) {
flush_kernel_vmap_range(waddr, twopage ? size / 2 : size);
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
-index 4a803c5..6c8688f 100644
+index 612eb53..5a44c8c 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
-@@ -114,8 +114,8 @@ void __show_regs(struct pt_regs *regs)
+@@ -118,8 +118,8 @@ void __show_regs(struct pt_regs *regs)
show_regs_print_info(KERN_DEFAULT);
@@ -2881,7 +3039,7 @@ index 4a803c5..6c8688f 100644
printk("pc : [<%08lx>] lr : [<%08lx>] psr: %08lx\n"
"sp : %08lx ip : %08lx fp : %08lx\n",
regs->ARM_pc, regs->ARM_lr, regs->ARM_cpsr,
-@@ -229,7 +229,7 @@ copy_thread(unsigned long clone_flags, unsigned long stack_start,
+@@ -233,7 +233,7 @@ copy_thread(unsigned long clone_flags, unsigned long stack_start,
memset(&thread->cpu_context, 0, sizeof(struct cpu_context_save));
@@ -2890,7 +3048,7 @@ index 4a803c5..6c8688f 100644
/*
* Copy the initial value of the domain access control register
* from the current thread: thread->addr_limit will have been
-@@ -333,7 +333,7 @@ static struct vm_area_struct gate_vma = {
+@@ -337,7 +337,7 @@ static struct vm_area_struct gate_vma = {
static int __init gate_vma_init(void)
{
@@ -2899,7 +3057,7 @@ index 4a803c5..6c8688f 100644
return 0;
}
arch_initcall(gate_vma_init);
-@@ -362,92 +362,14 @@ const char *arch_vma_name(struct vm_area_struct *vma)
+@@ -366,92 +366,14 @@ const char *arch_vma_name(struct vm_area_struct *vma)
return is_gate_vma(vma) ? "[vectors]" : NULL;
}
@@ -2995,7 +3153,7 @@ index 4a803c5..6c8688f 100644
}
#endif
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
-index 4d93758..c2f471f92 100644
+index ce131ed..26f9765 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -928,10 +928,19 @@ static void tracehook_report_syscall(struct pt_regs *regs,
@@ -3015,9 +3173,9 @@ index 4d93758..c2f471f92 100644
+ gr_delayed_cred_worker();
+#endif
+
- /* Do the secure computing check first; failures should be fast. */
- #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
- if (secure_computing() == -1)
+ if (test_thread_flag(TIF_SYSCALL_TRACE))
+ tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
+
diff --git a/arch/arm/kernel/reboot.c b/arch/arm/kernel/reboot.c
index 3fa867a..d610607 100644
--- a/arch/arm/kernel/reboot.c
@@ -3031,10 +3189,10 @@ index 3fa867a..d610607 100644
/*
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
-index 7b53500..d25a7aa 100644
+index df7f2a7..d9d2bc1 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
-@@ -113,21 +113,23 @@ EXPORT_SYMBOL(elf_hwcap);
+@@ -112,21 +112,23 @@ EXPORT_SYMBOL(elf_hwcap);
unsigned int elf_hwcap2 __read_mostly;
EXPORT_SYMBOL(elf_hwcap2);
@@ -3063,7 +3221,7 @@ index 7b53500..d25a7aa 100644
EXPORT_SYMBOL(outer_cache);
#endif
-@@ -258,9 +260,13 @@ static int __get_cpu_architecture(void)
+@@ -257,9 +259,13 @@ static int __get_cpu_architecture(void)
* Register 0 and check for VMSAv7 or PMSAv7 */
unsigned int mmfr0 = read_cpuid_ext(CPUID_EXT_MMFR0);
if ((mmfr0 & 0x0000000f) >= 0x00000003 ||
@@ -3205,41 +3363,24 @@ index bc69838..e5dfdd4 100644
do_exit(signr);
}
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
-index e2c6da0..6155a88 100644
+index d24e5dd..77cf6cf 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
-@@ -44,7 +44,7 @@
+@@ -44,7 +44,8 @@
#endif
#if (defined(CONFIG_SMP_ON_UP) && !defined(CONFIG_DEBUG_SPINLOCK)) || \
-- defined(CONFIG_GENERIC_BUG)
-+ defined(CONFIG_GENERIC_BUG) || defined(CONFIG_PAX_REFCOUNT)
+- defined(CONFIG_GENERIC_BUG) || defined(CONFIG_JUMP_LABEL)
++ defined(CONFIG_GENERIC_BUG) || defined(CONFIG_JUMP_LABEL) || \
++ defined(CONFIG_PAX_REFCOUNT)
#define ARM_EXIT_KEEP(x) x
#define ARM_EXIT_DISCARD(x)
#else
-@@ -125,6 +125,8 @@ SECTIONS
- #ifdef CONFIG_DEBUG_ALIGN_RODATA
- . = ALIGN(1<<SECTION_SHIFT);
- #endif
-+ _etext = .; /* End of text section */
-+
- RO_DATA(PAGE_SIZE)
-
- . = ALIGN(4);
-@@ -155,8 +157,6 @@ SECTIONS
-
- NOTES
-
-- _etext = .; /* End of text and rodata section */
--
- #ifdef CONFIG_DEBUG_RODATA
- . = ALIGN(1<<SECTION_SHIFT);
- #else
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
-index 4e1b22a..10ef049 100644
+index c94b90d..0cc6830 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
-@@ -58,7 +58,7 @@ static unsigned long hyp_default_vectors;
+@@ -59,7 +59,7 @@ static unsigned long hyp_default_vectors;
static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu);
/* The VMID used in the VTTBR */
@@ -3248,7 +3389,7 @@ index 4e1b22a..10ef049 100644
static u32 kvm_next_vmid;
static unsigned int kvm_vmid_bits __read_mostly;
static DEFINE_SPINLOCK(kvm_vmid_lock);
-@@ -387,7 +387,7 @@ void force_vm_exit(const cpumask_t *mask)
+@@ -388,7 +388,7 @@ void force_vm_exit(const cpumask_t *mask)
*/
static bool need_new_vmid_gen(struct kvm *kvm)
{
@@ -3257,7 +3398,7 @@ index 4e1b22a..10ef049 100644
}
/**
-@@ -420,7 +420,7 @@ static void update_vttbr(struct kvm *kvm)
+@@ -421,7 +421,7 @@ static void update_vttbr(struct kvm *kvm)
/* First user of a new VMID generation? */
if (unlikely(kvm_next_vmid == 0)) {
@@ -3266,7 +3407,7 @@ index 4e1b22a..10ef049 100644
kvm_next_vmid = 1;
/*
-@@ -437,7 +437,7 @@ static void update_vttbr(struct kvm *kvm)
+@@ -438,7 +438,7 @@ static void update_vttbr(struct kvm *kvm)
kvm_call_hyp(__kvm_flush_vm_context);
}
@@ -3338,10 +3479,10 @@ index 6bd1089..e999400 100644
{
unsigned long ua_flags;
diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c
-index f216909..7b6776e 100644
+index 06332f6..1fa0c71 100644
--- a/arch/arm/mach-exynos/suspend.c
+++ b/arch/arm/mach-exynos/suspend.c
-@@ -718,8 +718,10 @@ void __init exynos_pm_init(void)
+@@ -724,8 +724,10 @@ void __init exynos_pm_init(void)
tmp |= pm_data->wake_disable_mask;
pmu_raw_writel(tmp, S5P_WAKEUP_MASK);
@@ -3385,10 +3526,10 @@ index 1ccbba9..7a95c29 100644
}
diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
-index e80f0dd..0262909 100644
+index ae2a018..297ad08 100644
--- a/arch/arm/mach-mvebu/coherency.c
+++ b/arch/arm/mach-mvebu/coherency.c
-@@ -163,7 +163,7 @@ exit:
+@@ -156,7 +156,7 @@ exit:
/*
* This ioremap hook is used on Armada 375/38x to ensure that all MMIO
@@ -3397,7 +3538,7 @@ index e80f0dd..0262909 100644
* needed for the HW I/O coherency mechanism to work properly without
* deadlock.
*/
-@@ -171,7 +171,7 @@ static void __iomem *
+@@ -164,7 +164,7 @@ static void __iomem *
armada_wa_ioremap_caller(phys_addr_t phys_addr, size_t size,
unsigned int mtype, void *caller)
{
@@ -3406,7 +3547,7 @@ index e80f0dd..0262909 100644
return __arm_ioremap_caller(phys_addr, size, mtype, caller);
}
-@@ -181,7 +181,7 @@ static void __init armada_375_380_coherency_init(struct device_node *np)
+@@ -174,7 +174,7 @@ static void __init armada_375_380_coherency_init(struct device_node *np)
coherency_cpu_base = of_iomap(np, 0);
arch_ioremap_caller = armada_wa_ioremap_caller;
@@ -3415,6 +3556,19 @@ index e80f0dd..0262909 100644
/*
* We should switch the PL310 to I/O coherency mode only if
+diff --git a/arch/arm/mach-mvebu/pmsu.c b/arch/arm/mach-mvebu/pmsu.c
+index f39bd51..866c780 100644
+--- a/arch/arm/mach-mvebu/pmsu.c
++++ b/arch/arm/mach-mvebu/pmsu.c
+@@ -93,7 +93,7 @@
+ #define ARMADA_370_CRYPT0_ENG_ATTR 0x1
+
+ extern void ll_disable_coherency(void);
+-extern void ll_enable_coherency(void);
++extern int ll_enable_coherency(void);
+
+ extern void armada_370_xp_cpu_resume(void);
+ extern void armada_38x_cpu_resume(void);
diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
index b6443a4..20a0b74 100644
--- a/arch/arm/mach-omap2/board-n8x0.c
@@ -3429,10 +3583,10 @@ index b6443a4..20a0b74 100644
};
diff --git a/arch/arm/mach-omap2/omap-mpuss-lowpower.c b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
-index 65024af..70bf184 100644
+index ad98246..69437a8 100644
--- a/arch/arm/mach-omap2/omap-mpuss-lowpower.c
+++ b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
-@@ -86,7 +86,7 @@ struct cpu_pm_ops {
+@@ -88,7 +88,7 @@ struct cpu_pm_ops {
void (*resume)(void);
void (*scu_prepare)(unsigned int cpu_id, unsigned int cpu_state);
void (*hotplug_restart)(void);
@@ -3441,7 +3595,7 @@ index 65024af..70bf184 100644
static DEFINE_PER_CPU(struct omap4_cpu_pm_info, omap4_pm_info);
static struct powerdomain *mpuss_pd;
-@@ -105,7 +105,7 @@ static void dummy_cpu_resume(void)
+@@ -106,7 +106,7 @@ static void dummy_cpu_resume(void)
static void dummy_scu_prepare(unsigned int cpu_id, unsigned int cpu_state)
{}
@@ -3451,7 +3605,7 @@ index 65024af..70bf184 100644
.resume = dummy_cpu_resume,
.scu_prepare = dummy_scu_prepare,
diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
-index 8cd1de9..1fcee77 100644
+index b4de3da..e027393 100644
--- a/arch/arm/mach-omap2/omap-smp.c
+++ b/arch/arm/mach-omap2/omap-smp.c
@@ -19,6 +19,7 @@
@@ -3463,10 +3617,10 @@ index 8cd1de9..1fcee77 100644
#include <asm/smp_scu.h>
diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
-index f7ff3b9..e6d5420 100644
+index e920dd8..ef999171 100644
--- a/arch/arm/mach-omap2/omap_device.c
+++ b/arch/arm/mach-omap2/omap_device.c
-@@ -515,7 +515,7 @@ void omap_device_delete(struct omap_device *od)
+@@ -530,7 +530,7 @@ void omap_device_delete(struct omap_device *od)
struct platform_device __init *omap_device_build(const char *pdev_name,
int pdev_id,
struct omap_hwmod *oh,
@@ -3475,7 +3629,7 @@ index f7ff3b9..e6d5420 100644
{
struct omap_hwmod *ohs[] = { oh };
-@@ -543,7 +543,7 @@ struct platform_device __init *omap_device_build(const char *pdev_name,
+@@ -558,7 +558,7 @@ struct platform_device __init *omap_device_build(const char *pdev_name,
struct platform_device __init *omap_device_build_ss(const char *pdev_name,
int pdev_id,
struct omap_hwmod **ohs,
@@ -3504,13 +3658,13 @@ index 78c02b3..c94109a 100644
struct omap_device *omap_device_alloc(struct platform_device *pdev,
struct omap_hwmod **ohs, int oh_cnt);
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
-index 83cb527..e82f20f 100644
+index 1052b29..54669b0 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
-@@ -200,10 +200,10 @@ struct omap_hwmod_soc_ops {
- int (*init_clkdm)(struct omap_hwmod *oh);
+@@ -206,10 +206,10 @@ struct omap_hwmod_soc_ops {
void (*update_context_lost)(struct omap_hwmod *oh);
int (*get_context_lost)(struct omap_hwmod *oh);
+ int (*disable_direct_prcm)(struct omap_hwmod *oh);
-};
+} __no_const;
@@ -3581,7 +3735,7 @@ index 92ec8c3..3b09472 100644
};
diff --git a/arch/arm/mach-shmobile/platsmp-apmu.c b/arch/arm/mach-shmobile/platsmp-apmu.c
-index aba75c8..b2b340f 100644
+index 0c6bb45..0f18d70 100644
--- a/arch/arm/mach-shmobile/platsmp-apmu.c
+++ b/arch/arm/mach-shmobile/platsmp-apmu.c
@@ -22,6 +22,7 @@
@@ -3591,8 +3745,8 @@ index aba75c8..b2b340f 100644
+#include <asm/pgtable.h>
#include "common.h"
#include "platsmp-apmu.h"
-
-@@ -232,6 +233,8 @@ static int shmobile_smp_apmu_enter_suspend(suspend_state_t state)
+ #include "rcar-gen2.h"
+@@ -316,6 +317,8 @@ static int shmobile_smp_apmu_enter_suspend(suspend_state_t state)
void __init shmobile_smp_apmu_suspend_init(void)
{
@@ -3603,10 +3757,10 @@ index aba75c8..b2b340f 100644
}
#endif
diff --git a/arch/arm/mach-tegra/cpuidle-tegra20.c b/arch/arm/mach-tegra/cpuidle-tegra20.c
-index 7469347..1ecc350 100644
+index afcee04..63e52ac 100644
--- a/arch/arm/mach-tegra/cpuidle-tegra20.c
+++ b/arch/arm/mach-tegra/cpuidle-tegra20.c
-@@ -177,7 +177,7 @@ static int tegra20_idle_lp2_coupled(struct cpuidle_device *dev,
+@@ -178,7 +178,7 @@ static int tegra20_idle_lp2_coupled(struct cpuidle_device *dev,
bool entered_lp2 = false;
if (tegra_pending_sgi())
@@ -3616,7 +3770,7 @@ index 7469347..1ecc350 100644
cpuidle_coupled_parallel_barrier(dev, &abort_barrier);
diff --git a/arch/arm/mach-tegra/irq.c b/arch/arm/mach-tegra/irq.c
-index 3b9098d..15b390f 100644
+index a69b22d..8523a03 100644
--- a/arch/arm/mach-tegra/irq.c
+++ b/arch/arm/mach-tegra/irq.c
@@ -20,6 +20,7 @@
@@ -3652,7 +3806,7 @@ index 7cd9865..a00b6ab 100644
#include "common.h"
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
-index cb569b6..da9d9db 100644
+index d15a7fe..6cc4fc9 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -445,6 +445,7 @@ config CPU_32v5
@@ -3761,7 +3915,7 @@ index 7d5f4c7..c6a0816 100644
ai_sys += 1;
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
-index c61996c..56d36df 100644
+index cc12905..88463b3 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -44,7 +44,7 @@ struct l2c_init_data {
@@ -3822,7 +3976,7 @@ index c8c8b9e..c55cc79 100644
atomic64_set(&mm->context.id, asid);
}
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
-index ad58418..8267ca5 100644
+index 3a2e678..ebdbf80 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -25,6 +25,7 @@
@@ -4041,7 +4195,7 @@ index ad58418..8267ca5 100644
+#endif
+ current->thread.error_code = ifsr;
+ current->thread.trap_no = 0;
-+ pax_report_refcount_overflow(regs);
++ pax_report_refcount_error(regs, NULL);
+ fixup_exception(regs);
+ return;
+ }
@@ -4271,7 +4425,7 @@ index 66353ca..8aad9f8 100644
}
}
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
-index 62f4d01..bffdcfe 100644
+index 30fe03f..738d54e 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -243,7 +243,15 @@ __setup("noalign", noalign_setup);
@@ -4476,7 +4630,7 @@ index 62f4d01..bffdcfe 100644
break;
}
pr_info("Memory policy: %sData cache %s\n",
-@@ -958,7 +999,7 @@ static void __init create_mapping(struct map_desc *md)
+@@ -959,7 +1000,7 @@ static void __init create_mapping(struct map_desc *md)
return;
}
@@ -4485,7 +4639,7 @@ index 62f4d01..bffdcfe 100644
md->virtual >= PAGE_OFFSET && md->virtual < FIXADDR_START &&
(md->virtual < VMALLOC_START || md->virtual >= VMALLOC_END)) {
pr_warn("BUG: mapping for 0x%08llx at 0x%08lx out of vmalloc space\n",
-@@ -1309,18 +1350,15 @@ void __init arm_mm_memblock_reserve(void)
+@@ -1320,18 +1361,15 @@ void __init arm_mm_memblock_reserve(void)
* Any other function or debugging method which may touch any device _will_
* crash the kernel.
*/
@@ -4508,7 +4662,7 @@ index 62f4d01..bffdcfe 100644
/*
* Clear page table except top pmd used by early fixmaps
-@@ -1336,7 +1374,7 @@ static void __init devicemaps_init(const struct machine_desc *mdesc)
+@@ -1347,7 +1385,7 @@ static void __init devicemaps_init(const struct machine_desc *mdesc)
map.pfn = __phys_to_pfn(CONFIG_XIP_PHYS_ADDR & SECTION_MASK);
map.virtual = MODULES_VADDR;
map.length = ((unsigned long)_exiprom - map.virtual + ~SECTION_MASK) & SECTION_MASK;
@@ -4517,7 +4671,7 @@ index 62f4d01..bffdcfe 100644
create_mapping(&map);
#endif
-@@ -1347,14 +1385,14 @@ static void __init devicemaps_init(const struct machine_desc *mdesc)
+@@ -1358,14 +1396,14 @@ static void __init devicemaps_init(const struct machine_desc *mdesc)
map.pfn = __phys_to_pfn(FLUSH_BASE_PHYS);
map.virtual = FLUSH_BASE;
map.length = SZ_1M;
@@ -4534,7 +4688,7 @@ index 62f4d01..bffdcfe 100644
create_mapping(&map);
#endif
-@@ -1363,7 +1401,7 @@ static void __init devicemaps_init(const struct machine_desc *mdesc)
+@@ -1374,7 +1412,7 @@ static void __init devicemaps_init(const struct machine_desc *mdesc)
* location (0xffff0000). If we aren't using high-vectors, also
* create a mapping at the low-vectors virtual address.
*/
@@ -4543,7 +4697,7 @@ index 62f4d01..bffdcfe 100644
map.virtual = 0xffff0000;
map.length = PAGE_SIZE;
#ifdef CONFIG_KUSER_HELPERS
-@@ -1426,12 +1464,14 @@ static void __init kmap_init(void)
+@@ -1437,12 +1475,14 @@ static void __init kmap_init(void)
static void __init map_lowmem(void)
{
struct memblock_region *reg;
@@ -4558,7 +4712,7 @@ index 62f4d01..bffdcfe 100644
/* Map all the lowmem memory banks. */
for_each_memblock(memory, reg) {
-@@ -1447,11 +1487,48 @@ static void __init map_lowmem(void)
+@@ -1458,11 +1498,48 @@ static void __init map_lowmem(void)
if (start >= end)
break;
@@ -4608,7 +4762,7 @@ index 62f4d01..bffdcfe 100644
create_mapping(&map);
} else if (start >= kernel_x_end) {
-@@ -1475,7 +1552,7 @@ static void __init map_lowmem(void)
+@@ -1486,7 +1563,7 @@ static void __init map_lowmem(void)
map.pfn = __phys_to_pfn(kernel_x_start);
map.virtual = __phys_to_virt(kernel_x_start);
map.length = kernel_x_end - kernel_x_start;
@@ -4617,7 +4771,7 @@ index 62f4d01..bffdcfe 100644
create_mapping(&map);
-@@ -1488,6 +1565,7 @@ static void __init map_lowmem(void)
+@@ -1499,6 +1576,7 @@ static void __init map_lowmem(void)
create_mapping(&map);
}
}
@@ -4743,7 +4897,7 @@ index 93d0b6d..2db6d99 100644
ctx);
diff --git a/arch/arm/plat-iop/setup.c b/arch/arm/plat-iop/setup.c
-index 5b217f4..c23f40e 100644
+index 8151bde..9be301f 100644
--- a/arch/arm/plat-iop/setup.c
+++ b/arch/arm/plat-iop/setup.c
@@ -24,7 +24,7 @@ static struct map_desc iop3xx_std_desc[] __initdata = {
@@ -4752,7 +4906,7 @@ index 5b217f4..c23f40e 100644
.length = IOP3XX_PERIPHERAL_SIZE,
- .type = MT_UNCACHED,
+ .type = MT_UNCACHED_RW,
- },
+ },
};
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
@@ -4769,18 +4923,10 @@ index a5bc92d..0bb4730 100644
+ pax_close_kernel();
}
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
-index 2038492..a6adfda 100644
+index bc3f00f..88ded6a 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
-@@ -76,6 +76,7 @@ config ARM64
- select HAVE_FTRACE_MCOUNT_RECORD
- select HAVE_FUNCTION_TRACER
- select HAVE_FUNCTION_GRAPH_TRACER
-+ select HAVE_GCC_PLUGINS
- select HAVE_GENERIC_DMA_COHERENT
- select HAVE_HW_BREAKPOINT if PERF_EVENTS
- select HAVE_IRQ_TIME_ACCOUNTING
-@@ -872,6 +873,7 @@ config RELOCATABLE
+@@ -891,6 +891,7 @@ config RELOCATABLE
config RANDOMIZE_BASE
bool "Randomize the address of the kernel image"
@@ -4800,8 +4946,53 @@ index 0cc758c..de67415 100644
help
Say Y here if you want to show the kernel pagetable layout in a
debugfs file. This information is only useful for kernel developers
+diff --git a/arch/arm64/crypto/sha1-ce-glue.c b/arch/arm64/crypto/sha1-ce-glue.c
+index aefda98..2937874 100644
+--- a/arch/arm64/crypto/sha1-ce-glue.c
++++ b/arch/arm64/crypto/sha1-ce-glue.c
+@@ -29,7 +29,7 @@ struct sha1_ce_state {
+ u32 finalize;
+ };
+
+-asmlinkage void sha1_ce_transform(struct sha1_ce_state *sst, u8 const *src,
++asmlinkage void sha1_ce_transform(struct sha1_state *sst, u8 const *src,
+ int blocks);
+
+ static int sha1_ce_update(struct shash_desc *desc, const u8 *data,
+@@ -39,8 +39,7 @@ static int sha1_ce_update(struct shash_desc *desc, const u8 *data,
+
+ sctx->finalize = 0;
+ kernel_neon_begin_partial(16);
+- sha1_base_do_update(desc, data, len,
+- (sha1_block_fn *)sha1_ce_transform);
++ sha1_base_do_update(desc, data, len, sha1_ce_transform);
+ kernel_neon_end();
+
+ return 0;
+@@ -64,10 +63,9 @@ static int sha1_ce_finup(struct shash_desc *desc, const u8 *data,
+ sctx->finalize = finalize;
+
+ kernel_neon_begin_partial(16);
+- sha1_base_do_update(desc, data, len,
+- (sha1_block_fn *)sha1_ce_transform);
++ sha1_base_do_update(desc, data, len, sha1_ce_transform);
+ if (!finalize)
+- sha1_base_do_finalize(desc, (sha1_block_fn *)sha1_ce_transform);
++ sha1_base_do_finalize(desc, sha1_ce_transform);
+ kernel_neon_end();
+ return sha1_base_finish(desc, out);
+ }
+@@ -78,7 +76,7 @@ static int sha1_ce_final(struct shash_desc *desc, u8 *out)
+
+ sctx->finalize = 0;
+ kernel_neon_begin_partial(16);
+- sha1_base_do_finalize(desc, (sha1_block_fn *)sha1_ce_transform);
++ sha1_base_do_finalize(desc, sha1_ce_transform);
+ kernel_neon_end();
+ return sha1_base_finish(desc, out);
+ }
diff --git a/arch/arm64/include/asm/atomic.h b/arch/arm64/include/asm/atomic.h
-index f3a3586..9b37018 100644
+index c0235e0..86eb684 100644
--- a/arch/arm64/include/asm/atomic.h
+++ b/arch/arm64/include/asm/atomic.h
@@ -57,11 +57,13 @@
@@ -4818,7 +5009,7 @@ index f3a3586..9b37018 100644
#define atomic_inc_return_acquire(v) atomic_add_return_acquire(1, (v))
#define atomic_inc_return_release(v) atomic_add_return_release(1, (v))
#define atomic_inc_return(v) atomic_add_return(1, (v))
-@@ -98,6 +100,8 @@
+@@ -128,6 +130,8 @@
#define __atomic_add_unless(v, a, u) ___atomic_add_unless(v, a, u,)
#define atomic_andnot atomic_andnot
@@ -4827,7 +5018,7 @@ index f3a3586..9b37018 100644
/*
* 64-bit atomic operations.
*/
-@@ -146,5 +150,16 @@
+@@ -206,5 +210,16 @@
#define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
@@ -4865,10 +5056,10 @@ index 5082b30..9ef38c2 100644
/*
* Memory returned by kmalloc() may be used for DMA, so we must make
diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
-index 0a456be..7799ff5 100644
+index 5394c84..05e5a95 100644
--- a/arch/arm64/include/asm/percpu.h
+++ b/arch/arm64/include/asm/percpu.h
-@@ -127,16 +127,16 @@ static inline void __percpu_write(void *ptr, unsigned long val, int size)
+@@ -123,16 +123,16 @@ static inline void __percpu_write(void *ptr, unsigned long val, int size)
{
switch (size) {
case 1:
@@ -4918,7 +5109,7 @@ index d25f4f1..61d52da 100644
static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pud, pgdval_t prot)
{
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
-index 46472a9..83dc517 100644
+index e20bd43..7e476da 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -23,6 +23,9 @@
@@ -4931,7 +5122,7 @@ index 46472a9..83dc517 100644
/*
* VMALLOC range.
*
-@@ -701,6 +704,9 @@ static inline void update_mmu_cache(struct vm_area_struct *vma,
+@@ -718,6 +721,9 @@ static inline void update_mmu_cache(struct vm_area_struct *vma,
#define kc_vaddr_to_offset(v) ((v) & ~VA_START)
#define kc_offset_to_vaddr(o) ((o) | VA_START)
@@ -4941,6 +5132,22 @@ index 46472a9..83dc517 100644
#endif /* !__ASSEMBLY__ */
#endif /* __ASM_PGTABLE_H */
+diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
+index ace0a96..c7c4d3c 100644
+--- a/arch/arm64/include/asm/processor.h
++++ b/arch/arm64/include/asm/processor.h
+@@ -194,4 +194,11 @@ void cpu_enable_pan(void *__unused);
+ void cpu_enable_uao(void *__unused);
+ void cpu_enable_cache_maint_trap(void *__unused);
+
++#ifdef CONFIG_PAX_RAP
++static inline void pax_reload_rap_cookie(unsigned long *rap_cookie)
++{
++ asm volatile("mov\tx19, %0\n\t" : : "r"(*rap_cookie) : "r19");
++}
++#endif
++
+ #endif /* __ASM_PROCESSOR_H */
diff --git a/arch/arm64/include/asm/string.h b/arch/arm64/include/asm/string.h
index 2eb714c..3a10471 100644
--- a/arch/arm64/include/asm/string.h
@@ -4999,17 +5206,125 @@ index 2eb714c..3a10471 100644
#if defined(CONFIG_KASAN) && !defined(__SANITIZE_ADDRESS__)
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
-index 9e397a5..6cd98e5 100644
+index db84983..d256a3edc 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
-@@ -101,6 +101,7 @@ static inline void set_fs(mm_segment_t fs)
- flag; \
- })
+@@ -110,6 +110,7 @@ static inline void set_fs(mm_segment_t fs)
+ */
+ #define untagged_addr(addr) sign_extend64(addr, 55)
+#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size))
#define access_ok(type, addr, size) __range_ok(addr, size)
#define user_addr_max get_fs
+@@ -279,6 +280,9 @@ static inline unsigned long __must_check __copy_from_user(void *to, const void _
+
+ static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
++ if ((long)n < 0)
++ return n;
++
+ kasan_check_read(from, n);
+ check_object_size(from, n, true);
+ return __arch_copy_to_user(to, from, n);
+@@ -286,6 +290,9 @@ static inline unsigned long __must_check __copy_to_user(void __user *to, const v
+
+ static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
++ if ((long)n < 0)
++ return n;
++
+ kasan_check_write(to, n);
+
+ if (access_ok(VERIFY_READ, from, n)) {
+@@ -298,6 +305,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
+
+ static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
++ if ((long)n < 0)
++ return n;
++
+ kasan_check_read(from, n);
+
+ if (access_ok(VERIFY_WRITE, to, n)) {
+diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
+index 65d81f9..6a46f09 100644
+--- a/arch/arm64/kernel/hibernate.c
++++ b/arch/arm64/kernel/hibernate.c
+@@ -166,7 +166,7 @@ EXPORT_SYMBOL(arch_hibernation_header_restore);
+ static int create_safe_exec_page(void *src_start, size_t length,
+ unsigned long dst_addr,
+ phys_addr_t *phys_dst_addr,
+- void *(*allocator)(gfp_t mask),
++ unsigned long (*allocator)(gfp_t mask),
+ gfp_t mask)
+ {
+ int rc = 0;
+@@ -174,7 +174,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
+ pud_t *pud;
+ pmd_t *pmd;
+ pte_t *pte;
+- unsigned long dst = (unsigned long)allocator(mask);
++ unsigned long dst = allocator(mask);
+
+ if (!dst) {
+ rc = -ENOMEM;
+@@ -184,9 +184,9 @@ static int create_safe_exec_page(void *src_start, size_t length,
+ memcpy((void *)dst, src_start, length);
+ flush_icache_range(dst, dst + length);
+
+- pgd = pgd_offset_raw(allocator(mask), dst_addr);
++ pgd = pgd_offset_raw((pgd_t *)allocator(mask), dst_addr);
+ if (pgd_none(*pgd)) {
+- pud = allocator(mask);
++ pud = (pud_t *)allocator(mask);
+ if (!pud) {
+ rc = -ENOMEM;
+ goto out;
+@@ -196,7 +196,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
+
+ pud = pud_offset(pgd, dst_addr);
+ if (pud_none(*pud)) {
+- pmd = allocator(mask);
++ pmd = (pmd_t *)allocator(mask);
+ if (!pmd) {
+ rc = -ENOMEM;
+ goto out;
+@@ -206,7 +206,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
+
+ pmd = pmd_offset(pud, dst_addr);
+ if (pmd_none(*pmd)) {
+- pte = allocator(mask);
++ pte = (pte_t *)allocator(mask);
+ if (!pte) {
+ rc = -ENOMEM;
+ goto out;
+@@ -449,7 +449,7 @@ int swsusp_arch_resume(void)
+ rc = create_safe_exec_page(__hibernate_exit_text_start, exit_size,
+ (unsigned long)hibernate_exit,
+ &phys_hibernate_exit,
+- (void *)get_safe_page, GFP_ATOMIC);
++ get_safe_page, GFP_ATOMIC);
+ if (rc) {
+ pr_err("Failed to create safe executable page for hibernate_exit code.");
+ goto out;
+diff --git a/arch/arm64/kernel/probes/decode-insn.c b/arch/arm64/kernel/probes/decode-insn.c
+index 37e47a9..f8597fc 100644
+--- a/arch/arm64/kernel/probes/decode-insn.c
++++ b/arch/arm64/kernel/probes/decode-insn.c
+@@ -157,10 +157,10 @@ arm_kprobe_decode_insn(kprobe_opcode_t *addr, struct arch_specific_insn *asi)
+ mod = __module_address((unsigned long)addr);
+ if (mod && within_module_init((unsigned long)addr, mod) &&
+ !within_module_init((unsigned long)scan_end, mod))
+- scan_end = (kprobe_opcode_t *)mod->init_layout.base;
++ scan_end = (kprobe_opcode_t *)mod->init_layout.base_rx;
+ else if (mod && within_module_core((unsigned long)addr, mod) &&
+ !within_module_core((unsigned long)scan_end, mod))
+- scan_end = (kprobe_opcode_t *)mod->core_layout.base;
++ scan_end = (kprobe_opcode_t *)mod->core_layout.base_rx;
+ preempt_enable();
+ }
+ #endif
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index 6cd2612..56d72e5c 100644
--- a/arch/arm64/kernel/process.c
@@ -5072,10 +5387,10 @@ index d34fd72..8b6faee 100644
/* orig_sp is the saved pt_regs, find the elr */
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
-index f014df9..c4892f7 100644
+index 771a01a7f..db6d9cc 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
-@@ -420,7 +420,7 @@ asmlinkage long do_ni_syscall(struct pt_regs *regs)
+@@ -511,7 +511,7 @@ asmlinkage long do_ni_syscall(struct pt_regs *regs)
__show_regs(regs);
}
@@ -5137,7 +5452,7 @@ index 479330b..53717a8 100644
#endif /* __ASM_AVR32_KMAP_TYPES_H */
diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
-index c035339..e1fa594 100644
+index a4b7eda..d057f9e 100644
--- a/arch/avr32/mm/fault.c
+++ b/arch/avr32/mm/fault.c
@@ -41,6 +41,23 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
@@ -5248,10 +5563,10 @@ index 7caf25d..ee65ac5 100644
#define __read_mostly __attribute__((__section__(".data..read_mostly")))
diff --git a/arch/frv/include/asm/atomic.h b/arch/frv/include/asm/atomic.h
-index 64f02d4..c1b0839 100644
+index 1c2a5e2..2579e5f 100644
--- a/arch/frv/include/asm/atomic.h
+++ b/arch/frv/include/asm/atomic.h
-@@ -166,6 +166,16 @@ static inline void atomic64_dec(atomic64_t *v)
+@@ -146,6 +146,16 @@ static inline void atomic64_dec(atomic64_t *v)
#define atomic64_cmpxchg(v, old, new) (__cmpxchg_64(old, new, &(v)->counter))
#define atomic64_xchg(v, new) (__xchg_64(new, &(v)->counter))
@@ -5346,7 +5661,7 @@ index 69952c18..4fa2908 100644
#define ARCH_DMA_MINALIGN L1_CACHE_BYTES
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
-index e109ee9..a426a85 100644
+index 18ca6a9..77b0e0d 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -519,6 +519,7 @@ config KEXEC
@@ -5369,10 +5684,10 @@ index c100d78..07538cc 100644
make_nr_irqs_h:
$(Q)$(MAKE) $(build)=arch/ia64/kernel include/generated/nr-irqs.h
diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
-index 8dfb5f6..d58bd69 100644
+index f565ad3..484af46 100644
--- a/arch/ia64/include/asm/atomic.h
+++ b/arch/ia64/include/asm/atomic.h
-@@ -209,4 +209,14 @@ atomic64_add_negative (__s64 i, atomic64_t *v)
+@@ -307,4 +307,14 @@ atomic64_add_negative (__s64 i, atomic64_t *v)
#define atomic64_inc(v) atomic64_add(1, (v))
#define atomic64_dec(v) atomic64_sub(1, (v))
@@ -5488,10 +5803,10 @@ index 9f3ed9e..c99b418 100644
#define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
#define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
diff --git a/arch/ia64/include/asm/spinlock.h b/arch/ia64/include/asm/spinlock.h
-index 45698cd..e8e2dbc 100644
+index ca9e761..40dffaf 100644
--- a/arch/ia64/include/asm/spinlock.h
+++ b/arch/ia64/include/asm/spinlock.h
-@@ -71,7 +71,7 @@ static __always_inline void __ticket_spin_unlock(arch_spinlock_t *lock)
+@@ -73,7 +73,7 @@ static __always_inline void __ticket_spin_unlock(arch_spinlock_t *lock)
unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
@@ -5501,7 +5816,7 @@ index 45698cd..e8e2dbc 100644
static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
-index ebcd8a1..005b284 100644
+index bfe1319..da0014b 100644
--- a/arch/ia64/include/asm/uaccess.h
+++ b/arch/ia64/include/asm/uaccess.h
@@ -70,6 +70,7 @@
@@ -5512,17 +5827,17 @@ index ebcd8a1..005b284 100644
#define access_ok(type, addr, size) __access_ok((addr), (size), get_fs())
/*
-@@ -241,12 +242,24 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
+@@ -241,17 +242,23 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
static inline unsigned long
__copy_to_user (void __user *to, const void *from, unsigned long count)
{
+ if (count > INT_MAX)
+ return count;
+
-+ if (!__builtin_constant_p(count))
-+ check_object_size(from, count, true);
-+
- return __copy_user(to, (__force void __user *) from, count);
+ check_object_size(from, count, true);
+
+- return __copy_user(to, (__force void __user *) from, count);
++ return __copy_user(to, (void __force_user *) from, count);
}
static inline unsigned long
@@ -5531,31 +5846,34 @@ index ebcd8a1..005b284 100644
+ if (count > INT_MAX)
+ return count;
+
-+ if (!__builtin_constant_p(count))
-+ check_object_size(to, count, false);
-+
- return __copy_user((__force void __user *) to, from, count);
+ check_object_size(to, count, false);
+
+- return __copy_user((__force void __user *) to, from, count);
++ return __copy_user((void __force_user *) to, from, count);
}
-@@ -256,19 +269,23 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+ #define __copy_to_user_inatomic __copy_to_user
+@@ -260,11 +267,11 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
({ \
void __user *__cu_to = (to); \
const void *__cu_from = (from); \
- long __cu_len = (n); \
+ unsigned long __cu_len = (n); \
\
-- if (__access_ok(__cu_to, __cu_len, get_fs())) \
+- if (__access_ok(__cu_to, __cu_len, get_fs())) { \
+- check_object_size(__cu_from, __cu_len, true); \
+- __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
+ if (__cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) { \
-+ if (!__builtin_constant_p(n)) \
-+ check_object_size(__cu_from, __cu_len, true); \
- __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
-+ } \
++ check_object_size(__cu_from, __cu_len, true); \
++ __cu_len = __copy_user(__cu_to, (void __force_user *) __cu_from, __cu_len); \
+ } \
__cu_len; \
})
-
+@@ -272,10 +279,10 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
static inline unsigned long
copy_from_user(void *to, const void __user *from, unsigned long n)
{
+- check_object_size(to, n, false);
- if (likely(__access_ok(from, n, get_fs())))
- n = __copy_user((__force void __user *) to, from, n);
- else
@@ -5682,7 +6000,7 @@ index dc506b0..39baade 100644
* ensure percpu data fits
* into percpu page size
diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
-index 70b40d1..01a9a28 100644
+index fa6ad95..b46bd89 100644
--- a/arch/ia64/mm/fault.c
+++ b/arch/ia64/mm/fault.c
@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned long address)
@@ -5842,6 +6160,18 @@ index 0395c51..5f26031 100644
#define ARCH_DMA_MINALIGN L1_CACHE_BYTES
+diff --git a/arch/m68k/kernel/time.c b/arch/m68k/kernel/time.c
+index 4e5aa2f..172c469 100644
+--- a/arch/m68k/kernel/time.c
++++ b/arch/m68k/kernel/time.c
+@@ -107,6 +107,7 @@ static int rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
+
+ switch (cmd) {
+ case RTC_PLL_GET:
++ memset(&pll, 0, sizeof(pll));
+ if (!mach_get_rtc_pll || mach_get_rtc_pll(&pll))
+ return -EINVAL;
+ return copy_to_user(argp, &pll, sizeof pll) ? -EFAULT : 0;
diff --git a/arch/metag/mm/hugetlbpage.c b/arch/metag/mm/hugetlbpage.c
index db1b7da..8e13684 100644
--- a/arch/metag/mm/hugetlbpage.c
@@ -5886,7 +6216,7 @@ index 5c3f688..f8cc1b3 100644
# platform specific definitions
include arch/mips/Kbuild.platforms
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
-index ac91939..810f609 100644
+index 212ff92..36b3437 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -50,6 +50,7 @@ config MIPS
@@ -5897,7 +6227,7 @@ index ac91939..810f609 100644
select MODULES_USE_ELF_REL if MODULES
select MODULES_USE_ELF_RELA if MODULES && 64BIT
select CLONE_BACKWARDS
-@@ -2569,7 +2570,7 @@ config RELOCATION_TABLE_SIZE
+@@ -2561,7 +2562,7 @@ config RELOCATION_TABLE_SIZE
config RANDOMIZE_BASE
bool "Randomize the address of the kernel image"
@@ -5906,7 +6236,7 @@ index ac91939..810f609 100644
---help---
Randomizes the physical and virtual address at which the
kernel image is loaded, as a security feature that
-@@ -2775,6 +2776,7 @@ source "kernel/Kconfig.preempt"
+@@ -2777,6 +2778,7 @@ source "kernel/Kconfig.preempt"
config KEXEC
bool "Kexec system call"
select KEXEC_CORE
@@ -5915,7 +6245,7 @@ index ac91939..810f609 100644
kexec is a system call that implements the ability to shutdown your
current kernel, and to start another kernel. It is like a reboot
diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
-index 835b402..347a797 100644
+index 0ab176b..c4469a4 100644
--- a/arch/mips/include/asm/atomic.h
+++ b/arch/mips/include/asm/atomic.h
@@ -22,15 +22,39 @@
@@ -6020,7 +6350,7 @@ index 835b402..347a797 100644
- " " #asm_op " %0, %2 \n" \
- " sc %0, %1 \n" \
- " .set mips0 \n" \
-- : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (v->counter) \
+- : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (v->counter) \
- : "Ir" (i)); \
- } while (unlikely(!temp)); \
+ __asm__ __volatile__( \
@@ -6047,16 +6377,16 @@ index 835b402..347a797 100644
}
-#define ATOMIC_OP_RETURN(op, c_op, asm_op) \
--static __inline__ int atomic_##op##_return(int i, atomic_t * v) \
+-static __inline__ int atomic_##op##_return_relaxed(int i, atomic_t * v) \
+#define ATOMIC_OP(op, asm_op) __ATOMIC_OP(op, _unchecked, asm_op##u, ) \
+ __ATOMIC_OP(op, , asm_op, __OVERFLOW_EXTABLE)
+
+#define __ATOMIC_OP_RETURN(op, suffix, asm_op, post_op, extable) \
-+static inline int atomic_##op##_return##suffix(int i, atomic##suffix##_t * v) \
++static inline int atomic_##op##_return##suffix##_relaxed(int i, atomic##suffix##_t * v) \
{ \
int result; \
\
-@@ -89,12 +143,15 @@ static __inline__ int atomic_##op##_return(int i, atomic_t * v) \
+@@ -87,12 +141,15 @@ static __inline__ int atomic_##op##_return_relaxed(int i, atomic_t * v) \
int temp; \
\
__asm__ __volatile__( \
@@ -6076,7 +6406,7 @@ index 835b402..347a797 100644
" .set mips0 \n" \
: "=&r" (result), "=&r" (temp), \
"+" GCC_OFF_SMALL_ASM() (v->counter) \
-@@ -102,26 +159,31 @@ static __inline__ int atomic_##op##_return(int i, atomic_t * v) \
+@@ -100,32 +157,40 @@ static __inline__ int atomic_##op##_return_relaxed(int i, atomic_t * v) \
} else if (kernel_uses_llsc) { \
int temp; \
\
@@ -6124,33 +6454,58 @@ index 835b402..347a797 100644
raw_local_irq_restore(flags); \
} \
\
-@@ -130,20 +192,25 @@ static __inline__ int atomic_##op##_return(int i, atomic_t * v) \
return result; \
}
--#define ATOMIC_OPS(op, c_op, asm_op) \
-- ATOMIC_OP(op, c_op, asm_op) \
-- ATOMIC_OP_RETURN(op, c_op, asm_op)
+#define ATOMIC_OP_RETURN(op, asm_op) __ATOMIC_OP_RETURN(op, _unchecked, asm_op##u, , ) \
+ __ATOMIC_OP_RETURN(op, , asm_op, __OVERFLOW_POST, __OVERFLOW_EXTABLE)
++
+ #define ATOMIC_FETCH_OP(op, c_op, asm_op) \
+ static __inline__ int atomic_fetch_##op##_relaxed(int i, atomic_t * v) \
+ { \
+@@ -173,13 +238,13 @@ static __inline__ int atomic_fetch_##op##_relaxed(int i, atomic_t * v) \
+ return result; \
+ }
+
+-#define ATOMIC_OPS(op, c_op, asm_op) \
+- ATOMIC_OP(op, c_op, asm_op) \
+- ATOMIC_OP_RETURN(op, c_op, asm_op) \
+- ATOMIC_FETCH_OP(op, c_op, asm_op)
++#define ATOMIC_OPS(op, asm_op) \
++ ATOMIC_OP(op, asm_op) \
++ ATOMIC_OP_RETURN(op, asm_op) \
++ ATOMIC_FETCH_OP(op, asm_op)
-ATOMIC_OPS(add, +=, addu)
-ATOMIC_OPS(sub, -=, subu)
-+#define ATOMIC_OPS(op, asm_op) \
-+ ATOMIC_OP(op, asm_op) \
-+ ATOMIC_OP_RETURN(op, asm_op)
++ATOMIC_OPS(add, addu)
++ATOMIC_OPS(sub, subu)
--ATOMIC_OP(and, &=, and)
--ATOMIC_OP(or, |=, or)
--ATOMIC_OP(xor, ^=, xor)
-+ATOMIC_OPS(add, add)
-+ATOMIC_OPS(sub, sub)
-+
-+ATOMIC_OP(and, and)
-+ATOMIC_OP(or, or)
-+ATOMIC_OP(xor, xor)
+ #define atomic_add_return_relaxed atomic_add_return_relaxed
+ #define atomic_sub_return_relaxed atomic_sub_return_relaxed
+@@ -187,13 +252,13 @@ ATOMIC_OPS(sub, -=, subu)
+ #define atomic_fetch_sub_relaxed atomic_fetch_sub_relaxed
#undef ATOMIC_OPS
+-#define ATOMIC_OPS(op, c_op, asm_op) \
+- ATOMIC_OP(op, c_op, asm_op) \
+- ATOMIC_FETCH_OP(op, c_op, asm_op)
++#define ATOMIC_OPS(op, asm_op) \
++ ATOMIC_OP(op, asm_op) \
++ ATOMIC_FETCH_OP(op, asm_op)
+
+-ATOMIC_OPS(and, &=, and)
+-ATOMIC_OPS(or, |=, or)
+-ATOMIC_OPS(xor, ^=, xor)
++ATOMIC_OPS(and, and)
++ATOMIC_OPS(or, or)
++ATOMIC_OPS(xor, xor)
+
+ #define atomic_fetch_and_relaxed atomic_fetch_and_relaxed
+ #define atomic_fetch_or_relaxed atomic_fetch_or_relaxed
+@@ -202,7 +267,9 @@ ATOMIC_OPS(xor, ^=, xor)
+ #undef ATOMIC_OPS
+ #undef ATOMIC_FETCH_OP
#undef ATOMIC_OP_RETURN
+#undef __ATOMIC_OP_RETURN
#undef ATOMIC_OP
@@ -6158,7 +6513,7 @@ index 835b402..347a797 100644
/*
* atomic_sub_if_positive - conditionally subtract integer from atomic variable
-@@ -153,7 +220,7 @@ ATOMIC_OP(xor, ^=, xor)
+@@ -212,7 +279,7 @@ ATOMIC_OPS(xor, ^=, xor)
* Atomically test @v and subtract @i if @v is greater or equal than @i.
* The function returns the old value of @v minus @i.
*/
@@ -6167,7 +6522,7 @@ index 835b402..347a797 100644
{
int result;
-@@ -163,7 +230,7 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
+@@ -222,7 +289,7 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
int temp;
__asm__ __volatile__(
@@ -6176,7 +6531,7 @@ index 835b402..347a797 100644
"1: ll %1, %2 # atomic_sub_if_positive\n"
" subu %0, %1, %3 \n"
" bltz %0, 1f \n"
-@@ -212,8 +279,26 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
+@@ -271,8 +338,26 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
return result;
}
@@ -6205,7 +6560,7 @@ index 835b402..347a797 100644
/**
* __atomic_add_unless - add unless the number is a given value
-@@ -241,6 +326,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
+@@ -300,6 +385,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
#define atomic_dec_return(v) atomic_sub_return(1, (v))
#define atomic_inc_return(v) atomic_add_return(1, (v))
@@ -6216,7 +6571,7 @@ index 835b402..347a797 100644
/*
* atomic_sub_and_test - subtract value from variable and test result
-@@ -262,6 +351,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
+@@ -321,6 +410,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
* other cases.
*/
#define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
@@ -6227,7 +6582,7 @@ index 835b402..347a797 100644
/*
* atomic_dec_and_test - decrement by 1 and test
-@@ -286,6 +379,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
+@@ -345,6 +438,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
* Atomically increments @v by 1.
*/
#define atomic_inc(v) atomic_add(1, (v))
@@ -6238,7 +6593,7 @@ index 835b402..347a797 100644
/*
* atomic_dec - decrement and test
-@@ -294,6 +391,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
+@@ -353,6 +450,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
* Atomically decrements @v by 1.
*/
#define atomic_dec(v) atomic_sub(1, (v))
@@ -6249,7 +6604,7 @@ index 835b402..347a797 100644
/*
* atomic_add_negative - add and test if negative
-@@ -315,54 +416,77 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
+@@ -374,54 +475,77 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
* @v: pointer of type atomic64_t
*
*/
@@ -6338,16 +6693,16 @@ index 835b402..347a797 100644
}
-#define ATOMIC64_OP_RETURN(op, c_op, asm_op) \
--static __inline__ long atomic64_##op##_return(long i, atomic64_t * v) \
+-static __inline__ long atomic64_##op##_return_relaxed(long i, atomic64_t * v) \
+#define ATOMIC64_OP(op, asm_op) __ATOMIC64_OP(op, _unchecked, asm_op##u, ) \
+ __ATOMIC64_OP(op, , asm_op, __OVERFLOW_EXTABLE)
+
+#define __ATOMIC64_OP_RETURN(op, suffix, asm_op, post_op, extable) \
-+static inline long atomic64_##op##_return##suffix(long i, atomic64##suffix##_t * v)\
++static inline long atomic64_##op##_return##suffix##_relaxed(long i, atomic64##suffix##_t * v)\
{ \
long result; \
\
-@@ -372,12 +496,15 @@ static __inline__ long atomic64_##op##_return(long i, atomic64_t * v) \
+@@ -429,12 +553,15 @@ static __inline__ long atomic64_##op##_return_relaxed(long i, atomic64_t * v) \
long temp; \
\
__asm__ __volatile__( \
@@ -6366,7 +6721,7 @@ index 835b402..347a797 100644
" .set mips0 \n" \
: "=&r" (result), "=&r" (temp), \
"+" GCC_OFF_SMALL_ASM() (v->counter) \
-@@ -385,27 +512,33 @@ static __inline__ long atomic64_##op##_return(long i, atomic64_t * v) \
+@@ -442,33 +569,42 @@ static __inline__ long atomic64_##op##_return_relaxed(long i, atomic64_t * v) \
} else if (kernel_uses_llsc) { \
long temp; \
\
@@ -6417,33 +6772,58 @@ index 835b402..347a797 100644
raw_local_irq_restore(flags); \
} \
\
-@@ -414,19 +547,27 @@ static __inline__ long atomic64_##op##_return(long i, atomic64_t * v) \
return result; \
}
--#define ATOMIC64_OPS(op, c_op, asm_op) \
-- ATOMIC64_OP(op, c_op, asm_op) \
-- ATOMIC64_OP_RETURN(op, c_op, asm_op)
+#define ATOMIC64_OP_RETURN(op, asm_op) __ATOMIC64_OP_RETURN(op, _unchecked, asm_op##u, , ) \
+ __ATOMIC64_OP_RETURN(op, , asm_op, __OVERFLOW_POST, __OVERFLOW_EXTABLE)
++
+ #define ATOMIC64_FETCH_OP(op, c_op, asm_op) \
+ static __inline__ long atomic64_fetch_##op##_relaxed(long i, atomic64_t * v) \
+ { \
+@@ -517,13 +653,13 @@ static __inline__ long atomic64_fetch_##op##_relaxed(long i, atomic64_t * v) \
+ return result; \
+ }
+
+-#define ATOMIC64_OPS(op, c_op, asm_op) \
+- ATOMIC64_OP(op, c_op, asm_op) \
+- ATOMIC64_OP_RETURN(op, c_op, asm_op) \
+- ATOMIC64_FETCH_OP(op, c_op, asm_op)
++#define ATOMIC64_OPS(op, asm_op) \
++ ATOMIC64_OP(op, asm_op) \
++ ATOMIC64_OP_RETURN(op, asm_op) \
++ ATOMIC64_FETCH_OP(op, asm_op)
-ATOMIC64_OPS(add, +=, daddu)
-ATOMIC64_OPS(sub, -=, dsubu)
--ATOMIC64_OP(and, &=, and)
--ATOMIC64_OP(or, |=, or)
--ATOMIC64_OP(xor, ^=, xor)
-+#define ATOMIC64_OPS(op, asm_op) \
-+ ATOMIC64_OP(op, asm_op) \
-+ ATOMIC64_OP_RETURN(op, asm_op)
-+
-+ATOMIC64_OPS(add, dadd)
-+ATOMIC64_OPS(sub, dsub)
-+
-+ATOMIC64_OP(and, and)
-+ATOMIC64_OP(or, or)
-+ATOMIC64_OP(xor, xor)
++ATOMIC64_OPS(add, daddu)
++ATOMIC64_OPS(sub, dsubu)
+
+ #define atomic64_add_return_relaxed atomic64_add_return_relaxed
+ #define atomic64_sub_return_relaxed atomic64_sub_return_relaxed
+@@ -531,13 +667,13 @@ ATOMIC64_OPS(sub, -=, dsubu)
+ #define atomic64_fetch_sub_relaxed atomic64_fetch_sub_relaxed
#undef ATOMIC64_OPS
+-#define ATOMIC64_OPS(op, c_op, asm_op) \
+- ATOMIC64_OP(op, c_op, asm_op) \
+- ATOMIC64_FETCH_OP(op, c_op, asm_op)
++#define ATOMIC64_OPS(op, asm_op) \
++ ATOMIC64_OP(op, asm_op) \
++ ATOMIC64_FETCH_OP(op, asm_op)
+
+-ATOMIC64_OPS(and, &=, and)
+-ATOMIC64_OPS(or, |=, or)
+-ATOMIC64_OPS(xor, ^=, xor)
++ATOMIC64_OPS(and, and)
++ATOMIC64_OPS(or, or)
++ATOMIC64_OPS(xor, xor)
+
+ #define atomic64_fetch_and_relaxed atomic64_fetch_and_relaxed
+ #define atomic64_fetch_or_relaxed atomic64_fetch_or_relaxed
+@@ -546,7 +682,11 @@ ATOMIC64_OPS(xor, ^=, xor)
+ #undef ATOMIC64_OPS
+ #undef ATOMIC64_FETCH_OP
#undef ATOMIC64_OP_RETURN
+#undef __ATOMIC64_OP_RETURN
#undef ATOMIC64_OP
@@ -6453,7 +6833,7 @@ index 835b402..347a797 100644
/*
* atomic64_sub_if_positive - conditionally subtract integer from atomic
-@@ -437,7 +578,7 @@ ATOMIC64_OP(xor, ^=, xor)
+@@ -557,7 +697,7 @@ ATOMIC64_OPS(xor, ^=, xor)
* Atomically test @v and subtract @i if @v is greater or equal than @i.
* The function returns the old value of @v minus @i.
*/
@@ -6462,7 +6842,7 @@ index 835b402..347a797 100644
{
long result;
-@@ -447,7 +588,7 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
+@@ -567,7 +707,7 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
long temp;
__asm__ __volatile__(
@@ -6471,7 +6851,7 @@ index 835b402..347a797 100644
"1: lld %1, %2 # atomic64_sub_if_positive\n"
" dsubu %0, %1, %3 \n"
" bltz %0, 1f \n"
-@@ -496,9 +637,26 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
+@@ -616,9 +756,26 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
return result;
}
@@ -6501,7 +6881,7 @@ index 835b402..347a797 100644
/**
* atomic64_add_unless - add unless the number is a given value
-@@ -528,6 +686,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+@@ -648,6 +805,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
#define atomic64_dec_return(v) atomic64_sub_return(1, (v))
#define atomic64_inc_return(v) atomic64_add_return(1, (v))
@@ -6509,7 +6889,7 @@ index 835b402..347a797 100644
/*
* atomic64_sub_and_test - subtract value from variable and test result
-@@ -549,6 +708,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+@@ -669,6 +827,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
* other cases.
*/
#define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
@@ -6517,7 +6897,7 @@ index 835b402..347a797 100644
/*
* atomic64_dec_and_test - decrement by 1 and test
-@@ -573,6 +733,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+@@ -693,6 +852,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
* Atomically increments @v by 1.
*/
#define atomic64_inc(v) atomic64_add(1, (v))
@@ -6525,7 +6905,7 @@ index 835b402..347a797 100644
/*
* atomic64_dec - decrement and test
-@@ -581,6 +742,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+@@ -701,6 +861,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
* Atomically decrements @v by 1.
*/
#define atomic64_dec(v) atomic64_sub(1, (v))
@@ -6551,7 +6931,7 @@ index b4db69f..8f3b093 100644
#define SMP_CACHE_SHIFT L1_CACHE_SHIFT
#define SMP_CACHE_BYTES L1_CACHE_BYTES
diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
-index f5f4571..38cf967 100644
+index 2b3dc29..1f7bdc4 100644
--- a/arch/mips/include/asm/elf.h
+++ b/arch/mips/include/asm/elf.h
@@ -458,6 +458,13 @@ extern const char *__elf_platform;
@@ -6565,9 +6945,9 @@ index f5f4571..38cf967 100644
+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
+#endif
+
+ /* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */
#define ARCH_DLINFO \
do { \
- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
diff --git a/arch/mips/include/asm/exec.h b/arch/mips/include/asm/exec.h
index c1f6afa..38cc6e9 100644
--- a/arch/mips/include/asm/exec.h
@@ -6697,7 +7077,7 @@ index 8feaed6..1bd8a64 100644
/**
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
-index 21ed715..774a251 100644
+index 5f98759..a3a7cb2 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -118,7 +118,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
@@ -6726,7 +7106,7 @@ index 93c079a..1d6bf7c 100644
/*
diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
-index 7d44e88..6f28830 100644
+index 70128d3..471bc25 100644
--- a/arch/mips/include/asm/pgtable.h
+++ b/arch/mips/include/asm/pgtable.h
@@ -20,6 +20,9 @@
@@ -6782,7 +7162,7 @@ index e309d8f..20eefec 100644
/*
* We stash processor id into a COP0 register to retrieve it fast
diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
-index b6e20f3..afabc54 100644
+index 21a2aab..c00b80d 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -147,6 +147,7 @@ static inline bool eva_kernel_access(void)
@@ -6885,7 +7265,7 @@ index f25f7ea..19e1c62 100644
}
#else
diff --git a/arch/mips/kernel/pm-cps.c b/arch/mips/kernel/pm-cps.c
-index adda3ff..ac067e2 100644
+index 5b31a94..15ac4a1 100644
--- a/arch/mips/kernel/pm-cps.c
+++ b/arch/mips/kernel/pm-cps.c
@@ -172,7 +172,7 @@ int cps_pm_enter_state(enum cps_pm_state state)
@@ -6898,10 +7278,10 @@ index adda3ff..ac067e2 100644
/* Run the generated entry code */
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
-index 45cff9f..f3eae55 100644
+index d2d0615..46c1803 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
-@@ -531,18 +531,6 @@ out:
+@@ -545,18 +545,6 @@ out:
return pc;
}
@@ -6921,7 +7301,7 @@ index 45cff9f..f3eae55 100644
{
struct pt_regs *regs;
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
-index 0dcf691..b75d89a 100644
+index 6103b24..8253315 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -882,6 +882,10 @@ long arch_ptrace(struct task_struct *child, long request,
@@ -6935,9 +7315,9 @@ index 0dcf691..b75d89a 100644
/*
* Notification of system call entry/exit
* - triggered by current->work.syscall_trace
-@@ -900,6 +904,11 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)
- tracehook_report_syscall_entry(regs))
- ret = -1;
+@@ -899,6 +903,11 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)
+ if (secure_computing(NULL) == -1)
+ return -1;
+#ifdef CONFIG_GRKERNSEC_SETXID
+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
@@ -7017,7 +7397,7 @@ index 4472a7f..c5905e6 100644
}
/* Arrange for an interrupt in a short while */
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
-index 4a1712b..a1348b9 100644
+index 3de85be..73560ec 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -695,7 +695,18 @@ asmlinkage void do_ov(struct pt_regs *regs)
@@ -7029,7 +7409,7 @@ index 4a1712b..a1348b9 100644
+
+#ifdef CONFIG_PAX_REFCOUNT
+ if (fixup_exception(regs)) {
-+ pax_report_refcount_overflow(regs);
++ pax_report_refcount_error(regs, NULL);
+ exception_exit(prev_state);
+ return;
+ }
@@ -7169,7 +7549,7 @@ index 05909d58..b03284b 100644
#endif /* __ASM_LIBGCC_H */
diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
-index 4b88fa0..b16bc17 100644
+index 9560ad7..da27540 100644
--- a/arch/mips/mm/fault.c
+++ b/arch/mips/mm/fault.c
@@ -31,6 +31,23 @@
@@ -7212,10 +7592,10 @@ index 4b88fa0..b16bc17 100644
tsk->thread.error_code = write;
if (show_unhandled_signals &&
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
-index 9b58eb5..b1f2558 100644
+index 72f7478..06abd2a 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
-@@ -472,10 +472,10 @@ void __init mem_init(void)
+@@ -474,10 +474,10 @@ void __init mem_init(void)
#ifdef CONFIG_64BIT
if ((unsigned long) &_text > (unsigned long) CKSEG0)
@@ -7434,10 +7814,10 @@ index 4ce7a01..449202a 100644
#endif /* __ASM_OPENRISC_CACHE_H */
diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
-index 1d10999..5907031 100644
+index 5394b9c..e77a306 100644
--- a/arch/parisc/include/asm/atomic.h
+++ b/arch/parisc/include/asm/atomic.h
-@@ -280,6 +280,16 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
+@@ -327,6 +327,16 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
return dec;
}
@@ -7518,7 +7898,7 @@ index f08dda3..ea6aa1b 100644
#endif
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
-index 291cee2..2ac33db 100644
+index c2c43f7..b08ffd9 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
@@ -236,6 +236,17 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
@@ -7540,10 +7920,10 @@ index 291cee2..2ac33db 100644
#define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC)
#define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX)
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
-index 37a1bee..cfcf0bf 100644
+index 4828478..89b1fbe 100644
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
-@@ -221,14 +221,14 @@ static inline unsigned long __must_check copy_from_user(void *to,
+@@ -221,17 +221,17 @@ static inline unsigned long __must_check copy_from_user(void *to,
const void __user *from,
unsigned long n)
{
@@ -7551,11 +7931,14 @@ index 37a1bee..cfcf0bf 100644
+ size_t sz = __compiletime_object_size(to);
unsigned long ret = n;
-- if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n))
-+ if (likely(sz == (size_t)-1 || !__builtin_constant_p(n) || sz >= n))
+- if (likely(sz == -1 || sz >= n))
++ if (likely(sz == (size_t)-1 || sz >= n))
ret = __copy_from_user(to, from, n);
- else
- copy_from_user_overflow();
+ else if (!__builtin_constant_p(n))
+ copy_user_overflow(sz, n);
+ else
+ __bad_copy_user();
+
- if (unlikely(ret))
+ if (unlikely(ret && (long)ret > 0))
memset(to + (n - ret), 0, ret);
@@ -7726,7 +8109,7 @@ index 97d6b20..2ab0232 100644
fault_space = regs->iasq[0];
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
-index 16dbe81..db2ed24 100644
+index 163af2c..ed77b14 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -16,6 +16,7 @@
@@ -7899,7 +8282,7 @@ index 16dbe81..db2ed24 100644
/*
* If for any reason at all we couldn't handle the fault, make
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
-index 0a9d439..2b95815 100644
+index 792cb17..1a96a22 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -146,6 +146,7 @@ config PPC
@@ -7910,7 +8293,7 @@ index 0a9d439..2b95815 100644
select HAVE_DEBUG_STACKOVERFLOW
select HAVE_IRQ_EXIT_ON_IRQ_STACK
select ARCH_USE_CMPXCHG_LOCKREF if PPC64
-@@ -443,6 +444,7 @@ config KEXEC
+@@ -446,6 +447,7 @@ config KEXEC
bool "kexec system call"
depends on (PPC_BOOK3S || FSL_BOOKE || (44x && !SMP)) || PPC_BOOK3E
select KEXEC_CORE
@@ -7919,14 +8302,10 @@ index 0a9d439..2b95815 100644
kexec is a system call that implements the ability to shutdown your
current kernel, and to start another kernel. It is like a reboot
diff --git a/arch/powerpc/include/asm/atomic.h b/arch/powerpc/include/asm/atomic.h
-index ae0751e..4f02720 100644
+index f08d567..94e5497 100644
--- a/arch/powerpc/include/asm/atomic.h
+++ b/arch/powerpc/include/asm/atomic.h
-@@ -9,9 +9,15 @@
- #include <linux/types.h>
- #include <asm/cmpxchg.h>
- #include <asm/barrier.h>
-+#include <asm/asm-compat.h>
+@@ -12,6 +12,11 @@
#define ATOMIC_INIT(i) { (i) }
@@ -7938,7 +8317,7 @@ index ae0751e..4f02720 100644
/*
* Since *_return_relaxed and {cmp}xchg_relaxed are implemented with
* a "bne-" instruction at the end, so an isync is enough as a acquire barrier
-@@ -39,38 +45,79 @@ static __inline__ int atomic_read(const atomic_t *v)
+@@ -39,38 +44,79 @@ static __inline__ int atomic_read(const atomic_t *v)
return t;
}
@@ -8024,24 +8403,27 @@ index ae0751e..4f02720 100644
: "=&r" (t), "+m" (v->counter) \
: "r" (a), "r" (&v->counter) \
: "cc"); \
-@@ -78,6 +125,9 @@ static inline int atomic_##op##_return_relaxed(int a, atomic_t *v) \
+@@ -78,6 +124,9 @@ static inline int atomic_##op##_return_relaxed(int a, atomic_t *v) \
return t; \
}
+#define ATOMIC_OP_RETURN_RELAXED(op, asm_op) __ATOMIC_OP_RETURN(op, , , asm_op, , )\
+ __ATOMIC_OP_RETURN(op, _unchecked, __OVERFLOW_PRE, __REFCOUNT_OP(asm_op), __OVERFLOW_POST, __OVERFLOW_EXTABLE)
+
- #define ATOMIC_OPS(op, asm_op) \
- ATOMIC_OP(op, asm_op) \
- ATOMIC_OP_RETURN_RELAXED(op, asm_op)
-@@ -90,45 +140,27 @@ ATOMIC_OP(or, or)
- ATOMIC_OP(xor, xor)
+ #define ATOMIC_FETCH_OP_RELAXED(op, asm_op) \
+ static inline int atomic_fetch_##op##_relaxed(int a, atomic_t *v) \
+ { \
+@@ -105,6 +154,7 @@ ATOMIC_OPS(add, add)
+ ATOMIC_OPS(sub, subf)
#define atomic_add_return_relaxed atomic_add_return_relaxed
+#define atomic_add_return_unchecked_relaxed atomic_add_return_unchecked_relaxed
#define atomic_sub_return_relaxed atomic_sub_return_relaxed
+ #define atomic_fetch_add_relaxed atomic_fetch_add_relaxed
+@@ -126,41 +176,22 @@ ATOMIC_OPS(xor, xor)
#undef ATOMIC_OPS
+ #undef ATOMIC_FETCH_OP_RELAXED
#undef ATOMIC_OP_RETURN_RELAXED
+#undef __ATOMIC_OP_RETURN
#undef ATOMIC_OP
@@ -8093,7 +8475,7 @@ index ae0751e..4f02720 100644
/*
* atomic_inc_and_test - increment and test
-@@ -139,42 +171,22 @@ static __inline__ int atomic_inc_return_relaxed(atomic_t *v)
+@@ -171,37 +202,20 @@ static __inline__ int atomic_inc_return_relaxed(atomic_t *v)
* other cases.
*/
#define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
@@ -8143,13 +8525,8 @@ index ae0751e..4f02720 100644
+ atomic_sub_unchecked(1, v);
}
--#define atomic_inc_return_relaxed atomic_inc_return_relaxed
--#define atomic_dec_return_relaxed atomic_dec_return_relaxed
--
- #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
- #define atomic_cmpxchg_relaxed(v, o, n) \
- cmpxchg_relaxed(&((v)->counter), (o), (n))
-@@ -184,6 +196,13 @@ static __inline__ int atomic_dec_return_relaxed(atomic_t *v)
+ #define atomic_inc_return_relaxed atomic_inc_return_relaxed
+@@ -216,6 +230,16 @@ static __inline__ int atomic_dec_return_relaxed(atomic_t *v)
#define atomic_xchg(v, new) (xchg(&((v)->counter), new))
#define atomic_xchg_relaxed(v, new) xchg_relaxed(&((v)->counter), (new))
@@ -8158,42 +8535,40 @@ index ae0751e..4f02720 100644
+ return cmpxchg(&(v->counter), old, new);
+}
+
-+#define atomic_xchg_unchecked(v, new) (xchg_unchecked(&((v)->counter), new))
++static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
++{
++ return xchg(&(v->counter), new);
++}
+
/**
* __atomic_add_unless - add unless the number is a given value
* @v: pointer of type atomic_t
-@@ -201,11 +220,27 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
+@@ -233,14 +257,21 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
PPC_ATOMIC_ENTRY_BARRIER
"1: lwarx %0,0,%1 # __atomic_add_unless\n\
cmpw 0,%0,%3 \n\
- beq- 2f \n\
- add %0,%2,%0 \n"
-+ beq- 2f \n"
++ beq- 5f \n"
+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" mcrxr cr0\n"
-+" addo. %0,%2,%0\n"
-+" bf 4*cr0+so, 4f\n"
-+"3:.long " "0x00c00b00""\n"
-+"4:\n"
-+#else
-+ "add %0,%2,%0 \n"
-+#endif
++ __OVERFLOW_PRE
++ __REFCOUNT_OP(add) " %0,%2,%0 \n"
++ __OVERFLOW_POST
+
PPC405_ERR77(0,%2)
" stwcx. %0,0,%1 \n\
bne- 1b \n"
-+"5:"
+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ _ASM_EXTABLE(3b, 5b)
-+#endif
++ __OVERFLOW_EXTABLE
+
PPC_ATOMIC_EXIT_BARRIER
" subf %0,%2,%0 \n\
- 2:"
-@@ -291,37 +326,59 @@ static __inline__ long atomic64_read(const atomic64_t *v)
+-2:"
++5:"
+ : "=&r" (t)
+ : "r" (&v->counter), "r" (a), "r" (u)
+ : "cc", "memory");
+@@ -323,37 +354,59 @@ static __inline__ long atomic64_read(const atomic64_t *v)
return t;
}
@@ -8258,19 +8633,19 @@ index ae0751e..4f02720 100644
: "=&r" (t), "+m" (v->counter) \
: "r" (a), "r" (&v->counter) \
: "cc"); \
-@@ -329,6 +386,9 @@ atomic64_##op##_return_relaxed(long a, atomic64_t *v) \
+@@ -361,6 +414,9 @@ atomic64_##op##_return_relaxed(long a, atomic64_t *v) \
return t; \
}
+#define ATOMIC64_OP_RETURN_RELAXED(op, asm_op) __ATOMIC64_OP_RETURN(op, , , asm_op, , )\
+ __ATOMIC64_OP_RETURN(op, _unchecked, __OVERFLOW_PRE, __REFCOUNT_OP(asm_op), __OVERFLOW_POST, __OVERFLOW_EXTABLE)
+
- #define ATOMIC64_OPS(op, asm_op) \
- ATOMIC64_OP(op, asm_op) \
- ATOMIC64_OP_RETURN_RELAXED(op, asm_op)
-@@ -344,38 +404,33 @@ ATOMIC64_OP(xor, xor)
-
+ #define ATOMIC64_FETCH_OP_RELAXED(op, asm_op) \
+ static inline long \
+ atomic64_fetch_##op##_relaxed(long a, atomic64_t *v) \
+@@ -409,38 +465,33 @@ ATOMIC64_OPS(xor, xor)
#undef ATOPIC64_OPS
+ #undef ATOMIC64_FETCH_OP_RELAXED
#undef ATOMIC64_OP_RETURN_RELAXED
+#undef __ATOMIC64_OP_RETURN
#undef ATOMIC64_OP
@@ -8326,7 +8701,7 @@ index ae0751e..4f02720 100644
}
/*
-@@ -388,39 +443,20 @@ static __inline__ long atomic64_inc_return_relaxed(atomic64_t *v)
+@@ -453,34 +504,18 @@ static __inline__ long atomic64_inc_return_relaxed(atomic64_t *v)
*/
#define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
@@ -8352,9 +8727,8 @@ index ae0751e..4f02720 100644
- : "=&r" (t), "+m" (v->counter)
- : "r" (&v->counter)
- : "cc", "xer");
-+ atomic64_sub_unchecked(1, v);
- }
-
+-}
+-
-static __inline__ long atomic64_dec_return_relaxed(atomic64_t *v)
-{
- long t;
@@ -8369,15 +8743,11 @@ index ae0751e..4f02720 100644
- : "cc", "xer");
-
- return t;
--}
--
--#define atomic64_inc_return_relaxed atomic64_inc_return_relaxed
--#define atomic64_dec_return_relaxed atomic64_dec_return_relaxed
--
- #define atomic64_sub_and_test(a, v) (atomic64_sub_return((a), (v)) == 0)
- #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
++ atomic64_sub_unchecked(1, v);
+ }
-@@ -457,6 +493,13 @@ static __inline__ long atomic64_dec_if_positive(atomic64_t *v)
+ #define atomic64_inc_return_relaxed atomic64_inc_return_relaxed
+@@ -522,6 +557,16 @@ static __inline__ long atomic64_dec_if_positive(atomic64_t *v)
#define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
#define atomic64_xchg_relaxed(v, new) xchg_relaxed(&((v)->counter), (new))
@@ -8386,12 +8756,15 @@ index ae0751e..4f02720 100644
+ return cmpxchg(&(v->counter), old, new);
+}
+
-+#define atomic64_xchg_unchecked(v, new) (xchg(&((v)->counter), new))
++static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
++{
++ return xchg(&(v->counter), new);
++}
+
/**
* atomic64_add_unless - add unless the number is a given value
* @v: pointer of type atomic64_t
-@@ -472,13 +515,29 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+@@ -537,15 +582,22 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
__asm__ __volatile__ (
PPC_ATOMIC_ENTRY_BARRIER
@@ -8400,30 +8773,24 @@ index ae0751e..4f02720 100644
cmpd 0,%0,%3 \n\
- beq- 2f \n\
- add %0,%2,%0 \n"
-+ beq- 2f \n"
++ beq- 5f \n"
+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" mcrxr cr0\n"
-+" addo. %0,%2,%0\n"
-+" bf 4*cr0+so, 4f\n"
-+"3:.long " "0x00c00b00""\n"
-+"4:\n"
-+#else
-+ "add %0,%2,%0 \n"
-+#endif
++ __OVERFLOW_PRE
++ __REFCOUNT_OP(add) " %0,%2,%0 \n"
++ __OVERFLOW_POST
+
" stdcx. %0,0,%1 \n\
bne- 1b \n"
PPC_ATOMIC_EXIT_BARRIER
-+"5:"
+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ _ASM_EXTABLE(3b, 5b)
-+#endif
++ __OVERFLOW_EXTABLE
+
" subf %0,%2,%0 \n\
- 2:"
+-2:"
++5:"
: "=&r" (t)
+ : "r" (&v->counter), "r" (a), "r" (u)
+ : "cc", "memory");
diff --git a/arch/powerpc/include/asm/book3s/32/hash.h b/arch/powerpc/include/asm/book3s/32/hash.h
index 880db13..bb4ed4a 100644
--- a/arch/powerpc/include/asm/book3s/32/hash.h
@@ -8627,10 +8994,10 @@ index b8da913..c02b593 100644
/**
diff --git a/arch/powerpc/include/asm/mman.h b/arch/powerpc/include/asm/mman.h
-index 2563c43..d6fdd62 100644
+index 30922f6..0bb237c 100644
--- a/arch/powerpc/include/asm/mman.h
+++ b/arch/powerpc/include/asm/mman.h
-@@ -25,7 +25,7 @@ static inline unsigned long arch_calc_vm_prot_bits(unsigned long prot,
+@@ -26,7 +26,7 @@ static inline unsigned long arch_calc_vm_prot_bits(unsigned long prot,
}
#define arch_calc_vm_prot_bits(prot, pkey) arch_calc_vm_prot_bits(prot, pkey)
@@ -8672,7 +9039,7 @@ index 897d2e1..399f34f 100644
static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
pte_t *pte)
diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
-index 51db3a3..0bd72ae 100644
+index 56398e7..287a772 100644
--- a/arch/powerpc/include/asm/page.h
+++ b/arch/powerpc/include/asm/page.h
@@ -230,8 +230,9 @@ extern long long virt_phys_offset;
@@ -8723,7 +9090,7 @@ index dd5f071..0470718 100644
#include <asm-generic/getorder.h>
diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
-index ee09e99..7e580ee 100644
+index 9bd87f2..f600e6d 100644
--- a/arch/powerpc/include/asm/pgtable.h
+++ b/arch/powerpc/include/asm/pgtable.h
@@ -1,6 +1,7 @@
@@ -8735,7 +9102,7 @@ index ee09e99..7e580ee 100644
#include <linux/mmdebug.h>
#include <linux/mmzone.h>
diff --git a/arch/powerpc/include/asm/pte-common.h b/arch/powerpc/include/asm/pte-common.h
-index 2eeaf80..c75d4fb 100644
+index 4ba26dd..2d1137d 100644
--- a/arch/powerpc/include/asm/pte-common.h
+++ b/arch/powerpc/include/asm/pte-common.h
@@ -16,6 +16,9 @@
@@ -8802,10 +9169,10 @@ index 2eeaf80..c75d4fb 100644
#define PAGE_KERNEL_RO __pgprot(_PAGE_BASE | _PAGE_KERNEL_RO)
#define PAGE_KERNEL_ROX __pgprot(_PAGE_BASE | _PAGE_KERNEL_ROX)
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index 145e5b7..b559373 100644
+index 978dada..5d29335 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
-@@ -261,6 +261,7 @@
+@@ -270,6 +270,7 @@
#define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
#define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
#define DSISR_NOHPTE 0x40000000 /* no translation found */
@@ -8814,7 +9181,7 @@ index 145e5b7..b559373 100644
#define DSISR_ISSTORE 0x02000000 /* access was a store */
#define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
diff --git a/arch/powerpc/include/asm/smp.h b/arch/powerpc/include/asm/smp.h
-index e1afd4c..d75924a 100644
+index 0d02c11..33a8f08 100644
--- a/arch/powerpc/include/asm/smp.h
+++ b/arch/powerpc/include/asm/smp.h
@@ -51,7 +51,7 @@ struct smp_ops_t {
@@ -8827,7 +9194,7 @@ index e1afd4c..d75924a 100644
extern void smp_send_debugger_break(void);
extern void start_secondary_resume(void);
diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h
-index 523673d..10dc784 100644
+index fa37fe9..867d3cf 100644
--- a/arch/powerpc/include/asm/spinlock.h
+++ b/arch/powerpc/include/asm/spinlock.h
@@ -27,6 +27,7 @@
@@ -8838,7 +9205,7 @@ index 523673d..10dc784 100644
#ifdef CONFIG_PPC64
/* use 0x800000yy when locked, where yy == CPU number */
-@@ -202,13 +203,29 @@ static inline long __arch_read_trylock(arch_rwlock_t *rw)
+@@ -228,13 +229,29 @@ static inline long __arch_read_trylock(arch_rwlock_t *rw)
__asm__ __volatile__(
"1: " PPC_LWARX(%0,0,%1,1) "\n"
__DO_SIGN_EXTEND
@@ -8871,7 +9238,7 @@ index 523673d..10dc784 100644
: "r" (&rw->lock)
: "cr0", "xer", "memory");
-@@ -284,11 +301,27 @@ static inline void arch_read_unlock(arch_rwlock_t *rw)
+@@ -310,11 +327,27 @@ static inline void arch_read_unlock(arch_rwlock_t *rw)
__asm__ __volatile__(
"# read_unlock\n\t"
PPC_RELEASE_BARRIER
@@ -8902,10 +9269,10 @@ index 523673d..10dc784 100644
: "r"(&rw->lock)
: "cr0", "xer", "memory");
diff --git a/arch/powerpc/include/asm/string.h b/arch/powerpc/include/asm/string.h
-index e40010a..bd4a57b 100644
+index da3cdff..c774844 100644
--- a/arch/powerpc/include/asm/string.h
+++ b/arch/powerpc/include/asm/string.h
-@@ -15,17 +15,17 @@
+@@ -11,17 +11,17 @@
#define __HAVE_ARCH_MEMCMP
#define __HAVE_ARCH_MEMCHR
@@ -8934,10 +9301,10 @@ index e40010a..bd4a57b 100644
#endif /* __KERNEL__ */
diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h
-index 8febc3f..a4614f3 100644
+index 87e4b2d..c362390 100644
--- a/arch/powerpc/include/asm/thread_info.h
+++ b/arch/powerpc/include/asm/thread_info.h
-@@ -103,6 +103,8 @@ static inline struct thread_info *current_thread_info(void)
+@@ -107,6 +107,8 @@ static inline struct thread_info *current_thread_info(void)
#if defined(CONFIG_PPC64)
#define TIF_ELF2ABI 18 /* function descriptors must die! */
#endif
@@ -8946,7 +9313,7 @@ index 8febc3f..a4614f3 100644
/* as above, but as bit values */
#define _TIF_SYSCALL_TRACE (1<<TIF_SYSCALL_TRACE)
-@@ -121,9 +123,10 @@ static inline struct thread_info *current_thread_info(void)
+@@ -125,9 +127,10 @@ static inline struct thread_info *current_thread_info(void)
#define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT)
#define _TIF_EMULATE_STACK_STORE (1<<TIF_EMULATE_STACK_STORE)
#define _TIF_NOHZ (1<<TIF_NOHZ)
@@ -8959,7 +9326,7 @@ index 8febc3f..a4614f3 100644
#define _TIF_USER_WORK_MASK (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
_TIF_NOTIFY_RESUME | _TIF_UPROBE | \
diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
-index 43888c8..f3dc6bb 100644
+index c266227..f3dc6bb 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -58,6 +58,7 @@
@@ -8970,7 +9337,7 @@ index 43888c8..f3dc6bb 100644
#define access_ok(type, addr, size) \
(__chk_user_ptr(addr), \
__access_ok((__force unsigned long)(addr), (size), get_fs()))
-@@ -303,39 +304,6 @@ do { \
+@@ -303,43 +304,6 @@ do { \
extern unsigned long __copy_tofrom_user(void __user *to,
const void __user *from, unsigned long size);
@@ -8979,8 +9346,10 @@ index 43888c8..f3dc6bb 100644
-static inline unsigned long copy_from_user(void *to,
- const void __user *from, unsigned long n)
-{
-- if (likely(access_ok(VERIFY_READ, from, n)))
+- if (likely(access_ok(VERIFY_READ, from, n))) {
+- check_object_size(to, n, false);
- return __copy_tofrom_user((__force void __user *)to, from, n);
+- }
- memset(to, 0, n);
- return n;
-}
@@ -8988,8 +9357,10 @@ index 43888c8..f3dc6bb 100644
-static inline unsigned long copy_to_user(void __user *to,
- const void *from, unsigned long n)
-{
-- if (access_ok(VERIFY_WRITE, to, n))
+- if (access_ok(VERIFY_WRITE, to, n)) {
+- check_object_size(from, n, true);
- return __copy_tofrom_user(to, (__force void __user *)from, n);
+- }
- return n;
-}
-
@@ -9010,27 +9381,7 @@ index 43888c8..f3dc6bb 100644
static inline unsigned long __copy_from_user_inatomic(void *to,
const void __user *from, unsigned long n)
{
-@@ -359,6 +327,9 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
- if (ret == 0)
- return 0;
- }
-+
-+ check_object_size(to, n, false);
-+
- return __copy_tofrom_user((__force void __user *)to, from, n);
- }
-
-@@ -385,6 +356,9 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
- if (ret == 0)
- return 0;
- }
-+
-+ check_object_size(from, n, true);
-+
- return __copy_tofrom_user(to, (__force const void __user *)from, n);
- }
-
-@@ -402,6 +376,70 @@ static inline unsigned long __copy_to_user(void __user *to,
+@@ -412,6 +376,70 @@ static inline unsigned long __copy_to_user(void __user *to,
return __copy_to_user_inatomic(to, from, size);
}
@@ -9102,7 +9453,7 @@ index 43888c8..f3dc6bb 100644
static inline unsigned long clear_user(void __user *addr, unsigned long size)
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
-index 2da380f..0ba9052 100644
+index fe4c075..fcb4600 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -14,6 +14,11 @@ CFLAGS_prom_init.o += -fPIC
@@ -9127,7 +9478,7 @@ index 2da380f..0ba9052 100644
irq.o align.o signal_32.o pmc.o vdso.o \
process.o systbl.o idle.o \
diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
-index 488e631..6cdd928 100644
+index 38a1f96..ed94e42 100644
--- a/arch/powerpc/kernel/exceptions-64e.S
+++ b/arch/powerpc/kernel/exceptions-64e.S
@@ -1010,6 +1010,7 @@ storage_fault_common:
@@ -9149,10 +9500,10 @@ index 488e631..6cdd928 100644
ld r4,_DAR(r1)
bl bad_page_fault
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
-index 8bcc1b4..d2acf44 100644
+index bffec73..9cc5a35 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
-@@ -1488,10 +1488,10 @@ handle_page_fault:
+@@ -1520,10 +1520,10 @@ handle_page_fault:
11: ld r4,_DAR(r1)
ld r5,_DSISR(r1)
addi r3,r1,STACK_FRAME_OVERHEAD
@@ -9165,10 +9516,10 @@ index 8bcc1b4..d2acf44 100644
addi r3,r1,STACK_FRAME_OVERHEAD
lwz r4,_DAR(r1)
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
-index 3cb46a3..a8c0477 100644
+index 08887cf..0c98725 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
-@@ -461,6 +461,8 @@ void migrate_irqs(void)
+@@ -477,6 +477,8 @@ void migrate_irqs(void)
}
#endif
@@ -9177,7 +9528,7 @@ index 3cb46a3..a8c0477 100644
static inline void check_stack_overflow(void)
{
#ifdef CONFIG_DEBUG_STACKOVERFLOW
-@@ -473,6 +475,7 @@ static inline void check_stack_overflow(void)
+@@ -489,6 +491,7 @@ static inline void check_stack_overflow(void)
pr_err("do_IRQ: stack overflow: %ld\n",
sp - sizeof(struct thread_info));
dump_stack();
@@ -9228,10 +9579,10 @@ index 5a7a78f..c0e4207 100644
sechdrs, module);
if (!module->arch.tramp)
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
-index 0b93893..4c72fc1 100644
+index ad37aa1..51da6c4 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
-@@ -1321,8 +1321,8 @@ void show_regs(struct pt_regs * regs)
+@@ -1360,8 +1360,8 @@ void show_regs(struct pt_regs * regs)
* Lookup NIP late so we have the best change of getting the
* above info out without failing
*/
@@ -9242,7 +9593,7 @@ index 0b93893..4c72fc1 100644
#endif
show_stack(current, (unsigned long *) regs->gpr[1]);
if (!user_mode(regs))
-@@ -1843,10 +1843,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
+@@ -1882,10 +1882,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
newsp = stack[0];
ip = stack[STACK_FRAME_LR_SAVE];
if (!firstframe || ip != lr) {
@@ -9255,7 +9606,7 @@ index 0b93893..4c72fc1 100644
(void *)current->ret_stack[curr_frame].ret);
curr_frame--;
}
-@@ -1866,7 +1866,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
+@@ -1905,7 +1905,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
struct pt_regs *regs = (struct pt_regs *)
(sp + STACK_FRAME_OVERHEAD);
lr = regs->link;
@@ -9264,7 +9615,7 @@ index 0b93893..4c72fc1 100644
regs->trap, (void *)regs->nip, (void *)lr);
firstframe = 1;
}
-@@ -1903,13 +1903,6 @@ void notrace __ppc64_runlatch_off(void)
+@@ -1942,13 +1942,6 @@ void notrace __ppc64_runlatch_off(void)
}
#endif /* CONFIG_PPC64 */
@@ -9279,10 +9630,10 @@ index 0b93893..4c72fc1 100644
{
unsigned long rnd = 0;
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
-index 060b140..b67ca8c 100644
+index bf91658..edd21f8 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
-@@ -1801,6 +1801,10 @@ static int do_seccomp(struct pt_regs *regs)
+@@ -3312,6 +3312,10 @@ static int do_seccomp(struct pt_regs *regs)
static inline int do_seccomp(struct pt_regs *regs) { return 0; }
#endif /* CONFIG_SECCOMP */
@@ -9293,19 +9644,27 @@ index 060b140..b67ca8c 100644
/**
* do_syscall_trace_enter() - Do syscall tracing on kernel entry.
* @regs: the pt_regs of the task to trace (current)
-@@ -1829,6 +1833,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
- if (do_seccomp(regs))
- return -1;
+@@ -3335,6 +3339,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
+ {
+ user_exit();
+#ifdef CONFIG_GRKERNSEC_SETXID
+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
+ gr_delayed_cred_worker();
+#endif
+
- if (test_thread_flag(TIF_SYSCALL_TRACE)) {
- /*
- * The tracer may decide to abort the syscall, if so tracehook
-@@ -1871,6 +1880,11 @@ void do_syscall_trace_leave(struct pt_regs *regs)
+ /*
+ * The tracer may decide to abort the syscall, if so tracehook
+ * will return !0. Note that the tracer may also just change
+@@ -3353,6 +3362,7 @@ long do_syscall_trace_enter(struct pt_regs *regs)
+ if (regs->gpr[0] >= NR_syscalls)
+ goto skip;
+
++
+ if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
+ trace_sys_enter(regs, regs->gpr[0]);
+
+@@ -3384,6 +3394,11 @@ void do_syscall_trace_leave(struct pt_regs *regs)
{
int step;
@@ -9318,7 +9677,7 @@ index 060b140..b67ca8c 100644
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
-index b6aa378..a491f51 100644
+index a7daf74..d8159e5 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -1000,7 +1000,7 @@ int handle_rt_signal32(struct ksignal *ksig, sigset_t *oldset,
@@ -9331,10 +9690,10 @@ index b6aa378..a491f51 100644
tramp = current->mm->context.vdso_base + vdso32_rt_sigtramp;
} else {
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
-index 2552079..a290dc8a 100644
+index 70409bb..6cc6990 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
-@@ -751,7 +751,7 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs
+@@ -770,7 +770,7 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs
current->thread.fp_state.fpscr = 0;
/* Set up to return from userspace. */
@@ -9344,10 +9703,10 @@ index 2552079..a290dc8a 100644
} else {
err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
-index 9229ba6..112b6f9 100644
+index 62859eb..035955d 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
-@@ -36,6 +36,7 @@
+@@ -37,6 +37,7 @@
#include <linux/debugfs.h>
#include <linux/ratelimit.h>
#include <linux/context_tracking.h>
@@ -9355,7 +9714,7 @@ index 9229ba6..112b6f9 100644
#include <asm/emulated_ops.h>
#include <asm/pgtable.h>
-@@ -142,6 +143,8 @@ static unsigned __kprobes long oops_begin(struct pt_regs *regs)
+@@ -145,6 +146,8 @@ static unsigned __kprobes long oops_begin(struct pt_regs *regs)
return flags;
}
@@ -9364,7 +9723,7 @@ index 9229ba6..112b6f9 100644
static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
int signr)
{
-@@ -191,6 +194,9 @@ static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
+@@ -194,6 +197,9 @@ static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
panic("Fatal exception in interrupt");
if (panic_on_oops)
panic("Fatal exception");
@@ -9374,7 +9733,7 @@ index 9229ba6..112b6f9 100644
do_exit(signr);
}
-@@ -1138,6 +1144,26 @@ void __kprobes program_check_exception(struct pt_regs *regs)
+@@ -1145,6 +1151,26 @@ void __kprobes program_check_exception(struct pt_regs *regs)
enum ctx_state prev_state = exception_enter();
unsigned int reason = get_reason(regs);
@@ -9386,7 +9745,7 @@ index 9229ba6..112b6f9 100644
+ /* Check if PaX bad instruction */
+ if (!probe_kernel_address((const void *)regs->nip, bkpt) && bkpt == 0xc00b00) {
+ current->thread.trap_nr = 0;
-+ pax_report_refcount_overflow(regs);
++ pax_report_refcount_error(regs, NULL);
+ /* fixup_exception() for PowerPC does not exist, simulate its job */
+ if ((entry = search_exception_tables(regs->nip)) != NULL) {
+ regs->nip = entry->fixup;
@@ -9402,10 +9761,10 @@ index 9229ba6..112b6f9 100644
* has no FPU, in that case the reason flags will be 0 */
diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
-index 6767605..75520c0 100644
+index 4111d30..fa5e7be 100644
--- a/arch/powerpc/kernel/vdso.c
+++ b/arch/powerpc/kernel/vdso.c
-@@ -34,6 +34,7 @@
+@@ -35,6 +35,7 @@
#include <asm/vdso.h>
#include <asm/vdso_datapage.h>
#include <asm/setup.h>
@@ -9413,7 +9772,7 @@ index 6767605..75520c0 100644
#undef DEBUG
-@@ -179,7 +180,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+@@ -180,7 +181,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
vdso_base = VDSO32_MBASE;
#endif
@@ -9422,7 +9781,7 @@ index 6767605..75520c0 100644
/* vDSO has a problem and was disabled, just don't "enable" it for the
* process
-@@ -200,7 +201,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+@@ -201,7 +202,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
vdso_base = get_unmapped_area(NULL, vdso_base,
(vdso_pages << PAGE_SHIFT) +
((VDSO_ALIGNMENT - 1) & PAGE_MASK),
@@ -9467,7 +9826,7 @@ index 5eea6f3..5d10396 100644
EXPORT_SYMBOL(copy_in_user);
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
-index a67c6d7..a662e6d 100644
+index bb1ffc5..9ae5cb6 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -34,6 +34,10 @@
@@ -9657,7 +10016,7 @@ index 2b27458..7c7c59b 100644
return slice_get_unmapped_area(addr0, len, flags,
current->mm->context.user_psize, 1);
diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
-index 2936a00..2e73ed6 100644
+index 0625446..139a0aa 100644
--- a/arch/powerpc/platforms/cell/spufs/file.c
+++ b/arch/powerpc/platforms/cell/spufs/file.c
@@ -263,9 +263,9 @@ spufs_mem_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
@@ -9685,10 +10044,10 @@ index 26c5d5be..a308c28 100644
Say Y here if you want to show the kernel pagetable layout in a
debugfs file. This information is only useful for kernel developers
diff --git a/arch/s390/include/asm/atomic.h b/arch/s390/include/asm/atomic.h
-index 911064a..dcbb025 100644
+index d28cc2f..a937312 100644
--- a/arch/s390/include/asm/atomic.h
+++ b/arch/s390/include/asm/atomic.h
-@@ -322,4 +322,14 @@ static inline long long atomic64_dec_if_positive(atomic64_t *v)
+@@ -342,4 +342,14 @@ static inline long long atomic64_dec_if_positive(atomic64_t *v)
#define atomic64_dec_and_test(_v) (atomic64_sub_return(1, _v) == 0)
#define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
@@ -9704,7 +10063,7 @@ index 911064a..dcbb025 100644
+
#endif /* __ARCH_S390_ATOMIC__ */
diff --git a/arch/s390/include/asm/cache.h b/arch/s390/include/asm/cache.h
-index 22da3b3..80c7915 100644
+index 05219a5..032f5f0 100644
--- a/arch/s390/include/asm/cache.h
+++ b/arch/s390/include/asm/cache.h
@@ -9,8 +9,10 @@
@@ -9718,9 +10077,9 @@ index 22da3b3..80c7915 100644
+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
#define NET_SKB_PAD 32
- #define __read_mostly __attribute__((__section__(".data..read_mostly")))
+ #define __read_mostly __section(.data..read_mostly)
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
-index 563ab9f..65d8bd4 100644
+index 1736c7d..261351c 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -167,6 +167,13 @@ extern unsigned int vdso_enabled;
@@ -9750,7 +10109,7 @@ index c4a93d6..4d2a9b4 100644
#endif /* __ASM_EXEC_H */
diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
-index 666fd8b..778a9b9 100644
+index 52d7c87..577d292 100644
--- a/arch/s390/include/asm/uaccess.h
+++ b/arch/s390/include/asm/uaccess.h
@@ -59,6 +59,7 @@ static inline int __range_ok(unsigned long addr, unsigned long size)
@@ -9761,7 +10120,7 @@ index 666fd8b..778a9b9 100644
#define access_ok(type, addr, size) __access_ok(addr, size)
/*
-@@ -272,6 +273,10 @@ static inline unsigned long __must_check
+@@ -337,6 +338,10 @@ static inline unsigned long __must_check
copy_to_user(void __user *to, const void *from, unsigned long n)
{
might_fault();
@@ -9772,7 +10131,7 @@ index 666fd8b..778a9b9 100644
return __copy_to_user(to, from, n);
}
-@@ -301,10 +306,14 @@ __compiletime_warning("copy_from_user() buffer size is not provably correct")
+@@ -360,10 +365,14 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
static inline unsigned long __must_check
copy_from_user(void *to, const void __user *from, unsigned long n)
{
@@ -9786,9 +10145,9 @@ index 666fd8b..778a9b9 100644
+ return n;
+
+ if (unlikely(sz != (size_t)-1 && sz < n)) {
- copy_from_user_overflow();
- return n;
- }
+ if (!__builtin_constant_p(n))
+ copy_user_overflow(sz, n);
+ else
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index fbc0789..e7962a1 100644
--- a/arch/s390/kernel/module.c
@@ -10083,7 +10442,7 @@ index 6777177..d44b592 100644
addr = vm_unmapped_area(&info);
}
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
-index 546293d..cb6ea17 100644
+index 59b0960..75a8bcb 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -39,6 +39,7 @@ config SPARC
@@ -10095,7 +10454,7 @@ index 546293d..cb6ea17 100644
select OLD_SIGSUSPEND
select ARCH_HAS_SG_CHAIN
diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
-index f2fbf9e..470e701 100644
+index 24827a3..5dd45ac4 100644
--- a/arch/sparc/include/asm/atomic_64.h
+++ b/arch/sparc/include/asm/atomic_64.h
@@ -15,18 +15,38 @@
@@ -10141,11 +10500,11 @@ index f2fbf9e..470e701 100644
+
+#define ATOMIC_OP_RETURN(op) __ATOMIC_OP_RETURN(op, ) __ATOMIC_OP_RETURN(op, _unchecked)
- #define ATOMIC_OPS(op) ATOMIC_OP(op) ATOMIC_OP_RETURN(op)
-
-@@ -39,13 +59,23 @@ ATOMIC_OP(xor)
-
+ #define ATOMIC_FETCH_OP(op) \
+ int atomic_fetch_##op(int, atomic_t *); \
+@@ -47,13 +67,23 @@ ATOMIC_OPS(xor)
#undef ATOMIC_OPS
+ #undef ATOMIC_FETCH_OP
#undef ATOMIC_OP_RETURN
+#undef __ATOMIC_OP_RETURN
#undef ATOMIC_OP
@@ -10167,7 +10526,7 @@ index f2fbf9e..470e701 100644
/*
* atomic_inc_and_test - increment and test
-@@ -56,6 +86,10 @@ ATOMIC_OP(xor)
+@@ -64,6 +94,10 @@ ATOMIC_OPS(xor)
* other cases.
*/
#define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
@@ -10178,7 +10537,7 @@ index f2fbf9e..470e701 100644
#define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
#define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
-@@ -65,25 +99,60 @@ ATOMIC_OP(xor)
+@@ -73,25 +107,60 @@ ATOMIC_OPS(xor)
#define atomic64_dec_and_test(v) (atomic64_sub_return(1, v) == 0)
#define atomic_inc(v) atomic_add(1, v)
@@ -10242,7 +10601,7 @@ index f2fbf9e..470e701 100644
if (likely(old == c))
break;
c = old;
-@@ -93,21 +162,42 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
+@@ -101,21 +170,42 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
#define atomic64_cmpxchg(v, o, n) \
((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
@@ -10459,10 +10818,10 @@ index 29d64b1..4272fe8 100644
extern int sysctl_tsb_ratio;
#endif
diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
-index 9689176..63c18ea 100644
+index 87990b7..352fff0 100644
--- a/arch/sparc/include/asm/spinlock_64.h
+++ b/arch/sparc/include/asm/spinlock_64.h
-@@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long fla
+@@ -96,14 +96,19 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long fla
/* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
@@ -10484,7 +10843,7 @@ index 9689176..63c18ea 100644
" cas [%2], %0, %1\n"
" cmp %0, %1\n"
" bne,pn %%icc, 1b\n"
-@@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_rwlock_t *lock)
+@@ -116,10 +121,10 @@ static void inline arch_read_lock(arch_rwlock_t *lock)
" .previous"
: "=&r" (tmp1), "=&r" (tmp2)
: "r" (lock)
@@ -10497,7 +10856,7 @@ index 9689176..63c18ea 100644
{
int tmp1, tmp2;
-@@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
+@@ -127,7 +132,12 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
"1: ldsw [%2], %0\n"
" brlz,a,pn %0, 2f\n"
" mov 0, %0\n"
@@ -10511,7 +10870,7 @@ index 9689176..63c18ea 100644
" cas [%2], %0, %1\n"
" cmp %0, %1\n"
" bne,pn %%icc, 1b\n"
-@@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
+@@ -140,13 +150,18 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
return tmp1;
}
@@ -10532,7 +10891,7 @@ index 9689176..63c18ea 100644
" cas [%2], %0, %1\n"
" cmp %0, %1\n"
" bne,pn %%xcc, 1b\n"
-@@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch_rwlock_t *lock)
+@@ -156,7 +171,7 @@ static void inline arch_read_unlock(arch_rwlock_t *lock)
: "memory");
}
@@ -10541,7 +10900,7 @@ index 9689176..63c18ea 100644
{
unsigned long mask, tmp1, tmp2;
-@@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_rwlock_t *lock)
+@@ -181,7 +196,7 @@ static void inline arch_write_lock(arch_rwlock_t *lock)
: "memory");
}
@@ -10550,7 +10909,7 @@ index 9689176..63c18ea 100644
{
__asm__ __volatile__(
" stw %%g0, [%0]"
-@@ -186,7 +201,7 @@ static void inline arch_write_unlock(arch_rwlock_t *lock)
+@@ -190,7 +205,7 @@ static void inline arch_write_unlock(arch_rwlock_t *lock)
: "memory");
}
@@ -10572,7 +10931,7 @@ index 229475f..2fca9163 100644
/*
diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
-index bde5982..9cbb56d 100644
+index 3d7b925..493ce82 100644
--- a/arch/sparc/include/asm/thread_info_64.h
+++ b/arch/sparc/include/asm/thread_info_64.h
@@ -59,6 +59,8 @@ struct thread_info {
@@ -10629,7 +10988,7 @@ index bd56c28..4b63d83 100644
#include <asm/uaccess_64.h>
#else
diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
-index 3e8de69..eb6e4cf 100644
+index ea55f86..dbf15cf 100644
--- a/arch/sparc/include/asm/uaccess_32.h
+++ b/arch/sparc/include/asm/uaccess_32.h
@@ -47,6 +47,7 @@
@@ -10640,50 +10999,36 @@ index 3e8de69..eb6e4cf 100644
#define access_ok(type, addr, size) \
({ (void)(type); __access_ok((unsigned long)(addr), size); })
-@@ -248,22 +249,38 @@ unsigned long __copy_user(void __user *to, const void __user *from, unsigned lon
+@@ -248,6 +249,9 @@ unsigned long __copy_user(void __user *to, const void __user *from, unsigned lon
static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
{
-- if (n && __access_ok((unsigned long) to, n))
+ if ((long)n < 0)
+ return n;
+
-+ if (n && __access_ok((unsigned long) to, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
+ if (n && __access_ok((unsigned long) to, n)) {
+ check_object_size(from, n, true);
return __copy_user(to, (__force void __user *) from, n);
-- else
-+ } else
- return n;
- }
+@@ -257,12 +261,18 @@ static inline unsigned long copy_to_user(void __user *to, const void *from, unsi
static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
{
+ if ((long)n < 0)
+ return n;
+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+
+ check_object_size(from, n, true);
return __copy_user(to, (__force void __user *) from, n);
}
static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
{
-- if (n && __access_ok((unsigned long) from, n))
+ if ((long)n < 0)
+ return n;
+
-+ if (n && __access_ok((unsigned long) from, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
+ if (n && __access_ok((unsigned long) from, n)) {
+ check_object_size(to, n, false);
return __copy_user((__force void __user *) to, from, n);
-- else {
-+ } else {
- memset(to, 0, n);
- return n;
- }
-@@ -271,6 +288,9 @@ static inline unsigned long copy_from_user(void *to, const void __user *from, un
+@@ -274,6 +284,9 @@ static inline unsigned long copy_from_user(void *to, const void __user *from, un
static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
{
@@ -10694,7 +11039,7 @@ index 3e8de69..eb6e4cf 100644
}
diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
-index e9a51d6..3ef910c 100644
+index 37a315d..75ce910 100644
--- a/arch/sparc/include/asm/uaccess_64.h
+++ b/arch/sparc/include/asm/uaccess_64.h
@@ -10,6 +10,7 @@
@@ -10717,40 +11062,26 @@ index e9a51d6..3ef910c 100644
static inline int access_ok(int type, const void __user * addr, unsigned long size)
{
return 1;
-@@ -210,8 +216,15 @@ unsigned long copy_from_user_fixup(void *to, const void __user *from,
- static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long size)
+@@ -212,6 +218,9 @@ copy_from_user(void *to, const void __user *from, unsigned long size)
{
-- unsigned long ret = ___copy_from_user(to, from, size);
-+ unsigned long ret;
+ unsigned long ret;
+ if ((long)size < 0 || size > INT_MAX)
+ return size;
+
-+ if (!__builtin_constant_p(size))
-+ check_object_size(to, size, false);
-+
-+ ret = ___copy_from_user(to, from, size);
- if (unlikely(ret))
- ret = copy_from_user_fixup(to, from, size);
+ check_object_size(to, size, false);
-@@ -227,8 +240,15 @@ unsigned long copy_to_user_fixup(void __user *to, const void *from,
- static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long size)
+ ret = ___copy_from_user(to, from, size);
+@@ -232,6 +241,9 @@ copy_to_user(void __user *to, const void *from, unsigned long size)
{
-- unsigned long ret = ___copy_to_user(to, from, size);
-+ unsigned long ret;
+ unsigned long ret;
+ if ((long)size < 0 || size > INT_MAX)
+ return size;
+
-+ if (!__builtin_constant_p(size))
-+ check_object_size(from, size, true);
-+
-+ ret = ___copy_to_user(to, from, size);
- if (unlikely(ret))
- ret = copy_to_user_fixup(to, from, size);
- return ret;
+ check_object_size(from, size, true);
+
+ ret = ___copy_to_user(to, from, size);
diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
index fdb1332..1b10f89 100644
--- a/arch/sparc/kernel/Makefile
@@ -10887,7 +11218,7 @@ index 9ddc492..27a5619 100644
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
-index 8a6151a..fa3cbb19 100644
+index d3035ba..40683bd 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -891,7 +891,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu)
@@ -11198,7 +11529,7 @@ index 4f21df7..0a374da 100644
}
diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
-index d21cd62..00a4a17 100644
+index d21cd62..4e2ca86 100644
--- a/arch/sparc/kernel/traps_64.c
+++ b/arch/sparc/kernel/traps_64.c
@@ -79,7 +79,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p)
@@ -11217,7 +11548,7 @@ index d21cd62..00a4a17 100644
+
+#ifdef CONFIG_PAX_REFCOUNT
+ if (lvl == 6)
-+ pax_report_refcount_overflow(regs);
++ pax_report_refcount_error(regs, NULL);
+#endif
+
sprintf(buffer, "Kernel bad sw trap %lx", lvl);
@@ -11235,7 +11566,7 @@ index d21cd62..00a4a17 100644
+#ifdef CONFIG_PAX_REFCOUNT
+ if (lvl == 6)
-+ pax_report_refcount_overflow(regs);
++ pax_report_refcount_error(regs, NULL);
+#endif
+
dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
@@ -11414,11 +11745,11 @@ index 3269b02..64f5231 100644
lib-$(CONFIG_SPARC32) += ashrdi3.o
lib-$(CONFIG_SPARC32) += memcpy.o memset.o
diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
-index d6b0363..7fe8079 100644
+index a5c5a02..b62dbfec 100644
--- a/arch/sparc/lib/atomic_64.S
+++ b/arch/sparc/lib/atomic_64.S
-@@ -15,11 +15,22 @@
- * a value and does the barriers.
+@@ -16,11 +16,22 @@
+ * barriers.
*/
-#define ATOMIC_OP(op) \
@@ -11443,7 +11774,7 @@ index d6b0363..7fe8079 100644
cas [%o1], %g1, %g7; \
cmp %g1, %g7; \
bne,pn %icc, BACKOFF_LABEL(2f, 1b); \
-@@ -29,11 +40,15 @@ ENTRY(atomic_##op) /* %o0 = increment, %o1 = atomic_ptr */ \
+@@ -30,11 +41,15 @@ ENTRY(atomic_##op) /* %o0 = increment, %o1 = atomic_ptr */ \
2: BACKOFF_SPIN(%o2, %o3, 1b); \
ENDPROC(atomic_##op); \
@@ -11462,19 +11793,19 @@ index d6b0363..7fe8079 100644
cas [%o1], %g1, %g7; \
cmp %g1, %g7; \
bne,pn %icc, BACKOFF_LABEL(2f, 1b); \
-@@ -43,6 +58,9 @@ ENTRY(atomic_##op##_return) /* %o0 = increment, %o1 = atomic_ptr */ \
+@@ -44,6 +59,9 @@ ENTRY(atomic_##op##_return) /* %o0 = increment, %o1 = atomic_ptr */ \
2: BACKOFF_SPIN(%o2, %o3, 1b); \
ENDPROC(atomic_##op##_return);
+#define ATOMIC_OP_RETURN(op) __ATOMIC_OP_RETURN(op, , op, ) \
+ __ATOMIC_OP_RETURN(op, _unchecked, __REFCOUNT_OP(op), __OVERFLOW_IOP)
+
- #define ATOMIC_OPS(op) ATOMIC_OP(op) ATOMIC_OP_RETURN(op)
-
- ATOMIC_OPS(add)
-@@ -53,13 +71,16 @@ ATOMIC_OP(xor)
-
+ #define ATOMIC_FETCH_OP(op) \
+ ENTRY(atomic_fetch_##op) /* %o0 = increment, %o1 = atomic_ptr */ \
+ BACKOFF_SETUP(%o2); \
+@@ -73,13 +91,16 @@ ATOMIC_OPS(xor)
#undef ATOMIC_OPS
+ #undef ATOMIC_FETCH_OP
#undef ATOMIC_OP_RETURN
+#undef __ATOMIC_OP_RETURN
#undef ATOMIC_OP
@@ -11492,7 +11823,7 @@ index d6b0363..7fe8079 100644
casx [%o1], %g1, %g7; \
cmp %g1, %g7; \
bne,pn %xcc, BACKOFF_LABEL(2f, 1b); \
-@@ -69,11 +90,15 @@ ENTRY(atomic64_##op) /* %o0 = increment, %o1 = atomic_ptr */ \
+@@ -89,11 +110,15 @@ ENTRY(atomic64_##op) /* %o0 = increment, %o1 = atomic_ptr */ \
2: BACKOFF_SPIN(%o2, %o3, 1b); \
ENDPROC(atomic64_##op); \
@@ -11511,19 +11842,19 @@ index d6b0363..7fe8079 100644
casx [%o1], %g1, %g7; \
cmp %g1, %g7; \
bne,pn %xcc, BACKOFF_LABEL(2f, 1b); \
-@@ -83,6 +108,9 @@ ENTRY(atomic64_##op##_return) /* %o0 = increment, %o1 = atomic_ptr */ \
+@@ -103,6 +128,9 @@ ENTRY(atomic64_##op##_return) /* %o0 = increment, %o1 = atomic_ptr */ \
2: BACKOFF_SPIN(%o2, %o3, 1b); \
ENDPROC(atomic64_##op##_return);
+#define ATOMIC64_OP_RETURN(op) __ATOMIC64_OP_RETURN(op, , op, ) \
+ __ATOMIC64_OP_RETURN(op, _unchecked, __REFCOUNT_OP(op), __OVERFLOW_XOP)
+
- #define ATOMIC64_OPS(op) ATOMIC64_OP(op) ATOMIC64_OP_RETURN(op)
-
- ATOMIC64_OPS(add)
-@@ -93,7 +121,12 @@ ATOMIC64_OP(xor)
-
+ #define ATOMIC64_FETCH_OP(op) \
+ ENTRY(atomic64_fetch_##op) /* %o0 = increment, %o1 = atomic_ptr */ \
+ BACKOFF_SETUP(%o2); \
+@@ -132,7 +160,12 @@ ATOMIC64_OPS(xor)
#undef ATOMIC64_OPS
+ #undef ATOMIC64_FETCH_OP
#undef ATOMIC64_OP_RETURN
+#undef __ATOMIC64_OP_RETURN
#undef ATOMIC64_OP
@@ -11535,7 +11866,7 @@ index d6b0363..7fe8079 100644
ENTRY(atomic64_dec_if_positive) /* %o0 = atomic_ptr */
BACKOFF_SETUP(%o2)
diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
-index 8eb454c..7bd92f6 100644
+index de5e978..cf48854 100644
--- a/arch/sparc/lib/ksyms.c
+++ b/arch/sparc/lib/ksyms.c
@@ -101,7 +101,9 @@ EXPORT_SYMBOL(__clear_user);
@@ -11549,15 +11880,15 @@ index 8eb454c..7bd92f6 100644
#define ATOMIC_OP_RETURN(op) \
EXPORT_SYMBOL(atomic_##op##_return); \
-@@ -110,6 +112,8 @@ EXPORT_SYMBOL(atomic64_##op##_return);
- #define ATOMIC_OPS(op) ATOMIC_OP(op) ATOMIC_OP_RETURN(op)
+@@ -114,6 +116,8 @@ EXPORT_SYMBOL(atomic64_fetch_##op);
+ #define ATOMIC_OPS(op) ATOMIC_OP(op) ATOMIC_OP_RETURN(op) ATOMIC_FETCH_OP(op)
ATOMIC_OPS(add)
+EXPORT_SYMBOL(atomic_add_return_unchecked);
+EXPORT_SYMBOL(atomic64_add_return_unchecked);
ATOMIC_OPS(sub)
- ATOMIC_OP(and)
- ATOMIC_OP(or)
+
+ #undef ATOMIC_OPS
diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
index 30c3ecc..736f015 100644
--- a/arch/sparc/mm/Makefile
@@ -11572,7 +11903,7 @@ index 30c3ecc..736f015 100644
obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o gup.o
obj-y += fault_$(BITS).o
diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
-index b6c559c..cc30ea0 100644
+index 4714061..bad7f9a 100644
--- a/arch/sparc/mm/fault_32.c
+++ b/arch/sparc/mm/fault_32.c
@@ -22,6 +22,9 @@
@@ -11889,7 +12220,7 @@ index b6c559c..cc30ea0 100644
if (!(vma->vm_flags & (VM_READ | VM_EXEC)))
goto bad_area;
diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
-index cb841a3..f2061fb 100644
+index 3f291d8..b335338 100644
--- a/arch/sparc/mm/fault_64.c
+++ b/arch/sparc/mm/fault_64.c
@@ -23,6 +23,9 @@
@@ -12409,10 +12740,10 @@ index cb841a3..f2061fb 100644
* load/store/atomic was a write or not, it only says that there
* was no match. So in such a case we (carefully) read the
diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
-index ba52e64..eee5791 100644
+index 988acc8b..f26345c 100644
--- a/arch/sparc/mm/hugetlbpage.c
+++ b/arch/sparc/mm/hugetlbpage.c
-@@ -25,8 +25,10 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp,
+@@ -26,8 +26,10 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp,
unsigned long addr,
unsigned long len,
unsigned long pgoff,
@@ -12424,7 +12755,7 @@ index ba52e64..eee5791 100644
unsigned long task_size = TASK_SIZE;
struct vm_unmapped_area_info info;
-@@ -35,15 +37,22 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp,
+@@ -36,15 +38,22 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp,
info.flags = 0;
info.length = len;
@@ -12448,7 +12779,7 @@ index ba52e64..eee5791 100644
info.high_limit = task_size;
addr = vm_unmapped_area(&info);
}
-@@ -52,10 +61,11 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp,
+@@ -53,10 +62,11 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp,
}
static unsigned long
@@ -12464,7 +12795,7 @@ index ba52e64..eee5791 100644
{
struct mm_struct *mm = current->mm;
unsigned long addr = addr0;
-@@ -70,6 +80,7 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -71,6 +81,7 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
info.high_limit = mm->mmap_base;
info.align_mask = PAGE_MASK & ~HPAGE_MASK;
info.align_offset = 0;
@@ -12472,7 +12803,7 @@ index ba52e64..eee5791 100644
addr = vm_unmapped_area(&info);
/*
-@@ -82,6 +93,12 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -83,6 +94,12 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
VM_BUG_ON(addr != -ENOMEM);
info.flags = 0;
info.low_limit = TASK_UNMAPPED_BASE;
@@ -12485,7 +12816,7 @@ index ba52e64..eee5791 100644
info.high_limit = STACK_TOP32;
addr = vm_unmapped_area(&info);
}
-@@ -96,6 +113,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+@@ -97,6 +114,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
unsigned long task_size = TASK_SIZE;
@@ -12493,7 +12824,7 @@ index ba52e64..eee5791 100644
if (test_thread_flag(TIF_32BIT))
task_size = STACK_TOP32;
-@@ -111,19 +129,22 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+@@ -112,19 +130,22 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
return addr;
}
@@ -12521,7 +12852,7 @@ index ba52e64..eee5791 100644
pte_t *huge_pte_alloc(struct mm_struct *mm,
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
-index aec508e..ad807e7 100644
+index 7ac6b62..58e934c 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -189,9 +189,9 @@ unsigned long sparc64_kern_sec_context __read_mostly;
@@ -12545,7 +12876,7 @@ index aec508e..ad807e7 100644
#endif
#ifdef DCACHE_ALIASING_POSSIBLE
-@@ -459,10 +459,10 @@ void mmu_info(struct seq_file *m)
+@@ -462,10 +462,10 @@ void mmu_info(struct seq_file *m)
#ifdef CONFIG_DEBUG_DCFLUSH
seq_printf(m, "DCPageFlushes\t: %d\n",
@@ -12559,10 +12890,10 @@ index aec508e..ad807e7 100644
#endif /* CONFIG_DEBUG_DCFLUSH */
}
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
-index 4820a02..4366ab2 100644
+index 78da75b..264302d 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
-@@ -194,6 +194,7 @@ source "kernel/Kconfig.hz"
+@@ -193,6 +193,7 @@ source "kernel/Kconfig.hz"
config KEXEC
bool "kexec system call"
select KEXEC_CORE
@@ -12571,10 +12902,10 @@ index 4820a02..4366ab2 100644
kexec is a system call that implements the ability to shutdown your
current kernel, and to start another kernel. It is like a reboot
diff --git a/arch/tile/include/asm/atomic_64.h b/arch/tile/include/asm/atomic_64.h
-index b0531a6..555a389 100644
+index 4cefa0c..98d8b83 100644
--- a/arch/tile/include/asm/atomic_64.h
+++ b/arch/tile/include/asm/atomic_64.h
-@@ -158,6 +158,16 @@ static inline void atomic64_xor(long i, atomic64_t *v)
+@@ -195,6 +195,16 @@ static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
#define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
@@ -12610,10 +12941,10 @@ index 6160761..00cac88 100644
/* bytes per L2 cache line */
#define L2_CACHE_SHIFT CHIP_L2_LOG_LINE_SIZE()
diff --git a/arch/tile/include/asm/uaccess.h b/arch/tile/include/asm/uaccess.h
-index 0a9c4265..bfb62d1 100644
+index a77369e..7ba6ecd 100644
--- a/arch/tile/include/asm/uaccess.h
+++ b/arch/tile/include/asm/uaccess.h
-@@ -429,9 +429,9 @@ static inline unsigned long __must_check copy_from_user(void *to,
+@@ -428,9 +428,9 @@ static inline unsigned long __must_check copy_from_user(void *to,
const void __user *from,
unsigned long n)
{
@@ -12623,8 +12954,8 @@ index 0a9c4265..bfb62d1 100644
- if (likely(sz == -1 || sz >= n))
+ if (likely(sz == (size_t)-1 || sz >= n))
n = _copy_from_user(to, from, n);
- else
- copy_from_user_overflow();
+ else if (!__builtin_constant_p(n))
+ copy_user_overflow(sz, n);
diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c
index 77ceaa3..3630dea 100644
--- a/arch/tile/mm/hugetlbpage.c
@@ -12646,7 +12977,7 @@ index 77ceaa3..3630dea 100644
/*
diff --git a/arch/um/Makefile b/arch/um/Makefile
-index e3abe6f..33a363c 100644
+index 0ca46ede..8d7fd38 100644
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -73,6 +73,8 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -I%,,$(KBUILD_CFLAGS))) \
@@ -12761,7 +13092,7 @@ index ad8f795..2c7eec6 100644
/*
* Memory returned by kmalloc() may be used for DMA, so we must make
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index d9a94da..ef04c49 100644
+index 2a1f0ce..ca2cc51 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -39,14 +39,13 @@ config X86
@@ -12779,25 +13110,17 @@ index d9a94da..ef04c49 100644
- select ARCH_WANTS_DYNAMIC_TASK_STRUCT
select ARCH_WANT_FRAME_POINTERS
select ARCH_WANT_IPC_PARSE_VERSION if X86_32
- select ARCH_WANT_OPTIONAL_GPIOLIB
-@@ -92,7 +91,7 @@ config X86
- select HAVE_ARCH_TRACEHOOK
+ select BUILDTIME_EXTABLE_SORT
+@@ -93,7 +92,7 @@ config X86
select HAVE_ARCH_TRANSPARENT_HUGEPAGE
+ select HAVE_ARCH_WITHIN_STACK_FRAMES
select HAVE_EBPF_JIT if X86_64
- select HAVE_CC_STACKPROTECTOR
+ select HAVE_CC_STACKPROTECTOR if X86_64 || !PAX_MEMORY_UDEREF
select HAVE_CMPXCHG_DOUBLE