diff options
| -rw-r--r-- | 4.7.4/1000_linux-4.7.1.patch | 1141 | ||||
| -rw-r--r-- | 4.7.4/1001_linux-4.7.2.patch | 7668 | ||||
| -rw-r--r-- | 4.7.4/1002_linux-4.7.3.patch | 4418 | ||||
| -rw-r--r-- | 4.7.4/1003_linux-4.7.4.patch | 2424 | ||||
| -rw-r--r-- | 4.7.5/0000_README (renamed from 4.7.4/0000_README) | 18 | ||||
| -rw-r--r-- | 4.7.5/4420_grsecurity-3.1-4.7.5-201609261522.patch (renamed from 4.7.4/4420_grsecurity-3.1-4.7.4-201609211951.patch) | 1100 | ||||
| -rw-r--r-- | 4.7.5/4425_grsec_remove_EI_PAX.patch (renamed from 4.7.4/4425_grsec_remove_EI_PAX.patch) | 0 | ||||
| -rw-r--r-- | 4.7.5/4427_force_XATTR_PAX_tmpfs.patch (renamed from 4.7.4/4427_force_XATTR_PAX_tmpfs.patch) | 0 | ||||
| -rw-r--r-- | 4.7.5/4430_grsec-remove-localversion-grsec.patch (renamed from 4.7.4/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 4.7.5/4435_grsec-mute-warnings.patch (renamed from 4.7.4/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 4.7.5/4440_grsec-remove-protected-paths.patch (renamed from 4.7.4/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 4.7.5/4450_grsec-kconfig-default-gids.patch (renamed from 4.7.4/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 4.7.5/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 4.7.4/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 4.7.5/4470_disable-compat_vdso.patch (renamed from 4.7.4/4470_disable-compat_vdso.patch) | 0 | ||||
| -rw-r--r-- | 4.7.5/4475_emutramp_default_on.patch (renamed from 4.7.4/4475_emutramp_default_on.patch) | 0 |
15 files changed, 731 insertions, 16038 deletions
diff --git a/4.7.4/1000_linux-4.7.1.patch b/4.7.4/1000_linux-4.7.1.patch deleted file mode 100644 index 79c652a..0000000 --- a/4.7.4/1000_linux-4.7.1.patch +++ /dev/null @@ -1,1141 +0,0 @@ -diff --git a/Documentation/cpu-freq/pcc-cpufreq.txt b/Documentation/cpu-freq/pcc-cpufreq.txt -index 0a94224..9e3c3b3 100644 ---- a/Documentation/cpu-freq/pcc-cpufreq.txt -+++ b/Documentation/cpu-freq/pcc-cpufreq.txt -@@ -159,8 +159,8 @@ to be strictly associated with a P-state. - - 2.2 cpuinfo_transition_latency: - ------------------------------- --The cpuinfo_transition_latency field is CPUFREQ_ETERNAL. The PCC specification --does not include a field to expose this value currently. -+The cpuinfo_transition_latency field is 0. The PCC specification does -+not include a field to expose this value currently. - - 2.3 cpuinfo_cur_freq: - --------------------- -diff --git a/Makefile b/Makefile -index 66da9a3..84335c0 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 7 --SUBLEVEL = 0 -+SUBLEVEL = 1 - EXTRAVERSION = - NAME = Psychotic Stoned Sheep - -diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c -index 087acb5..5f221ac 100644 ---- a/arch/arm/kernel/sys_oabi-compat.c -+++ b/arch/arm/kernel/sys_oabi-compat.c -@@ -279,8 +279,12 @@ asmlinkage long sys_oabi_epoll_wait(int epfd, - mm_segment_t fs; - long ret, err, i; - -- if (maxevents <= 0 || maxevents > (INT_MAX/sizeof(struct epoll_event))) -+ if (maxevents <= 0 || -+ maxevents > (INT_MAX/sizeof(*kbuf)) || -+ maxevents > (INT_MAX/sizeof(*events))) - return -EINVAL; -+ if (!access_ok(VERIFY_WRITE, events, sizeof(*events) * maxevents)) -+ return -EFAULT; - kbuf = kmalloc(sizeof(*kbuf) * maxevents, GFP_KERNEL); - if (!kbuf) - return -ENOMEM; -@@ -317,6 +321,8 @@ asmlinkage long sys_oabi_semtimedop(int semid, - - if (nsops < 1 || nsops > SEMOPM) - return -EINVAL; -+ if (!access_ok(VERIFY_READ, tsops, sizeof(*tsops) * nsops)) -+ return -EFAULT; - sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL); - if (!sops) - return -ENOMEM; -diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S -index 9c0b387..51d3988 100644 ---- a/arch/mips/kernel/scall64-n32.S -+++ b/arch/mips/kernel/scall64-n32.S -@@ -348,7 +348,7 @@ EXPORT(sysn32_call_table) - PTR sys_ni_syscall /* available, was setaltroot */ - PTR sys_add_key - PTR sys_request_key -- PTR sys_keyctl /* 6245 */ -+ PTR compat_sys_keyctl /* 6245 */ - PTR sys_set_thread_area - PTR sys_inotify_init - PTR sys_inotify_add_watch -diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S -index f4f28b1..6efa713 100644 ---- a/arch/mips/kernel/scall64-o32.S -+++ b/arch/mips/kernel/scall64-o32.S -@@ -504,7 +504,7 @@ EXPORT(sys32_call_table) - PTR sys_ni_syscall /* available, was setaltroot */ - PTR sys_add_key /* 4280 */ - PTR sys_request_key -- PTR sys_keyctl -+ PTR compat_sys_keyctl - PTR sys_set_thread_area - PTR sys_inotify_init - PTR sys_inotify_add_watch /* 4285 */ -diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl -index 4cddd17..f848572 100644 ---- a/arch/x86/entry/syscalls/syscall_32.tbl -+++ b/arch/x86/entry/syscalls/syscall_32.tbl -@@ -294,7 +294,7 @@ - # 285 sys_setaltroot - 286 i386 add_key sys_add_key - 287 i386 request_key sys_request_key --288 i386 keyctl sys_keyctl -+288 i386 keyctl sys_keyctl compat_sys_keyctl - 289 i386 ioprio_set sys_ioprio_set - 290 i386 ioprio_get sys_ioprio_get - 291 i386 inotify_init sys_inotify_init -diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h -index 9d3a96c..01c2d14 100644 ---- a/arch/x86/include/asm/microcode.h -+++ b/arch/x86/include/asm/microcode.h -@@ -133,13 +133,11 @@ static inline unsigned int x86_cpuid_family(void) - #ifdef CONFIG_MICROCODE - extern void __init load_ucode_bsp(void); - extern void load_ucode_ap(void); --extern int __init save_microcode_in_initrd(void); - void reload_early_microcode(void); - extern bool get_builtin_firmware(struct cpio_data *cd, const char *name); - #else - static inline void __init load_ucode_bsp(void) { } - static inline void load_ucode_ap(void) { } --static inline int __init save_microcode_in_initrd(void) { return 0; } - static inline void reload_early_microcode(void) { } - static inline bool - get_builtin_firmware(struct cpio_data *cd, const char *name) { return false; } -diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c -index ac360bf..12823b6 100644 ---- a/arch/x86/kernel/cpu/microcode/core.c -+++ b/arch/x86/kernel/cpu/microcode/core.c -@@ -175,7 +175,7 @@ void load_ucode_ap(void) - } - } - --int __init save_microcode_in_initrd(void) -+static int __init save_microcode_in_initrd(void) - { - struct cpuinfo_x86 *c = &boot_cpu_data; - -@@ -691,4 +691,5 @@ int __init microcode_init(void) - return error; - - } -+fs_initcall(save_microcode_in_initrd); - late_initcall(microcode_init); -diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c -index 372aad2..dffd162 100644 ---- a/arch/x86/mm/init.c -+++ b/arch/x86/mm/init.c -@@ -696,13 +696,6 @@ void free_initmem(void) - void __init free_initrd_mem(unsigned long start, unsigned long end) - { - /* -- * Remember, initrd memory may contain microcode or other useful things. -- * Before we lose initrd mem, we need to find a place to hold them -- * now that normal virtual memory is enabled. -- */ -- save_microcode_in_initrd(); -- -- /* - * end could be not aligned, and We can not align that, - * decompresser could be confused by aligned initrd_end - * We already reserve the end partial page before in -diff --git a/arch/x86/power/hibernate_asm_64.S b/arch/x86/power/hibernate_asm_64.S -index 3177c2b..8eee0e9 100644 ---- a/arch/x86/power/hibernate_asm_64.S -+++ b/arch/x86/power/hibernate_asm_64.S -@@ -24,7 +24,6 @@ - #include <asm/frame.h> - - ENTRY(swsusp_arch_suspend) -- FRAME_BEGIN - movq $saved_context, %rax - movq %rsp, pt_regs_sp(%rax) - movq %rbp, pt_regs_bp(%rax) -@@ -48,6 +47,7 @@ ENTRY(swsusp_arch_suspend) - movq %cr3, %rax - movq %rax, restore_cr3(%rip) - -+ FRAME_BEGIN - call swsusp_save - FRAME_END - ret -@@ -104,7 +104,6 @@ ENTRY(core_restore_code) - /* code below belongs to the image kernel */ - .align PAGE_SIZE - ENTRY(restore_registers) -- FRAME_BEGIN - /* go back to the original page tables */ - movq %r9, %cr3 - -@@ -145,6 +144,5 @@ ENTRY(restore_registers) - /* tell the hibernation core that we've just restored the memory */ - movq %rax, in_suspend(%rip) - -- FRAME_END - ret - ENDPROC(restore_registers) -diff --git a/block/genhd.c b/block/genhd.c -index 9f42526..3eebd25 100644 ---- a/block/genhd.c -+++ b/block/genhd.c -@@ -856,6 +856,7 @@ static void disk_seqf_stop(struct seq_file *seqf, void *v) - if (iter) { - class_dev_iter_exit(iter); - kfree(iter); -+ seqf->private = NULL; - } - } - -diff --git a/crypto/gcm.c b/crypto/gcm.c -index bec329b..d9ea5f9 100644 ---- a/crypto/gcm.c -+++ b/crypto/gcm.c -@@ -639,7 +639,9 @@ static int crypto_gcm_create_common(struct crypto_template *tmpl, - - ghash_alg = crypto_find_alg(ghash_name, &crypto_ahash_type, - CRYPTO_ALG_TYPE_HASH, -- CRYPTO_ALG_TYPE_AHASH_MASK); -+ CRYPTO_ALG_TYPE_AHASH_MASK | -+ crypto_requires_sync(algt->type, -+ algt->mask)); - if (IS_ERR(ghash_alg)) - return PTR_ERR(ghash_alg); - -diff --git a/crypto/scatterwalk.c b/crypto/scatterwalk.c -index ea5815c..bc769c4 100644 ---- a/crypto/scatterwalk.c -+++ b/crypto/scatterwalk.c -@@ -72,7 +72,8 @@ static void scatterwalk_pagedone(struct scatter_walk *walk, int out, - - void scatterwalk_done(struct scatter_walk *walk, int out, int more) - { -- if (!(scatterwalk_pagelen(walk) & (PAGE_SIZE - 1)) || !more) -+ if (!more || walk->offset >= walk->sg->offset + walk->sg->length || -+ !(walk->offset & (PAGE_SIZE - 1))) - scatterwalk_pagedone(walk, out, more); - } - EXPORT_SYMBOL_GPL(scatterwalk_done); -diff --git a/drivers/char/random.c b/drivers/char/random.c -index 0158d3b..87ab9f6 100644 ---- a/drivers/char/random.c -+++ b/drivers/char/random.c -@@ -723,15 +723,18 @@ retry: - } - } - --static void credit_entropy_bits_safe(struct entropy_store *r, int nbits) -+static int credit_entropy_bits_safe(struct entropy_store *r, int nbits) - { - const int nbits_max = (int)(~0U >> (ENTROPY_SHIFT + 1)); - -+ if (nbits < 0) -+ return -EINVAL; -+ - /* Cap the value to avoid overflows */ - nbits = min(nbits, nbits_max); -- nbits = max(nbits, -nbits_max); - - credit_entropy_bits(r, nbits); -+ return 0; - } - - /********************************************************************* -@@ -1543,8 +1546,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg) - return -EPERM; - if (get_user(ent_count, p)) - return -EFAULT; -- credit_entropy_bits_safe(&input_pool, ent_count); -- return 0; -+ return credit_entropy_bits_safe(&input_pool, ent_count); - case RNDADDENTROPY: - if (!capable(CAP_SYS_ADMIN)) - return -EPERM; -@@ -1558,8 +1560,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg) - size); - if (retval < 0) - return retval; -- credit_entropy_bits_safe(&input_pool, ent_count); -- return 0; -+ return credit_entropy_bits_safe(&input_pool, ent_count); - case RNDZAPENTCNT: - case RNDCLEARPOOL: - /* -diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c -index a7ecb9a..3f0ce2a 100644 ---- a/drivers/cpufreq/pcc-cpufreq.c -+++ b/drivers/cpufreq/pcc-cpufreq.c -@@ -555,8 +555,6 @@ static int pcc_cpufreq_cpu_init(struct cpufreq_policy *policy) - policy->min = policy->cpuinfo.min_freq = - ioread32(&pcch_hdr->minimum_frequency) * 1000; - -- policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL; -- - pr_debug("init: policy->max is %d, policy->min is %d\n", - policy->max, policy->min); - out: -diff --git a/drivers/infiniband/hw/hfi1/Kconfig b/drivers/infiniband/hw/hfi1/Kconfig -index a925fb0..f846fd5 100644 ---- a/drivers/infiniband/hw/hfi1/Kconfig -+++ b/drivers/infiniband/hw/hfi1/Kconfig -@@ -3,7 +3,6 @@ config INFINIBAND_HFI1 - depends on X86_64 && INFINIBAND_RDMAVT - select MMU_NOTIFIER - select CRC32 -- default m - ---help--- - This is a low-level driver for Intel OPA Gen1 adapter. - config HFI1_DEBUG_SDMA_ORDER -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index a2afa3b..4d79819 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1422,7 +1422,16 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) - return -EINVAL; - } - -- if (slave_ops->ndo_set_mac_address == NULL) { -+ if (slave_dev->type == ARPHRD_INFINIBAND && -+ BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP) { -+ netdev_warn(bond_dev, "Type (%d) supports only active-backup mode\n", -+ slave_dev->type); -+ res = -EOPNOTSUPP; -+ goto err_undo_flags; -+ } -+ -+ if (!slave_ops->ndo_set_mac_address || -+ slave_dev->type == ARPHRD_INFINIBAND) { - netdev_warn(bond_dev, "The slave device specified does not support setting the MAC address\n"); - if (BOND_MODE(bond) == BOND_MODE_ACTIVEBACKUP && - bond->params.fail_over_mac != BOND_FOM_ACTIVE) { -diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c -index b122f60..03601df 100644 ---- a/drivers/net/ethernet/qlogic/qed/qed_spq.c -+++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c -@@ -809,13 +809,12 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn, - * in a bitmap and increasing the chain consumer only - * for the first successive completed entries. - */ -- bitmap_set(p_spq->p_comp_bitmap, pos, SPQ_RING_SIZE); -+ __set_bit(pos, p_spq->p_comp_bitmap); - - while (test_bit(p_spq->comp_bitmap_idx, - p_spq->p_comp_bitmap)) { -- bitmap_clear(p_spq->p_comp_bitmap, -- p_spq->comp_bitmap_idx, -- SPQ_RING_SIZE); -+ __clear_bit(p_spq->comp_bitmap_idx, -+ p_spq->p_comp_bitmap); - p_spq->comp_bitmap_idx++; - qed_chain_return_produced(&p_spq->chain); - } -diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c -index 8bcd78f..a70b6c4 100644 ---- a/drivers/net/macsec.c -+++ b/drivers/net/macsec.c -@@ -942,7 +942,6 @@ static struct sk_buff *macsec_decrypt(struct sk_buff *skb, - } - - macsec_skb_cb(skb)->req = req; -- macsec_skb_cb(skb)->rx_sa = rx_sa; - skb->dev = dev; - aead_request_set_callback(req, 0, macsec_decrypt_done, skb); - -@@ -1169,6 +1168,8 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) - } - } - -+ macsec_skb_cb(skb)->rx_sa = rx_sa; -+ - /* Disabled && !changed text => skip validation */ - if (hdr->tci_an & MACSEC_TCI_C || - secy->validate_frames != MACSEC_VALIDATE_DISABLED) -diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c -index ce362bd..45b57c2 100644 ---- a/drivers/tty/serial/mvebu-uart.c -+++ b/drivers/tty/serial/mvebu-uart.c -@@ -300,6 +300,8 @@ static int mvebu_uart_startup(struct uart_port *port) - static void mvebu_uart_shutdown(struct uart_port *port) - { - writel(0, port->membase + UART_CTRL); -+ -+ free_irq(port->irq, port); - } - - static void mvebu_uart_set_termios(struct uart_port *port, -diff --git a/fs/dcache.c b/fs/dcache.c -index d6847d7..1ed81bb 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -622,7 +622,6 @@ static struct dentry *dentry_kill(struct dentry *dentry) - - failed: - spin_unlock(&dentry->d_lock); -- cpu_relax(); - return dentry; /* try again with same dentry */ - } - -@@ -796,6 +795,8 @@ void dput(struct dentry *dentry) - return; - - repeat: -+ might_sleep(); -+ - rcu_read_lock(); - if (likely(fast_dput(dentry))) { - rcu_read_unlock(); -@@ -829,8 +830,10 @@ repeat: - - kill_it: - dentry = dentry_kill(dentry); -- if (dentry) -+ if (dentry) { -+ cond_resched(); - goto repeat; -+ } - } - EXPORT_SYMBOL(dput); - -diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c -index 3020fd7..1ea5054 100644 ---- a/fs/ext4/balloc.c -+++ b/fs/ext4/balloc.c -@@ -208,6 +208,9 @@ static int ext4_init_block_bitmap(struct super_block *sb, - memset(bh->b_data, 0, sb->s_blocksize); - - bit_max = ext4_num_base_meta_clusters(sb, block_group); -+ if ((bit_max >> 3) >= bh->b_size) -+ return -EFSCORRUPTED; -+ - for (bit = 0; bit < bit_max; bit++) - ext4_set_bit(bit, bh->b_data); - -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 2a2eef9..d7ccb7f 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -381,9 +381,13 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext) - ext4_fsblk_t block = ext4_ext_pblock(ext); - int len = ext4_ext_get_actual_len(ext); - ext4_lblk_t lblock = le32_to_cpu(ext->ee_block); -- ext4_lblk_t last = lblock + len - 1; - -- if (len == 0 || lblock > last) -+ /* -+ * We allow neither: -+ * - zero length -+ * - overflow/wrap-around -+ */ -+ if (lblock + len <= lblock) - return 0; - return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len); - } -@@ -474,6 +478,10 @@ static int __ext4_ext_check(const char *function, unsigned int line, - error_msg = "invalid extent entries"; - goto corrupted; - } -+ if (unlikely(depth > 32)) { -+ error_msg = "too large eh_depth"; -+ goto corrupted; -+ } - /* Verify checksum on non-root extent tree nodes */ - if (ext_depth(inode) != depth && - !ext4_extent_block_csum_verify(inode, eh)) { -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index f7140ca..b747ec0 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -205,9 +205,9 @@ void ext4_evict_inode(struct inode *inode) - * Note that directories do not have this problem because they - * don't use page cache. - */ -- if (ext4_should_journal_data(inode) && -- (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode)) && -- inode->i_ino != EXT4_JOURNAL_INO) { -+ if (inode->i_ino != EXT4_JOURNAL_INO && -+ ext4_should_journal_data(inode) && -+ (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode))) { - journal_t *journal = EXT4_SB(inode->i_sb)->s_journal; - tid_t commit_tid = EXT4_I(inode)->i_datasync_tid; - -@@ -2748,13 +2748,36 @@ retry: - done = true; - } - } -- ext4_journal_stop(handle); -+ /* -+ * Caution: If the handle is synchronous, -+ * ext4_journal_stop() can wait for transaction commit -+ * to finish which may depend on writeback of pages to -+ * complete or on page lock to be released. In that -+ * case, we have to wait until after after we have -+ * submitted all the IO, released page locks we hold, -+ * and dropped io_end reference (for extent conversion -+ * to be able to complete) before stopping the handle. -+ */ -+ if (!ext4_handle_valid(handle) || handle->h_sync == 0) { -+ ext4_journal_stop(handle); -+ handle = NULL; -+ } - /* Submit prepared bio */ - ext4_io_submit(&mpd.io_submit); - /* Unlock pages we didn't use */ - mpage_release_unused_pages(&mpd, give_up_on_write); -- /* Drop our io_end reference we got from init */ -- ext4_put_io_end(mpd.io_submit.io_end); -+ /* -+ * Drop our io_end reference we got from init. We have -+ * to be careful and use deferred io_end finishing if -+ * we are still holding the transaction as we can -+ * release the last reference to io_end which may end -+ * up doing unwritten extent conversion. -+ */ -+ if (handle) { -+ ext4_put_io_end_defer(mpd.io_submit.io_end); -+ ext4_journal_stop(handle); -+ } else -+ ext4_put_io_end(mpd.io_submit.io_end); - - if (ret == -ENOSPC && sbi->s_journal) { - /* -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index c1ab3ec..7f42eda 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -2939,7 +2939,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac, - ext4_error(sb, "Allocating blocks %llu-%llu which overlap " - "fs metadata", block, block+len); - /* File system mounted not to panic on error -- * Fix the bitmap and repeat the block allocation -+ * Fix the bitmap and return EFSCORRUPTED - * We leak some of the blocks here. - */ - ext4_lock_group(sb, ac->ac_b_ex.fe_group); -@@ -2948,7 +2948,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac, - ext4_unlock_group(sb, ac->ac_b_ex.fe_group); - err = ext4_handle_dirty_metadata(handle, NULL, bitmap_bh); - if (!err) -- err = -EAGAIN; -+ err = -EFSCORRUPTED; - goto out_err; - } - -@@ -4513,18 +4513,7 @@ repeat: - } - if (likely(ac->ac_status == AC_STATUS_FOUND)) { - *errp = ext4_mb_mark_diskspace_used(ac, handle, reserv_clstrs); -- if (*errp == -EAGAIN) { -- /* -- * drop the reference that we took -- * in ext4_mb_use_best_found -- */ -- ext4_mb_release_context(ac); -- ac->ac_b_ex.fe_group = 0; -- ac->ac_b_ex.fe_start = 0; -- ac->ac_b_ex.fe_len = 0; -- ac->ac_status = AC_STATUS_CONTINUE; -- goto repeat; -- } else if (*errp) { -+ if (*errp) { - ext4_discard_allocated_blocks(ac); - goto errout; - } else { -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 3822a5a..639bd756 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -2278,6 +2278,16 @@ static void ext4_orphan_cleanup(struct super_block *sb, - while (es->s_last_orphan) { - struct inode *inode; - -+ /* -+ * We may have encountered an error during cleanup; if -+ * so, skip the rest. -+ */ -+ if (EXT4_SB(sb)->s_mount_state & EXT4_ERROR_FS) { -+ jbd_debug(1, "Skipping orphan recovery on fs with errors.\n"); -+ es->s_last_orphan = 0; -+ break; -+ } -+ - inode = ext4_orphan_get(sb, le32_to_cpu(es->s_last_orphan)); - if (IS_ERR(inode)) { - es->s_last_orphan = 0; -@@ -3416,6 +3426,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - goto failed_mount; - } - -+ if (le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) > (blocksize / 4)) { -+ ext4_msg(sb, KERN_ERR, -+ "Number of reserved GDT blocks insanely large: %d", -+ le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks)); -+ goto failed_mount; -+ } -+ - if (sbi->s_mount_opt & EXT4_MOUNT_DAX) { - err = bdev_dax_supported(sb, blocksize); - if (err) -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 9154f86..6cac3dc 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -417,6 +417,15 @@ static int fuse_flush(struct file *file, fl_owner_t id) - fuse_sync_writes(inode); - inode_unlock(inode); - -+ if (test_bit(AS_ENOSPC, &file->f_mapping->flags) && -+ test_and_clear_bit(AS_ENOSPC, &file->f_mapping->flags)) -+ err = -ENOSPC; -+ if (test_bit(AS_EIO, &file->f_mapping->flags) && -+ test_and_clear_bit(AS_EIO, &file->f_mapping->flags)) -+ err = -EIO; -+ if (err) -+ return err; -+ - req = fuse_get_req_nofail_nopages(fc, file); - memset(&inarg, 0, sizeof(inarg)); - inarg.fh = ff->fh; -@@ -462,6 +471,21 @@ int fuse_fsync_common(struct file *file, loff_t start, loff_t end, - goto out; - - fuse_sync_writes(inode); -+ -+ /* -+ * Due to implementation of fuse writeback -+ * filemap_write_and_wait_range() does not catch errors. -+ * We have to do this directly after fuse_sync_writes() -+ */ -+ if (test_bit(AS_ENOSPC, &file->f_mapping->flags) && -+ test_and_clear_bit(AS_ENOSPC, &file->f_mapping->flags)) -+ err = -ENOSPC; -+ if (test_bit(AS_EIO, &file->f_mapping->flags) && -+ test_and_clear_bit(AS_EIO, &file->f_mapping->flags)) -+ err = -EIO; -+ if (err) -+ goto out; -+ - err = sync_inode_metadata(inode, 1); - if (err) - goto out; -diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c -index 9961d843..9b7cb37 100644 ---- a/fs/fuse/inode.c -+++ b/fs/fuse/inode.c -@@ -942,7 +942,7 @@ static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req) - arg->flags |= FUSE_ASYNC_READ | FUSE_POSIX_LOCKS | FUSE_ATOMIC_O_TRUNC | - FUSE_EXPORT_SUPPORT | FUSE_BIG_WRITES | FUSE_DONT_MASK | - FUSE_SPLICE_WRITE | FUSE_SPLICE_MOVE | FUSE_SPLICE_READ | -- FUSE_FLOCK_LOCKS | FUSE_IOCTL_DIR | FUSE_AUTO_INVAL_DATA | -+ FUSE_FLOCK_LOCKS | FUSE_HAS_IOCTL_DIR | FUSE_AUTO_INVAL_DATA | - FUSE_DO_READDIRPLUS | FUSE_READDIRPLUS_AUTO | FUSE_ASYNC_DIO | - FUSE_WRITEBACK_CACHE | FUSE_NO_OPEN_SUPPORT | - FUSE_PARALLEL_DIROPS; -diff --git a/fs/inode.c b/fs/inode.c -index 4ccbc21..9ea4219 100644 ---- a/fs/inode.c -+++ b/fs/inode.c -@@ -345,7 +345,7 @@ EXPORT_SYMBOL(inc_nlink); - void address_space_init_once(struct address_space *mapping) - { - memset(mapping, 0, sizeof(*mapping)); -- INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC); -+ INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC | __GFP_ACCOUNT); - spin_lock_init(&mapping->tree_lock); - init_rwsem(&mapping->i_mmap_rwsem); - INIT_LIST_HEAD(&mapping->private_list); -@@ -1740,8 +1740,8 @@ static int __remove_privs(struct dentry *dentry, int kill) - */ - int file_remove_privs(struct file *file) - { -- struct dentry *dentry = file->f_path.dentry; -- struct inode *inode = d_inode(dentry); -+ struct dentry *dentry = file_dentry(file); -+ struct inode *inode = file_inode(file); - int kill; - int error = 0; - -@@ -1749,7 +1749,7 @@ int file_remove_privs(struct file *file) - if (IS_NOSEC(inode)) - return 0; - -- kill = file_needs_remove_privs(file); -+ kill = dentry_needs_remove_privs(dentry); - if (kill < 0) - return kill; - if (kill) -diff --git a/fs/ioctl.c b/fs/ioctl.c -index 116a333..0f56deb 100644 ---- a/fs/ioctl.c -+++ b/fs/ioctl.c -@@ -590,6 +590,7 @@ static long ioctl_file_dedupe_range(struct file *file, void __user *arg) - goto out; - } - -+ same->dest_count = count; - ret = vfs_dedupe_file_range(file, same); - if (ret) - goto out; -diff --git a/ipc/msg.c b/ipc/msg.c -index 1471db9..c6521c2 100644 ---- a/ipc/msg.c -+++ b/ipc/msg.c -@@ -680,7 +680,7 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext, - rcu_read_lock(); - ipc_lock_object(&msq->q_perm); - -- ipc_rcu_putref(msq, ipc_rcu_free); -+ ipc_rcu_putref(msq, msg_rcu_free); - /* raced with RMID? */ - if (!ipc_valid_object(&msq->q_perm)) { - err = -EIDRM; -diff --git a/ipc/sem.c b/ipc/sem.c -index b3757ea..5d2f875 100644 ---- a/ipc/sem.c -+++ b/ipc/sem.c -@@ -449,7 +449,7 @@ static inline struct sem_array *sem_obtain_object_check(struct ipc_namespace *ns - static inline void sem_lock_and_putref(struct sem_array *sma) - { - sem_lock(sma, NULL, -1); -- ipc_rcu_putref(sma, ipc_rcu_free); -+ ipc_rcu_putref(sma, sem_rcu_free); - } - - static inline void sem_rmid(struct ipc_namespace *ns, struct sem_array *s) -@@ -1392,7 +1392,7 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum, - rcu_read_unlock(); - sem_io = ipc_alloc(sizeof(ushort)*nsems); - if (sem_io == NULL) { -- ipc_rcu_putref(sma, ipc_rcu_free); -+ ipc_rcu_putref(sma, sem_rcu_free); - return -ENOMEM; - } - -@@ -1426,20 +1426,20 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum, - if (nsems > SEMMSL_FAST) { - sem_io = ipc_alloc(sizeof(ushort)*nsems); - if (sem_io == NULL) { -- ipc_rcu_putref(sma, ipc_rcu_free); -+ ipc_rcu_putref(sma, sem_rcu_free); - return -ENOMEM; - } - } - - if (copy_from_user(sem_io, p, nsems*sizeof(ushort))) { -- ipc_rcu_putref(sma, ipc_rcu_free); -+ ipc_rcu_putref(sma, sem_rcu_free); - err = -EFAULT; - goto out_free; - } - - for (i = 0; i < nsems; i++) { - if (sem_io[i] > SEMVMX) { -- ipc_rcu_putref(sma, ipc_rcu_free); -+ ipc_rcu_putref(sma, sem_rcu_free); - err = -ERANGE; - goto out_free; - } -@@ -1731,7 +1731,7 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid) - /* step 2: allocate new undo structure */ - new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL); - if (!new) { -- ipc_rcu_putref(sma, ipc_rcu_free); -+ ipc_rcu_putref(sma, sem_rcu_free); - return ERR_PTR(-ENOMEM); - } - -diff --git a/lib/radix-tree.c b/lib/radix-tree.c -index 8b7d845..bc7852f 100644 ---- a/lib/radix-tree.c -+++ b/lib/radix-tree.c -@@ -274,10 +274,11 @@ radix_tree_node_alloc(struct radix_tree_root *root) - - /* - * Even if the caller has preloaded, try to allocate from the -- * cache first for the new node to get accounted. -+ * cache first for the new node to get accounted to the memory -+ * cgroup. - */ - ret = kmem_cache_alloc(radix_tree_node_cachep, -- gfp_mask | __GFP_ACCOUNT | __GFP_NOWARN); -+ gfp_mask | __GFP_NOWARN); - if (ret) - goto out; - -@@ -300,8 +301,7 @@ radix_tree_node_alloc(struct radix_tree_root *root) - kmemleak_update_trace(ret); - goto out; - } -- ret = kmem_cache_alloc(radix_tree_node_cachep, -- gfp_mask | __GFP_ACCOUNT); -+ ret = kmem_cache_alloc(radix_tree_node_cachep, gfp_mask); - out: - BUG_ON(radix_tree_is_internal_node(ret)); - return ret; -@@ -348,6 +348,12 @@ static int __radix_tree_preload(gfp_t gfp_mask) - struct radix_tree_node *node; - int ret = -ENOMEM; - -+ /* -+ * Nodes preloaded by one cgroup can be be used by another cgroup, so -+ * they should never be accounted to any particular memory cgroup. -+ */ -+ gfp_mask &= ~__GFP_ACCOUNT; -+ - preempt_disable(); - rtp = this_cpu_ptr(&radix_tree_preloads); - while (rtp->nr < RADIX_TREE_PRELOAD_SIZE) { -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index 5339c89..ca847d9 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -4083,14 +4083,32 @@ static struct cftype mem_cgroup_legacy_files[] = { - - static DEFINE_IDR(mem_cgroup_idr); - --static void mem_cgroup_id_get(struct mem_cgroup *memcg) -+static void mem_cgroup_id_get_many(struct mem_cgroup *memcg, unsigned int n) - { -- atomic_inc(&memcg->id.ref); -+ atomic_add(n, &memcg->id.ref); - } - --static void mem_cgroup_id_put(struct mem_cgroup *memcg) -+static struct mem_cgroup *mem_cgroup_id_get_online(struct mem_cgroup *memcg) - { -- if (atomic_dec_and_test(&memcg->id.ref)) { -+ while (!atomic_inc_not_zero(&memcg->id.ref)) { -+ /* -+ * The root cgroup cannot be destroyed, so it's refcount must -+ * always be >= 1. -+ */ -+ if (WARN_ON_ONCE(memcg == root_mem_cgroup)) { -+ VM_BUG_ON(1); -+ break; -+ } -+ memcg = parent_mem_cgroup(memcg); -+ if (!memcg) -+ memcg = root_mem_cgroup; -+ } -+ return memcg; -+} -+ -+static void mem_cgroup_id_put_many(struct mem_cgroup *memcg, unsigned int n) -+{ -+ if (atomic_sub_and_test(n, &memcg->id.ref)) { - idr_remove(&mem_cgroup_idr, memcg->id.id); - memcg->id.id = 0; - -@@ -4099,6 +4117,16 @@ static void mem_cgroup_id_put(struct mem_cgroup *memcg) - } - } - -+static inline void mem_cgroup_id_get(struct mem_cgroup *memcg) -+{ -+ mem_cgroup_id_get_many(memcg, 1); -+} -+ -+static inline void mem_cgroup_id_put(struct mem_cgroup *memcg) -+{ -+ mem_cgroup_id_put_many(memcg, 1); -+} -+ - /** - * mem_cgroup_from_id - look up a memcg from a memcg id - * @id: the memcg id to look up -@@ -4736,6 +4764,8 @@ static void __mem_cgroup_clear_mc(void) - if (!mem_cgroup_is_root(mc.from)) - page_counter_uncharge(&mc.from->memsw, mc.moved_swap); - -+ mem_cgroup_id_put_many(mc.from, mc.moved_swap); -+ - /* - * we charged both to->memory and to->memsw, so we - * should uncharge to->memory. -@@ -4743,9 +4773,9 @@ static void __mem_cgroup_clear_mc(void) - if (!mem_cgroup_is_root(mc.to)) - page_counter_uncharge(&mc.to->memory, mc.moved_swap); - -- css_put_many(&mc.from->css, mc.moved_swap); -+ mem_cgroup_id_get_many(mc.to, mc.moved_swap); -+ css_put_many(&mc.to->css, mc.moved_swap); - -- /* we've already done css_get(mc.to) */ - mc.moved_swap = 0; - } - memcg_oom_recover(from); -@@ -5805,7 +5835,7 @@ subsys_initcall(mem_cgroup_init); - */ - void mem_cgroup_swapout(struct page *page, swp_entry_t entry) - { -- struct mem_cgroup *memcg; -+ struct mem_cgroup *memcg, *swap_memcg; - unsigned short oldid; - - VM_BUG_ON_PAGE(PageLRU(page), page); -@@ -5820,16 +5850,27 @@ void mem_cgroup_swapout(struct page *page, swp_entry_t entry) - if (!memcg) - return; - -- mem_cgroup_id_get(memcg); -- oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg)); -+ /* -+ * In case the memcg owning these pages has been offlined and doesn't -+ * have an ID allocated to it anymore, charge the closest online -+ * ancestor for the swap instead and transfer the memory+swap charge. -+ */ -+ swap_memcg = mem_cgroup_id_get_online(memcg); -+ oldid = swap_cgroup_record(entry, mem_cgroup_id(swap_memcg)); - VM_BUG_ON_PAGE(oldid, page); -- mem_cgroup_swap_statistics(memcg, true); -+ mem_cgroup_swap_statistics(swap_memcg, true); - - page->mem_cgroup = NULL; - - if (!mem_cgroup_is_root(memcg)) - page_counter_uncharge(&memcg->memory, 1); - -+ if (memcg != swap_memcg) { -+ if (!mem_cgroup_is_root(swap_memcg)) -+ page_counter_charge(&swap_memcg->memsw, 1); -+ page_counter_uncharge(&memcg->memsw, 1); -+ } -+ - /* - * Interrupts should be disabled here because the caller holds the - * mapping->tree_lock lock which is taken with interrupts-off. It is -@@ -5868,11 +5909,14 @@ int mem_cgroup_try_charge_swap(struct page *page, swp_entry_t entry) - if (!memcg) - return 0; - -+ memcg = mem_cgroup_id_get_online(memcg); -+ - if (!mem_cgroup_is_root(memcg) && -- !page_counter_try_charge(&memcg->swap, 1, &counter)) -+ !page_counter_try_charge(&memcg->swap, 1, &counter)) { -+ mem_cgroup_id_put(memcg); - return -ENOMEM; -+ } - -- mem_cgroup_id_get(memcg); - oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg)); - VM_BUG_ON_PAGE(oldid, page); - mem_cgroup_swap_statistics(memcg, true); -diff --git a/mm/mempool.c b/mm/mempool.c -index 8f65464..47a659d 100644 ---- a/mm/mempool.c -+++ b/mm/mempool.c -@@ -306,7 +306,7 @@ EXPORT_SYMBOL(mempool_resize); - * returns NULL. Note that due to preallocation, this function - * *never* fails when called from process contexts. (it might - * fail if called from an IRQ context.) -- * Note: neither __GFP_NOMEMALLOC nor __GFP_ZERO are supported. -+ * Note: using __GFP_ZERO is not supported. - */ - void *mempool_alloc(mempool_t *pool, gfp_t gfp_mask) - { -@@ -315,27 +315,16 @@ void *mempool_alloc(mempool_t *pool, gfp_t gfp_mask) - wait_queue_t wait; - gfp_t gfp_temp; - -- /* If oom killed, memory reserves are essential to prevent livelock */ -- VM_WARN_ON_ONCE(gfp_mask & __GFP_NOMEMALLOC); -- /* No element size to zero on allocation */ - VM_WARN_ON_ONCE(gfp_mask & __GFP_ZERO); -- - might_sleep_if(gfp_mask & __GFP_DIRECT_RECLAIM); - -+ gfp_mask |= __GFP_NOMEMALLOC; /* don't allocate emergency reserves */ - gfp_mask |= __GFP_NORETRY; /* don't loop in __alloc_pages */ - gfp_mask |= __GFP_NOWARN; /* failures are OK */ - - gfp_temp = gfp_mask & ~(__GFP_DIRECT_RECLAIM|__GFP_IO); - - repeat_alloc: -- if (likely(pool->curr_nr)) { -- /* -- * Don't allocate from emergency reserves if there are -- * elements available. This check is racy, but it will -- * be rechecked each loop. -- */ -- gfp_temp |= __GFP_NOMEMALLOC; -- } - - element = pool->alloc(gfp_temp, pool->pool_data); - if (likely(element != NULL)) -@@ -359,12 +348,11 @@ repeat_alloc: - * We use gfp mask w/o direct reclaim or IO for the first round. If - * alloc failed with that and @pool was empty, retry immediately. - */ -- if ((gfp_temp & ~__GFP_NOMEMALLOC) != gfp_mask) { -+ if (gfp_temp != gfp_mask) { - spin_unlock_irqrestore(&pool->lock, flags); - gfp_temp = gfp_mask; - goto repeat_alloc; - } -- gfp_temp = gfp_mask; - - /* We must not sleep if !__GFP_DIRECT_RECLAIM */ - if (!(gfp_mask & __GFP_DIRECT_RECLAIM)) { -diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c -index 43d2cd8..28d5ec2 100644 ---- a/net/bridge/br_input.c -+++ b/net/bridge/br_input.c -@@ -288,6 +288,14 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb) - case 0x01: /* IEEE MAC (Pause) */ - goto drop; - -+ case 0x0E: /* 802.1AB LLDP */ -+ fwd_mask |= p->br->group_fwd_mask; -+ if (fwd_mask & (1u << dest[5])) -+ goto forward; -+ *pskb = skb; -+ __br_handle_local_finish(skb); -+ return RX_HANDLER_PASS; -+ - default: - /* Allow selective forwarding for most other protocols */ - fwd_mask |= p->br->group_fwd_mask; -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index e00e972..700b72c 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -236,7 +236,8 @@ void tcp_select_initial_window(int __space, __u32 mss, - /* Set window scaling on max possible window - * See RFC1323 for an explanation of the limit to 14 - */ -- space = max_t(u32, sysctl_tcp_rmem[2], sysctl_rmem_max); -+ space = max_t(u32, space, sysctl_tcp_rmem[2]); -+ space = max_t(u32, space, sysctl_rmem_max); - space = min_t(u32, space, *window_clamp); - while (space > 65535 && (*rcv_wscale) < 14) { - space >>= 1; -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 4aed8fc..e61f7cd 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -1581,9 +1581,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) - udp_lib_checksum_complete(skb)) - goto csum_error; - -- if (sk_filter(sk, skb)) -- goto drop; -- if (unlikely(skb->len < sizeof(struct udphdr))) -+ if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr))) - goto drop; - - udp_csum_pull_header(skb); -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 47f837a..047c75a 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -3562,6 +3562,10 @@ restart: - if (state != INET6_IFADDR_STATE_DEAD) { - __ipv6_ifa_notify(RTM_DELADDR, ifa); - inet6addr_notifier_call_chain(NETDEV_DOWN, ifa); -+ } else { -+ if (idev->cnf.forwarding) -+ addrconf_leave_anycast(ifa); -+ addrconf_leave_solict(ifa->idev, &ifa->addr); - } - - write_lock_bh(&idev->lock); -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index acc09705..42a2edf 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -618,9 +618,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) - udp_lib_checksum_complete(skb)) - goto csum_error; - -- if (sk_filter(sk, skb)) -- goto drop; -- if (unlikely(skb->len < sizeof(struct udphdr))) -+ if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr))) - goto drop; - - udp_csum_pull_header(skb); -diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c -index 923abd6..8d2f7c9 100644 ---- a/net/irda/af_irda.c -+++ b/net/irda/af_irda.c -@@ -1024,8 +1024,11 @@ static int irda_connect(struct socket *sock, struct sockaddr *uaddr, - } - - /* Check if we have opened a local TSAP */ -- if (!self->tsap) -- irda_open_tsap(self, LSAP_ANY, addr->sir_name); -+ if (!self->tsap) { -+ err = irda_open_tsap(self, LSAP_ANY, addr->sir_name); -+ if (err) -+ goto out; -+ } - - /* Move to connecting socket, start sending Connect Requests */ - sock->state = SS_CONNECTING; -diff --git a/net/sctp/input.c b/net/sctp/input.c -index 47cf460..f093322 100644 ---- a/net/sctp/input.c -+++ b/net/sctp/input.c -@@ -328,6 +328,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb) - */ - - sk = rcvr->sk; -+ local_bh_disable(); - bh_lock_sock(sk); - - if (sock_owned_by_user(sk)) { -@@ -339,6 +340,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb) - sctp_inq_push(inqueue, chunk); - - bh_unlock_sock(sk); -+ local_bh_enable(); - - /* If the chunk was backloged again, don't drop refs */ - if (backloged) -diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c -index 9d87bba..b335ffc 100644 ---- a/net/sctp/inqueue.c -+++ b/net/sctp/inqueue.c -@@ -89,12 +89,10 @@ void sctp_inq_push(struct sctp_inq *q, struct sctp_chunk *chunk) - * Eventually, we should clean up inqueue to not rely - * on the BH related data structures. - */ -- local_bh_disable(); - list_add_tail(&chunk->list, &q->in_chunk_list); - if (chunk->asoc) - chunk->asoc->stats.ipackets++; - q->immediate.func(&q->immediate); -- local_bh_enable(); - } - - /* Peek at the next chunk on the inqeue. */ -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 67154b8..7f5689a 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -4301,6 +4301,7 @@ int sctp_transport_walk_start(struct rhashtable_iter *iter) - - err = rhashtable_walk_start(iter); - if (err && err != -EAGAIN) { -+ rhashtable_walk_stop(iter); - rhashtable_walk_exit(iter); - return err; - } -diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c -index ad4fa49..9068369 100644 ---- a/security/apparmor/apparmorfs.c -+++ b/security/apparmor/apparmorfs.c -@@ -331,6 +331,7 @@ static int aa_fs_seq_hash_show(struct seq_file *seq, void *v) - seq_printf(seq, "%.2x", profile->hash[i]); - seq_puts(seq, "\n"); - } -+ aa_put_profile(profile); - - return 0; - } diff --git a/4.7.4/1001_linux-4.7.2.patch b/4.7.4/1001_linux-4.7.2.patch deleted file mode 100644 index d0ef798..0000000 --- a/4.7.4/1001_linux-4.7.2.patch +++ /dev/null @@ -1,7668 +0,0 @@ -diff --git a/Documentation/module-signing.txt b/Documentation/module-signing.txt -index 696d5ca..f0e3361 100644 ---- a/Documentation/module-signing.txt -+++ b/Documentation/module-signing.txt -@@ -271,3 +271,9 @@ Since the private key is used to sign modules, viruses and malware could use - the private key to sign modules and compromise the operating system. The - private key must be either destroyed or moved to a secure location and not kept - in the root node of the kernel source tree. -+ -+If you use the same private key to sign modules for multiple kernel -+configurations, you must ensure that the module version information is -+sufficient to prevent loading a module into a different kernel. Either -+set CONFIG_MODVERSIONS=y or ensure that each configuration has a different -+kernel release string by changing EXTRAVERSION or CONFIG_LOCALVERSION. -diff --git a/Makefile b/Makefile -index 84335c0..bb98f1c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 7 --SUBLEVEL = 1 -+SUBLEVEL = 2 - EXTRAVERSION = - NAME = Psychotic Stoned Sheep - -diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h -index 858f98e..0f92d97 100644 ---- a/arch/arc/include/asm/pgtable.h -+++ b/arch/arc/include/asm/pgtable.h -@@ -110,7 +110,7 @@ - #define ___DEF (_PAGE_PRESENT | _PAGE_CACHEABLE) - - /* Set of bits not changed in pte_modify */ --#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_DIRTY) -+#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_DIRTY | _PAGE_SPECIAL) - - /* More Abbrevaited helpers */ - #define PAGE_U_NONE __pgprot(___DEF) -diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c -index 73d7e4c..ab74b5d 100644 ---- a/arch/arc/mm/dma.c -+++ b/arch/arc/mm/dma.c -@@ -92,7 +92,8 @@ static void *arc_dma_alloc(struct device *dev, size_t size, - static void arc_dma_free(struct device *dev, size_t size, void *vaddr, - dma_addr_t dma_handle, struct dma_attrs *attrs) - { -- struct page *page = virt_to_page(dma_handle); -+ phys_addr_t paddr = plat_dma_to_phys(dev, dma_handle); -+ struct page *page = virt_to_page(paddr); - int is_non_coh = 1; - - is_non_coh = dma_get_attr(DMA_ATTR_NON_CONSISTENT, attrs) || -diff --git a/arch/arm/boot/dts/arm-realview-pbx-a9.dts b/arch/arm/boot/dts/arm-realview-pbx-a9.dts -index db808f9..90d00b4 100644 ---- a/arch/arm/boot/dts/arm-realview-pbx-a9.dts -+++ b/arch/arm/boot/dts/arm-realview-pbx-a9.dts -@@ -70,13 +70,12 @@ - * associativity as these may be erroneously set - * up by boot loader(s). - */ -- cache-size = <1048576>; // 1MB -- cache-sets = <4096>; -+ cache-size = <131072>; // 128KB -+ cache-sets = <512>; - cache-line-size = <32>; - arm,parity-disable; -- arm,tag-latency = <1>; -- arm,data-latency = <1 1>; -- arm,dirty-latency = <1>; -+ arm,tag-latency = <1 1 1>; -+ arm,data-latency = <1 1 1>; - }; - - scu: scu@1f000000 { -diff --git a/arch/arm/boot/dts/sun4i-a10-a1000.dts b/arch/arm/boot/dts/sun4i-a10-a1000.dts -index c92a1ae..fa70b8f 100644 ---- a/arch/arm/boot/dts/sun4i-a10-a1000.dts -+++ b/arch/arm/boot/dts/sun4i-a10-a1000.dts -@@ -84,6 +84,7 @@ - regulator-name = "emac-3v3"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; -+ startup-delay-us = <20000>; - enable-active-high; - gpio = <&pio 7 15 GPIO_ACTIVE_HIGH>; - }; -diff --git a/arch/arm/boot/dts/sun4i-a10-hackberry.dts b/arch/arm/boot/dts/sun4i-a10-hackberry.dts -index 2b17c51..6de83a6 100644 ---- a/arch/arm/boot/dts/sun4i-a10-hackberry.dts -+++ b/arch/arm/boot/dts/sun4i-a10-hackberry.dts -@@ -66,6 +66,7 @@ - regulator-name = "emac-3v3"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; -+ startup-delay-us = <20000>; - enable-active-high; - gpio = <&pio 7 19 GPIO_ACTIVE_HIGH>; - }; -diff --git a/arch/arm/boot/dts/sun4i-a10-jesurun-q5.dts b/arch/arm/boot/dts/sun4i-a10-jesurun-q5.dts -index 7afc7a6..e28f080 100644 ---- a/arch/arm/boot/dts/sun4i-a10-jesurun-q5.dts -+++ b/arch/arm/boot/dts/sun4i-a10-jesurun-q5.dts -@@ -80,6 +80,7 @@ - regulator-name = "emac-3v3"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; -+ startup-delay-us = <20000>; - enable-active-high; - gpio = <&pio 7 19 GPIO_ACTIVE_HIGH>; /* PH19 */ - }; -diff --git a/arch/arm/boot/dts/sun5i-a10s-wobo-i5.dts b/arch/arm/boot/dts/sun5i-a10s-wobo-i5.dts -index 9fea918..39731a7 100644 ---- a/arch/arm/boot/dts/sun5i-a10s-wobo-i5.dts -+++ b/arch/arm/boot/dts/sun5i-a10s-wobo-i5.dts -@@ -79,6 +79,7 @@ - regulator-name = "emac-3v3"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; -+ startup-delay-us = <20000>; - enable-active-high; - gpio = <&pio 0 2 GPIO_ACTIVE_HIGH>; - }; -diff --git a/arch/arm/boot/dts/tegra124-jetson-tk1.dts b/arch/arm/boot/dts/tegra124-jetson-tk1.dts -index 941f362..f4d8125 100644 ---- a/arch/arm/boot/dts/tegra124-jetson-tk1.dts -+++ b/arch/arm/boot/dts/tegra124-jetson-tk1.dts -@@ -1386,7 +1386,7 @@ - * Pin 41: BR_UART1_TXD - * Pin 44: BR_UART1_RXD - */ -- serial@70006000 { -+ serial@0,70006000 { - compatible = "nvidia,tegra124-hsuart", "nvidia,tegra30-hsuart"; - status = "okay"; - }; -@@ -1398,7 +1398,7 @@ - * Pin 71: UART2_CTS_L - * Pin 74: UART2_RTS_L - */ -- serial@70006040 { -+ serial@0,70006040 { - compatible = "nvidia,tegra124-hsuart", "nvidia,tegra30-hsuart"; - status = "okay"; - }; -diff --git a/arch/arm/configs/aspeed_g4_defconfig b/arch/arm/configs/aspeed_g4_defconfig -index b6e54ee..ca39c04 100644 ---- a/arch/arm/configs/aspeed_g4_defconfig -+++ b/arch/arm/configs/aspeed_g4_defconfig -@@ -58,7 +58,7 @@ CONFIG_SERIAL_OF_PLATFORM=y - # CONFIG_IOMMU_SUPPORT is not set - CONFIG_FIRMWARE_MEMMAP=y - CONFIG_FANOTIFY=y --CONFIG_PRINTK_TIME=1 -+CONFIG_PRINTK_TIME=y - CONFIG_DYNAMIC_DEBUG=y - CONFIG_STRIP_ASM_SYMS=y - CONFIG_PAGE_POISONING=y -diff --git a/arch/arm/configs/aspeed_g5_defconfig b/arch/arm/configs/aspeed_g5_defconfig -index 8926051..4f366b0 100644 ---- a/arch/arm/configs/aspeed_g5_defconfig -+++ b/arch/arm/configs/aspeed_g5_defconfig -@@ -59,7 +59,7 @@ CONFIG_SERIAL_OF_PLATFORM=y - # CONFIG_IOMMU_SUPPORT is not set - CONFIG_FIRMWARE_MEMMAP=y - CONFIG_FANOTIFY=y --CONFIG_PRINTK_TIME=1 -+CONFIG_PRINTK_TIME=y - CONFIG_DYNAMIC_DEBUG=y - CONFIG_STRIP_ASM_SYMS=y - CONFIG_PAGE_POISONING=y -diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c -index ff7ed56..d2485c7 100644 ---- a/arch/arm/mm/dma-mapping.c -+++ b/arch/arm/mm/dma-mapping.c -@@ -49,6 +49,7 @@ struct arm_dma_alloc_args { - pgprot_t prot; - const void *caller; - bool want_vaddr; -+ int coherent_flag; - }; - - struct arm_dma_free_args { -@@ -59,6 +60,9 @@ struct arm_dma_free_args { - bool want_vaddr; - }; - -+#define NORMAL 0 -+#define COHERENT 1 -+ - struct arm_dma_allocator { - void *(*alloc)(struct arm_dma_alloc_args *args, - struct page **ret_page); -@@ -272,7 +276,7 @@ static u64 get_coherent_dma_mask(struct device *dev) - return mask; - } - --static void __dma_clear_buffer(struct page *page, size_t size) -+static void __dma_clear_buffer(struct page *page, size_t size, int coherent_flag) - { - /* - * Ensure that the allocated pages are zeroed, and that any data -@@ -284,17 +288,21 @@ static void __dma_clear_buffer(struct page *page, size_t size) - while (size > 0) { - void *ptr = kmap_atomic(page); - memset(ptr, 0, PAGE_SIZE); -- dmac_flush_range(ptr, ptr + PAGE_SIZE); -+ if (coherent_flag != COHERENT) -+ dmac_flush_range(ptr, ptr + PAGE_SIZE); - kunmap_atomic(ptr); - page++; - size -= PAGE_SIZE; - } -- outer_flush_range(base, end); -+ if (coherent_flag != COHERENT) -+ outer_flush_range(base, end); - } else { - void *ptr = page_address(page); - memset(ptr, 0, size); -- dmac_flush_range(ptr, ptr + size); -- outer_flush_range(__pa(ptr), __pa(ptr) + size); -+ if (coherent_flag != COHERENT) { -+ dmac_flush_range(ptr, ptr + size); -+ outer_flush_range(__pa(ptr), __pa(ptr) + size); -+ } - } - } - -@@ -302,7 +310,8 @@ static void __dma_clear_buffer(struct page *page, size_t size) - * Allocate a DMA buffer for 'dev' of size 'size' using the - * specified gfp mask. Note that 'size' must be page aligned. - */ --static struct page *__dma_alloc_buffer(struct device *dev, size_t size, gfp_t gfp) -+static struct page *__dma_alloc_buffer(struct device *dev, size_t size, -+ gfp_t gfp, int coherent_flag) - { - unsigned long order = get_order(size); - struct page *page, *p, *e; -@@ -318,7 +327,7 @@ static struct page *__dma_alloc_buffer(struct device *dev, size_t size, gfp_t gf - for (p = page + (size >> PAGE_SHIFT), e = page + (1 << order); p < e; p++) - __free_page(p); - -- __dma_clear_buffer(page, size); -+ __dma_clear_buffer(page, size, coherent_flag); - - return page; - } -@@ -340,7 +349,8 @@ static void __dma_free_buffer(struct page *page, size_t size) - - static void *__alloc_from_contiguous(struct device *dev, size_t size, - pgprot_t prot, struct page **ret_page, -- const void *caller, bool want_vaddr); -+ const void *caller, bool want_vaddr, -+ int coherent_flag); - - static void *__alloc_remap_buffer(struct device *dev, size_t size, gfp_t gfp, - pgprot_t prot, struct page **ret_page, -@@ -405,10 +415,13 @@ static int __init atomic_pool_init(void) - atomic_pool = gen_pool_create(PAGE_SHIFT, -1); - if (!atomic_pool) - goto out; -- -+ /* -+ * The atomic pool is only used for non-coherent allocations -+ * so we must pass NORMAL for coherent_flag. -+ */ - if (dev_get_cma_area(NULL)) - ptr = __alloc_from_contiguous(NULL, atomic_pool_size, prot, -- &page, atomic_pool_init, true); -+ &page, atomic_pool_init, true, NORMAL); - else - ptr = __alloc_remap_buffer(NULL, atomic_pool_size, gfp, prot, - &page, atomic_pool_init, true); -@@ -522,7 +535,11 @@ static void *__alloc_remap_buffer(struct device *dev, size_t size, gfp_t gfp, - { - struct page *page; - void *ptr = NULL; -- page = __dma_alloc_buffer(dev, size, gfp); -+ /* -+ * __alloc_remap_buffer is only called when the device is -+ * non-coherent -+ */ -+ page = __dma_alloc_buffer(dev, size, gfp, NORMAL); - if (!page) - return NULL; - if (!want_vaddr) -@@ -577,7 +594,8 @@ static int __free_from_pool(void *start, size_t size) - - static void *__alloc_from_contiguous(struct device *dev, size_t size, - pgprot_t prot, struct page **ret_page, -- const void *caller, bool want_vaddr) -+ const void *caller, bool want_vaddr, -+ int coherent_flag) - { - unsigned long order = get_order(size); - size_t count = size >> PAGE_SHIFT; -@@ -588,7 +606,7 @@ static void *__alloc_from_contiguous(struct device *dev, size_t size, - if (!page) - return NULL; - -- __dma_clear_buffer(page, size); -+ __dma_clear_buffer(page, size, coherent_flag); - - if (!want_vaddr) - goto out; -@@ -638,7 +656,7 @@ static inline pgprot_t __get_dma_pgprot(struct dma_attrs *attrs, pgprot_t prot) - #define __get_dma_pgprot(attrs, prot) __pgprot(0) - #define __alloc_remap_buffer(dev, size, gfp, prot, ret, c, wv) NULL - #define __alloc_from_pool(size, ret_page) NULL --#define __alloc_from_contiguous(dev, size, prot, ret, c, wv) NULL -+#define __alloc_from_contiguous(dev, size, prot, ret, c, wv, coherent_flag) NULL - #define __free_from_pool(cpu_addr, size) do { } while (0) - #define __free_from_contiguous(dev, page, cpu_addr, size, wv) do { } while (0) - #define __dma_free_remap(cpu_addr, size) do { } while (0) -@@ -649,7 +667,8 @@ static void *__alloc_simple_buffer(struct device *dev, size_t size, gfp_t gfp, - struct page **ret_page) - { - struct page *page; -- page = __dma_alloc_buffer(dev, size, gfp); -+ /* __alloc_simple_buffer is only called when the device is coherent */ -+ page = __dma_alloc_buffer(dev, size, gfp, COHERENT); - if (!page) - return NULL; - -@@ -679,7 +698,7 @@ static void *cma_allocator_alloc(struct arm_dma_alloc_args *args, - { - return __alloc_from_contiguous(args->dev, args->size, args->prot, - ret_page, args->caller, -- args->want_vaddr); -+ args->want_vaddr, args->coherent_flag); - } - - static void cma_allocator_free(struct arm_dma_free_args *args) -@@ -746,6 +765,7 @@ static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, - .prot = prot, - .caller = caller, - .want_vaddr = !dma_get_attr(DMA_ATTR_NO_KERNEL_MAPPING, attrs), -+ .coherent_flag = is_coherent ? COHERENT : NORMAL, - }; - - #ifdef CONFIG_DMA_API_DEBUG -@@ -1253,7 +1273,8 @@ static inline void __free_iova(struct dma_iommu_mapping *mapping, - static const int iommu_order_array[] = { 9, 8, 4, 0 }; - - static struct page **__iommu_alloc_buffer(struct device *dev, size_t size, -- gfp_t gfp, struct dma_attrs *attrs) -+ gfp_t gfp, struct dma_attrs *attrs, -+ int coherent_flag) - { - struct page **pages; - int count = size >> PAGE_SHIFT; -@@ -1277,7 +1298,7 @@ static struct page **__iommu_alloc_buffer(struct device *dev, size_t size, - if (!page) - goto error; - -- __dma_clear_buffer(page, size); -+ __dma_clear_buffer(page, size, coherent_flag); - - for (i = 0; i < count; i++) - pages[i] = page + i; -@@ -1327,7 +1348,7 @@ static struct page **__iommu_alloc_buffer(struct device *dev, size_t size, - pages[i + j] = pages[i] + j; - } - -- __dma_clear_buffer(pages[i], PAGE_SIZE << order); -+ __dma_clear_buffer(pages[i], PAGE_SIZE << order, coherent_flag); - i += 1 << order; - count -= 1 << order; - } -@@ -1505,7 +1526,8 @@ static void *arm_iommu_alloc_attrs(struct device *dev, size_t size, - */ - gfp &= ~(__GFP_COMP); - -- pages = __iommu_alloc_buffer(dev, size, gfp, attrs); -+ /* For now always consider we are in a non-coherent case */ -+ pages = __iommu_alloc_buffer(dev, size, gfp, attrs, NORMAL); - if (!pages) - return NULL; - -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 5a0a691..2038492 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -872,7 +872,7 @@ config RELOCATABLE - - config RANDOMIZE_BASE - bool "Randomize the address of the kernel image" -- select ARM64_MODULE_PLTS -+ select ARM64_MODULE_PLTS if MODULES - select RELOCATABLE - help - Randomizes the virtual address at which the kernel image is -diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi -index 8b4a7c9..080203e 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi -@@ -670,7 +670,7 @@ - #address-cells = <0>; - - reg = <0x0 0xffb71000 0x0 0x1000>, -- <0x0 0xffb72000 0x0 0x1000>, -+ <0x0 0xffb72000 0x0 0x2000>, - <0x0 0xffb74000 0x0 0x2000>, - <0x0 0xffb76000 0x0 0x2000>; - interrupts = <GIC_PPI 9 -diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c -index 4fbf3c5..0800d23 100644 ---- a/arch/arm64/kernel/debug-monitors.c -+++ b/arch/arm64/kernel/debug-monitors.c -@@ -151,7 +151,6 @@ static int debug_monitors_init(void) - /* Clear the OS lock. */ - on_each_cpu(clear_os_lock, NULL, 1); - isb(); -- local_dbg_enable(); - - /* Register hotplug handler. */ - __register_cpu_notifier(&os_lock_nb); -diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c -index 21ab5df..65d81f9 100644 ---- a/arch/arm64/kernel/hibernate.c -+++ b/arch/arm64/kernel/hibernate.c -@@ -35,6 +35,7 @@ - #include <asm/sections.h> - #include <asm/smp.h> - #include <asm/suspend.h> -+#include <asm/sysreg.h> - #include <asm/virt.h> - - /* -@@ -217,12 +218,22 @@ static int create_safe_exec_page(void *src_start, size_t length, - set_pte(pte, __pte(virt_to_phys((void *)dst) | - pgprot_val(PAGE_KERNEL_EXEC))); - -- /* Load our new page tables */ -- asm volatile("msr ttbr0_el1, %0;" -- "isb;" -- "tlbi vmalle1is;" -- "dsb ish;" -- "isb" : : "r"(virt_to_phys(pgd))); -+ /* -+ * Load our new page tables. A strict BBM approach requires that we -+ * ensure that TLBs are free of any entries that may overlap with the -+ * global mappings we are about to install. -+ * -+ * For a real hibernate/resume cycle TTBR0 currently points to a zero -+ * page, but TLBs may contain stale ASID-tagged entries (e.g. for EFI -+ * runtime services), while for a userspace-driven test_resume cycle it -+ * points to userspace page tables (and we must point it at a zero page -+ * ourselves). Elsewhere we only (un)install the idmap with preemption -+ * disabled, so T0SZ should be as required regardless. -+ */ -+ cpu_set_reserved_ttbr0(); -+ local_flush_tlb_all(); -+ write_sysreg(virt_to_phys(pgd), ttbr0_el1); -+ isb(); - - *phys_dst_addr = virt_to_phys((void *)dst); - -@@ -394,6 +405,38 @@ int swsusp_arch_resume(void) - void *, phys_addr_t, phys_addr_t); - - /* -+ * Restoring the memory image will overwrite the ttbr1 page tables. -+ * Create a second copy of just the linear map, and use this when -+ * restoring. -+ */ -+ tmp_pg_dir = (pgd_t *)get_safe_page(GFP_ATOMIC); -+ if (!tmp_pg_dir) { -+ pr_err("Failed to allocate memory for temporary page tables."); -+ rc = -ENOMEM; -+ goto out; -+ } -+ rc = copy_page_tables(tmp_pg_dir, PAGE_OFFSET, 0); -+ if (rc) -+ goto out; -+ -+ /* -+ * Since we only copied the linear map, we need to find restore_pblist's -+ * linear map address. -+ */ -+ lm_restore_pblist = LMADDR(restore_pblist); -+ -+ /* -+ * We need a zero page that is zero before & after resume in order to -+ * to break before make on the ttbr1 page tables. -+ */ -+ zero_page = (void *)get_safe_page(GFP_ATOMIC); -+ if (!zero_page) { -+ pr_err("Failed to allocate zero page."); -+ rc = -ENOMEM; -+ goto out; -+ } -+ -+ /* - * Locate the exit code in the bottom-but-one page, so that *NULL - * still has disastrous affects. - */ -@@ -419,27 +462,6 @@ int swsusp_arch_resume(void) - __flush_dcache_area(hibernate_exit, exit_size); - - /* -- * Restoring the memory image will overwrite the ttbr1 page tables. -- * Create a second copy of just the linear map, and use this when -- * restoring. -- */ -- tmp_pg_dir = (pgd_t *)get_safe_page(GFP_ATOMIC); -- if (!tmp_pg_dir) { -- pr_err("Failed to allocate memory for temporary page tables."); -- rc = -ENOMEM; -- goto out; -- } -- rc = copy_page_tables(tmp_pg_dir, PAGE_OFFSET, 0); -- if (rc) -- goto out; -- -- /* -- * Since we only copied the linear map, we need to find restore_pblist's -- * linear map address. -- */ -- lm_restore_pblist = LMADDR(restore_pblist); -- -- /* - * KASLR will cause the el2 vectors to be in a different location in - * the resumed kernel. Load hibernate's temporary copy into el2. - * -@@ -453,12 +475,6 @@ int swsusp_arch_resume(void) - __hyp_set_vectors(el2_vectors); - } - -- /* -- * We need a zero page that is zero before & after resume in order to -- * to break before make on the ttbr1 page tables. -- */ -- zero_page = (void *)get_safe_page(GFP_ATOMIC); -- - hibernate_exit(virt_to_phys(tmp_pg_dir), resume_hdr.ttbr1_el1, - resume_hdr.reenter_kernel, lm_restore_pblist, - resume_hdr.__hyp_stub_vectors, virt_to_phys(zero_page)); -diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c -index 62ff3c0..490db85 100644 ---- a/arch/arm64/kernel/smp.c -+++ b/arch/arm64/kernel/smp.c -@@ -267,7 +267,6 @@ asmlinkage void secondary_start_kernel(void) - set_cpu_online(cpu, true); - complete(&cpu_running); - -- local_dbg_enable(); - local_irq_enable(); - local_async_enable(); - -@@ -437,9 +436,9 @@ void __init smp_cpus_done(unsigned int max_cpus) - - void __init smp_prepare_boot_cpu(void) - { -+ set_my_cpu_offset(per_cpu_offset(smp_processor_id())); - cpuinfo_store_boot_cpu(); - save_boot_cpu_run_el(); -- set_my_cpu_offset(per_cpu_offset(smp_processor_id())); - } - - static u64 __init of_get_cpu_mpidr(struct device_node *dn) -@@ -694,6 +693,13 @@ void __init smp_prepare_cpus(unsigned int max_cpus) - smp_store_cpu_info(smp_processor_id()); - - /* -+ * If UP is mandated by "nosmp" (which implies "maxcpus=0"), don't set -+ * secondary CPUs present. -+ */ -+ if (max_cpus == 0) -+ return; -+ -+ /* - * Initialise the present map (which describes the set of CPUs - * actually populated at the present time) and release the - * secondaries from the bootloader. -diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S -index 435e820..e564d45 100644 ---- a/arch/arm64/kernel/vmlinux.lds.S -+++ b/arch/arm64/kernel/vmlinux.lds.S -@@ -181,9 +181,9 @@ SECTIONS - *(.hash) - } - -- __rela_offset = ADDR(.rela) - KIMAGE_VADDR; -+ __rela_offset = ABSOLUTE(ADDR(.rela) - KIMAGE_VADDR); - __rela_size = SIZEOF(.rela); -- __dynsym_offset = ADDR(.dynsym) - KIMAGE_VADDR; -+ __dynsym_offset = ABSOLUTE(ADDR(.dynsym) - KIMAGE_VADDR); - - . = ALIGN(SEGMENT_ALIGN); - __init_end = .; -diff --git a/arch/arm64/kvm/hyp/sysreg-sr.c b/arch/arm64/kvm/hyp/sysreg-sr.c -index 0f7c40e..9341376 100644 ---- a/arch/arm64/kvm/hyp/sysreg-sr.c -+++ b/arch/arm64/kvm/hyp/sysreg-sr.c -@@ -27,8 +27,8 @@ static void __hyp_text __sysreg_do_nothing(struct kvm_cpu_context *ctxt) { } - /* - * Non-VHE: Both host and guest must save everything. - * -- * VHE: Host must save tpidr*_el[01], actlr_el1, sp0, pc, pstate, and -- * guest must save everything. -+ * VHE: Host must save tpidr*_el[01], actlr_el1, mdscr_el1, sp0, pc, -+ * pstate, and guest must save everything. - */ - - static void __hyp_text __sysreg_save_common_state(struct kvm_cpu_context *ctxt) -@@ -37,6 +37,7 @@ static void __hyp_text __sysreg_save_common_state(struct kvm_cpu_context *ctxt) - ctxt->sys_regs[TPIDR_EL0] = read_sysreg(tpidr_el0); - ctxt->sys_regs[TPIDRRO_EL0] = read_sysreg(tpidrro_el0); - ctxt->sys_regs[TPIDR_EL1] = read_sysreg(tpidr_el1); -+ ctxt->sys_regs[MDSCR_EL1] = read_sysreg(mdscr_el1); - ctxt->gp_regs.regs.sp = read_sysreg(sp_el0); - ctxt->gp_regs.regs.pc = read_sysreg_el2(elr); - ctxt->gp_regs.regs.pstate = read_sysreg_el2(spsr); -@@ -61,7 +62,6 @@ static void __hyp_text __sysreg_save_state(struct kvm_cpu_context *ctxt) - ctxt->sys_regs[AMAIR_EL1] = read_sysreg_el1(amair); - ctxt->sys_regs[CNTKCTL_EL1] = read_sysreg_el1(cntkctl); - ctxt->sys_regs[PAR_EL1] = read_sysreg(par_el1); -- ctxt->sys_regs[MDSCR_EL1] = read_sysreg(mdscr_el1); - - ctxt->gp_regs.sp_el1 = read_sysreg(sp_el1); - ctxt->gp_regs.elr_el1 = read_sysreg_el1(elr); -@@ -90,6 +90,7 @@ static void __hyp_text __sysreg_restore_common_state(struct kvm_cpu_context *ctx - write_sysreg(ctxt->sys_regs[TPIDR_EL0], tpidr_el0); - write_sysreg(ctxt->sys_regs[TPIDRRO_EL0], tpidrro_el0); - write_sysreg(ctxt->sys_regs[TPIDR_EL1], tpidr_el1); -+ write_sysreg(ctxt->sys_regs[MDSCR_EL1], mdscr_el1); - write_sysreg(ctxt->gp_regs.regs.sp, sp_el0); - write_sysreg_el2(ctxt->gp_regs.regs.pc, elr); - write_sysreg_el2(ctxt->gp_regs.regs.pstate, spsr); -@@ -114,7 +115,6 @@ static void __hyp_text __sysreg_restore_state(struct kvm_cpu_context *ctxt) - write_sysreg_el1(ctxt->sys_regs[AMAIR_EL1], amair); - write_sysreg_el1(ctxt->sys_regs[CNTKCTL_EL1], cntkctl); - write_sysreg(ctxt->sys_regs[PAR_EL1], par_el1); -- write_sysreg(ctxt->sys_regs[MDSCR_EL1], mdscr_el1); - - write_sysreg(ctxt->gp_regs.sp_el1, sp_el1); - write_sysreg_el1(ctxt->gp_regs.elr_el1, elr); -diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c -index e9e0e6d..898c0e6 100644 ---- a/arch/arm64/kvm/inject_fault.c -+++ b/arch/arm64/kvm/inject_fault.c -@@ -132,16 +132,14 @@ static u64 get_except_vector(struct kvm_vcpu *vcpu, enum exception_type type) - static void inject_abt64(struct kvm_vcpu *vcpu, bool is_iabt, unsigned long addr) - { - unsigned long cpsr = *vcpu_cpsr(vcpu); -- bool is_aarch32; -+ bool is_aarch32 = vcpu_mode_is_32bit(vcpu); - u32 esr = 0; - -- is_aarch32 = vcpu_mode_is_32bit(vcpu); -- -- *vcpu_spsr(vcpu) = cpsr; - *vcpu_elr_el1(vcpu) = *vcpu_pc(vcpu); -- - *vcpu_pc(vcpu) = get_except_vector(vcpu, except_type_sync); -+ - *vcpu_cpsr(vcpu) = PSTATE_FAULT_BITS_64; -+ *vcpu_spsr(vcpu) = cpsr; - - vcpu_sys_reg(vcpu, FAR_EL1) = addr; - -@@ -172,11 +170,11 @@ static void inject_undef64(struct kvm_vcpu *vcpu) - unsigned long cpsr = *vcpu_cpsr(vcpu); - u32 esr = (ESR_ELx_EC_UNKNOWN << ESR_ELx_EC_SHIFT); - -- *vcpu_spsr(vcpu) = cpsr; - *vcpu_elr_el1(vcpu) = *vcpu_pc(vcpu); -- - *vcpu_pc(vcpu) = get_except_vector(vcpu, except_type_sync); -+ - *vcpu_cpsr(vcpu) = PSTATE_FAULT_BITS_64; -+ *vcpu_spsr(vcpu) = cpsr; - - /* - * Build an unknown exception, depending on the instruction -diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c -index 0f85a46..3e90a2c 100644 ---- a/arch/arm64/mm/mmu.c -+++ b/arch/arm64/mm/mmu.c -@@ -748,9 +748,9 @@ void *__init __fixmap_remap_fdt(phys_addr_t dt_phys, int *size, pgprot_t prot) - /* - * Check whether the physical FDT address is set and meets the minimum - * alignment requirement. Since we are relying on MIN_FDT_ALIGN to be -- * at least 8 bytes so that we can always access the size field of the -- * FDT header after mapping the first chunk, double check here if that -- * is indeed the case. -+ * at least 8 bytes so that we can always access the magic and size -+ * fields of the FDT header after mapping the first chunk, double check -+ * here if that is indeed the case. - */ - BUILD_BUG_ON(MIN_FDT_ALIGN < 8); - if (!dt_phys || dt_phys % MIN_FDT_ALIGN) -@@ -778,7 +778,7 @@ void *__init __fixmap_remap_fdt(phys_addr_t dt_phys, int *size, pgprot_t prot) - create_mapping_noalloc(round_down(dt_phys, SWAPPER_BLOCK_SIZE), - dt_virt_base, SWAPPER_BLOCK_SIZE, prot); - -- if (fdt_check_header(dt_virt) != 0) -+ if (fdt_magic(dt_virt) != FDT_MAGIC) - return NULL; - - *size = fdt_totalsize(dt_virt); -diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S -index c431787..5bb61de 100644 ---- a/arch/arm64/mm/proc.S -+++ b/arch/arm64/mm/proc.S -@@ -180,6 +180,8 @@ ENTRY(__cpu_setup) - msr cpacr_el1, x0 // Enable FP/ASIMD - mov x0, #1 << 12 // Reset mdscr_el1 and disable - msr mdscr_el1, x0 // access to the DCC from EL0 -+ isb // Unmask debug exceptions now, -+ enable_dbg // since this is per-cpu - reset_pmuserenr_el0 x0 // Disable PMU access from EL0 - /* - * Memory region attributes for LPAE: -diff --git a/arch/metag/include/asm/cmpxchg_lnkget.h b/arch/metag/include/asm/cmpxchg_lnkget.h -index 0154e28..2369ad3 100644 ---- a/arch/metag/include/asm/cmpxchg_lnkget.h -+++ b/arch/metag/include/asm/cmpxchg_lnkget.h -@@ -73,7 +73,7 @@ static inline unsigned long __cmpxchg_u32(volatile int *m, unsigned long old, - " DCACHE [%2], %0\n" - #endif - "2:\n" -- : "=&d" (temp), "=&da" (retval) -+ : "=&d" (temp), "=&d" (retval) - : "da" (m), "bd" (old), "da" (new) - : "cc" - ); -diff --git a/arch/mips/kernel/cevt-r4k.c b/arch/mips/kernel/cevt-r4k.c -index e4c21bb..804d2a2 100644 ---- a/arch/mips/kernel/cevt-r4k.c -+++ b/arch/mips/kernel/cevt-r4k.c -@@ -276,12 +276,7 @@ int r4k_clockevent_init(void) - CLOCK_EVT_FEAT_C3STOP | - CLOCK_EVT_FEAT_PERCPU; - -- clockevent_set_clock(cd, mips_hpt_frequency); -- -- /* Calculate the min / max delta */ -- cd->max_delta_ns = clockevent_delta2ns(0x7fffffff, cd); - min_delta = calculate_min_delta(); -- cd->min_delta_ns = clockevent_delta2ns(min_delta, cd); - - cd->rating = 300; - cd->irq = irq; -@@ -289,7 +284,7 @@ int r4k_clockevent_init(void) - cd->set_next_event = mips_next_event; - cd->event_handler = mips_event_handler; - -- clockevents_register_device(cd); -+ clockevents_config_and_register(cd, mips_hpt_frequency, min_delta, 0x7fffffff); - - if (cp0_timer_irq_installed) - return 0; -diff --git a/arch/mips/kernel/csrc-r4k.c b/arch/mips/kernel/csrc-r4k.c -index 1f91056..d76275d 100644 ---- a/arch/mips/kernel/csrc-r4k.c -+++ b/arch/mips/kernel/csrc-r4k.c -@@ -23,7 +23,7 @@ static struct clocksource clocksource_mips = { - .flags = CLOCK_SOURCE_IS_CONTINUOUS, - }; - --static u64 notrace r4k_read_sched_clock(void) -+static u64 __maybe_unused notrace r4k_read_sched_clock(void) - { - return read_c0_count(); - } -@@ -82,7 +82,9 @@ int __init init_r4k_clocksource(void) - - clocksource_register_hz(&clocksource_mips, mips_hpt_frequency); - -+#ifndef CONFIG_CPU_FREQ - sched_clock_register(r4k_read_sched_clock, 32, mips_hpt_frequency); -+#endif - - return 0; - } -diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c -index 645c8a1..2b42a74 100644 ---- a/arch/mips/kvm/emulate.c -+++ b/arch/mips/kvm/emulate.c -@@ -1615,8 +1615,14 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc, - - preempt_disable(); - if (KVM_GUEST_KSEGX(va) == KVM_GUEST_KSEG0) { -- if (kvm_mips_host_tlb_lookup(vcpu, va) < 0) -- kvm_mips_handle_kseg0_tlb_fault(va, vcpu); -+ if (kvm_mips_host_tlb_lookup(vcpu, va) < 0 && -+ kvm_mips_handle_kseg0_tlb_fault(va, vcpu)) { -+ kvm_err("%s: handling mapped kseg0 tlb fault for %lx, vcpu: %p, ASID: %#lx\n", -+ __func__, va, vcpu, read_c0_entryhi()); -+ er = EMULATE_FAIL; -+ preempt_enable(); -+ goto done; -+ } - } else if ((KVM_GUEST_KSEGX(va) < KVM_GUEST_KSEG0) || - KVM_GUEST_KSEGX(va) == KVM_GUEST_KSEG23) { - int index; -@@ -1654,14 +1660,19 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc, - run, vcpu); - preempt_enable(); - goto dont_update_pc; -- } else { -- /* -- * We fault an entry from the guest tlb to the -- * shadow host TLB -- */ -- kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb, -- NULL, -- NULL); -+ } -+ /* -+ * We fault an entry from the guest tlb to the -+ * shadow host TLB -+ */ -+ if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb, -+ NULL, NULL)) { -+ kvm_err("%s: handling mapped seg tlb fault for %lx, index: %u, vcpu: %p, ASID: %#lx\n", -+ __func__, va, index, vcpu, -+ read_c0_entryhi()); -+ er = EMULATE_FAIL; -+ preempt_enable(); -+ goto done; - } - } - } else { -@@ -2625,8 +2636,13 @@ enum emulation_result kvm_mips_handle_tlbmiss(unsigned long cause, - * OK we have a Guest TLB entry, now inject it into the - * shadow host TLB - */ -- kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb, NULL, -- NULL); -+ if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb, -+ NULL, NULL)) { -+ kvm_err("%s: handling mapped seg tlb fault for %lx, index: %u, vcpu: %p, ASID: %#lx\n", -+ __func__, va, index, vcpu, -+ read_c0_entryhi()); -+ er = EMULATE_FAIL; -+ } - } - } - -diff --git a/arch/mips/kvm/tlb.c b/arch/mips/kvm/tlb.c -index ed021ae..ad2270f 100644 ---- a/arch/mips/kvm/tlb.c -+++ b/arch/mips/kvm/tlb.c -@@ -284,7 +284,7 @@ int kvm_mips_handle_kseg0_tlb_fault(unsigned long badvaddr, - } - - gfn = (KVM_GUEST_CPHYSADDR(badvaddr) >> PAGE_SHIFT); -- if (gfn >= kvm->arch.guest_pmap_npages) { -+ if ((gfn | 1) >= kvm->arch.guest_pmap_npages) { - kvm_err("%s: Invalid gfn: %#llx, BadVaddr: %#lx\n", __func__, - gfn, badvaddr); - kvm_mips_dump_host_tlbs(); -@@ -373,26 +373,40 @@ int kvm_mips_handle_mapped_seg_tlb_fault(struct kvm_vcpu *vcpu, - unsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0; - struct kvm *kvm = vcpu->kvm; - kvm_pfn_t pfn0, pfn1; -+ gfn_t gfn0, gfn1; -+ long tlb_lo[2]; - int ret; - -- if ((tlb->tlb_hi & VPN2_MASK) == 0) { -- pfn0 = 0; -- pfn1 = 0; -- } else { -- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo0) -- >> PAGE_SHIFT) < 0) -- return -1; -- -- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo1) -- >> PAGE_SHIFT) < 0) -- return -1; -- -- pfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo0) -- >> PAGE_SHIFT]; -- pfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo1) -- >> PAGE_SHIFT]; -+ tlb_lo[0] = tlb->tlb_lo0; -+ tlb_lo[1] = tlb->tlb_lo1; -+ -+ /* -+ * The commpage address must not be mapped to anything else if the guest -+ * TLB contains entries nearby, or commpage accesses will break. -+ */ -+ if (!((tlb->tlb_hi ^ KVM_GUEST_COMMPAGE_ADDR) & -+ VPN2_MASK & (PAGE_MASK << 1))) -+ tlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0; -+ -+ gfn0 = mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT; -+ gfn1 = mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT; -+ if (gfn0 >= kvm->arch.guest_pmap_npages || -+ gfn1 >= kvm->arch.guest_pmap_npages) { -+ kvm_err("%s: Invalid gfn: [%#llx, %#llx], EHi: %#lx\n", -+ __func__, gfn0, gfn1, tlb->tlb_hi); -+ kvm_mips_dump_guest_tlbs(vcpu); -+ return -1; - } - -+ if (kvm_mips_map_page(kvm, gfn0) < 0) -+ return -1; -+ -+ if (kvm_mips_map_page(kvm, gfn1) < 0) -+ return -1; -+ -+ pfn0 = kvm->arch.guest_pmap[gfn0]; -+ pfn1 = kvm->arch.guest_pmap[gfn1]; -+ - if (hpa0) - *hpa0 = pfn0 << PAGE_SHIFT; - -@@ -401,9 +415,9 @@ int kvm_mips_handle_mapped_seg_tlb_fault(struct kvm_vcpu *vcpu, - - /* Get attributes from the Guest TLB */ - entrylo0 = mips3_paddr_to_tlbpfn(pfn0 << PAGE_SHIFT) | (0x3 << 3) | -- (tlb->tlb_lo0 & MIPS3_PG_D) | (tlb->tlb_lo0 & MIPS3_PG_V); -+ (tlb_lo[0] & MIPS3_PG_D) | (tlb_lo[0] & MIPS3_PG_V); - entrylo1 = mips3_paddr_to_tlbpfn(pfn1 << PAGE_SHIFT) | (0x3 << 3) | -- (tlb->tlb_lo1 & MIPS3_PG_D) | (tlb->tlb_lo1 & MIPS3_PG_V); -+ (tlb_lo[1] & MIPS3_PG_D) | (tlb_lo[1] & MIPS3_PG_V); - - kvm_debug("@ %#lx tlb_lo0: 0x%08lx tlb_lo1: 0x%08lx\n", vcpu->arch.pc, - tlb->tlb_lo0, tlb->tlb_lo1); -@@ -776,10 +790,16 @@ uint32_t kvm_get_inst(uint32_t *opc, struct kvm_vcpu *vcpu) - local_irq_restore(flags); - return KVM_INVALID_INST; - } -- kvm_mips_handle_mapped_seg_tlb_fault(vcpu, -- &vcpu->arch. -- guest_tlb[index], -- NULL, NULL); -+ if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu, -+ &vcpu->arch.guest_tlb[index], -+ NULL, NULL)) { -+ kvm_err("%s: handling mapped seg tlb fault failed for %p, index: %u, vcpu: %p, ASID: %#lx\n", -+ __func__, opc, index, vcpu, -+ read_c0_entryhi()); -+ kvm_mips_dump_guest_tlbs(vcpu); -+ local_irq_restore(flags); -+ return KVM_INVALID_INST; -+ } - inst = *(opc); - } - local_irq_restore(flags); -diff --git a/arch/mips/loongson64/loongson-3/hpet.c b/arch/mips/loongson64/loongson-3/hpet.c -index 249039a..4788bea 100644 ---- a/arch/mips/loongson64/loongson-3/hpet.c -+++ b/arch/mips/loongson64/loongson-3/hpet.c -@@ -13,8 +13,8 @@ - #define SMBUS_PCI_REG64 0x64 - #define SMBUS_PCI_REGB4 0xb4 - --#define HPET_MIN_CYCLES 64 --#define HPET_MIN_PROG_DELTA (HPET_MIN_CYCLES + (HPET_MIN_CYCLES >> 1)) -+#define HPET_MIN_CYCLES 16 -+#define HPET_MIN_PROG_DELTA (HPET_MIN_CYCLES * 12) - - static DEFINE_SPINLOCK(hpet_lock); - DEFINE_PER_CPU(struct clock_event_device, hpet_clockevent_device); -@@ -157,14 +157,14 @@ static int hpet_tick_resume(struct clock_event_device *evt) - static int hpet_next_event(unsigned long delta, - struct clock_event_device *evt) - { -- unsigned int cnt; -- int res; -+ u32 cnt; -+ s32 res; - - cnt = hpet_read(HPET_COUNTER); -- cnt += delta; -+ cnt += (u32) delta; - hpet_write(HPET_T0_CMP, cnt); - -- res = (int)(cnt - hpet_read(HPET_COUNTER)); -+ res = (s32)(cnt - hpet_read(HPET_COUNTER)); - - return res < HPET_MIN_CYCLES ? -ETIME : 0; - } -@@ -230,7 +230,7 @@ void __init setup_hpet_timer(void) - - cd = &per_cpu(hpet_clockevent_device, cpu); - cd->name = "hpet"; -- cd->rating = 320; -+ cd->rating = 100; - cd->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT; - cd->set_state_shutdown = hpet_set_state_shutdown; - cd->set_state_periodic = hpet_set_state_periodic; -diff --git a/arch/mips/mm/uasm-mips.c b/arch/mips/mm/uasm-mips.c -index 9c2220a..45e3b87 100644 ---- a/arch/mips/mm/uasm-mips.c -+++ b/arch/mips/mm/uasm-mips.c -@@ -65,7 +65,7 @@ static struct insn insn_table[] = { - #ifndef CONFIG_CPU_MIPSR6 - { insn_cache, M(cache_op, 0, 0, 0, 0, 0), RS | RT | SIMM }, - #else -- { insn_cache, M6(cache_op, 0, 0, 0, cache6_op), RS | RT | SIMM9 }, -+ { insn_cache, M6(spec3_op, 0, 0, 0, cache6_op), RS | RT | SIMM9 }, - #endif - { insn_daddiu, M(daddiu_op, 0, 0, 0, 0, 0), RS | RT | SIMM }, - { insn_daddu, M(spec_op, 0, 0, 0, 0, daddu_op), RS | RT | RD }, -diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S -index b7019b5..298afcf 100644 ---- a/arch/powerpc/kernel/tm.S -+++ b/arch/powerpc/kernel/tm.S -@@ -338,8 +338,6 @@ _GLOBAL(__tm_recheckpoint) - */ - subi r7, r7, STACK_FRAME_OVERHEAD - -- SET_SCRATCH0(r1) -- - mfmsr r6 - /* R4 = original MSR to indicate whether thread used FP/Vector etc. */ - -@@ -468,6 +466,7 @@ restore_gprs: - * until we turn MSR RI back on. - */ - -+ SET_SCRATCH0(r1) - ld r5, -8(r1) - ld r1, -16(r1) - -diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -index e571ad2..38e108e 100644 ---- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S -+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -@@ -655,112 +655,8 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) - - #ifdef CONFIG_PPC_TRANSACTIONAL_MEM - BEGIN_FTR_SECTION -- b skip_tm --END_FTR_SECTION_IFCLR(CPU_FTR_TM) -- -- /* Turn on TM/FP/VSX/VMX so we can restore them. */ -- mfmsr r5 -- li r6, MSR_TM >> 32 -- sldi r6, r6, 32 -- or r5, r5, r6 -- ori r5, r5, MSR_FP -- oris r5, r5, (MSR_VEC | MSR_VSX)@h -- mtmsrd r5 -- -- /* -- * The user may change these outside of a transaction, so they must -- * always be context switched. -- */ -- ld r5, VCPU_TFHAR(r4) -- ld r6, VCPU_TFIAR(r4) -- ld r7, VCPU_TEXASR(r4) -- mtspr SPRN_TFHAR, r5 -- mtspr SPRN_TFIAR, r6 -- mtspr SPRN_TEXASR, r7 -- -- ld r5, VCPU_MSR(r4) -- rldicl. r5, r5, 64 - MSR_TS_S_LG, 62 -- beq skip_tm /* TM not active in guest */ -- -- /* Make sure the failure summary is set, otherwise we'll program check -- * when we trechkpt. It's possible that this might have been not set -- * on a kvmppc_set_one_reg() call but we shouldn't let this crash the -- * host. -- */ -- oris r7, r7, (TEXASR_FS)@h -- mtspr SPRN_TEXASR, r7 -- -- /* -- * We need to load up the checkpointed state for the guest. -- * We need to do this early as it will blow away any GPRs, VSRs and -- * some SPRs. -- */ -- -- mr r31, r4 -- addi r3, r31, VCPU_FPRS_TM -- bl load_fp_state -- addi r3, r31, VCPU_VRS_TM -- bl load_vr_state -- mr r4, r31 -- lwz r7, VCPU_VRSAVE_TM(r4) -- mtspr SPRN_VRSAVE, r7 -- -- ld r5, VCPU_LR_TM(r4) -- lwz r6, VCPU_CR_TM(r4) -- ld r7, VCPU_CTR_TM(r4) -- ld r8, VCPU_AMR_TM(r4) -- ld r9, VCPU_TAR_TM(r4) -- mtlr r5 -- mtcr r6 -- mtctr r7 -- mtspr SPRN_AMR, r8 -- mtspr SPRN_TAR, r9 -- -- /* -- * Load up PPR and DSCR values but don't put them in the actual SPRs -- * till the last moment to avoid running with userspace PPR and DSCR for -- * too long. -- */ -- ld r29, VCPU_DSCR_TM(r4) -- ld r30, VCPU_PPR_TM(r4) -- -- std r2, PACATMSCRATCH(r13) /* Save TOC */ -- -- /* Clear the MSR RI since r1, r13 are all going to be foobar. */ -- li r5, 0 -- mtmsrd r5, 1 -- -- /* Load GPRs r0-r28 */ -- reg = 0 -- .rept 29 -- ld reg, VCPU_GPRS_TM(reg)(r31) -- reg = reg + 1 -- .endr -- -- mtspr SPRN_DSCR, r29 -- mtspr SPRN_PPR, r30 -- -- /* Load final GPRs */ -- ld 29, VCPU_GPRS_TM(29)(r31) -- ld 30, VCPU_GPRS_TM(30)(r31) -- ld 31, VCPU_GPRS_TM(31)(r31) -- -- /* TM checkpointed state is now setup. All GPRs are now volatile. */ -- TRECHKPT -- -- /* Now let's get back the state we need. */ -- HMT_MEDIUM -- GET_PACA(r13) -- ld r29, HSTATE_DSCR(r13) -- mtspr SPRN_DSCR, r29 -- ld r4, HSTATE_KVM_VCPU(r13) -- ld r1, HSTATE_HOST_R1(r13) -- ld r2, PACATMSCRATCH(r13) -- -- /* Set the MSR RI since we have our registers back. */ -- li r5, MSR_RI -- mtmsrd r5, 1 --skip_tm: -+ bl kvmppc_restore_tm -+END_FTR_SECTION_IFSET(CPU_FTR_TM) - #endif - - /* Load guest PMU registers */ -@@ -841,12 +737,6 @@ BEGIN_FTR_SECTION - /* Skip next section on POWER7 */ - b 8f - END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) -- /* Turn on TM so we can access TFHAR/TFIAR/TEXASR */ -- mfmsr r8 -- li r0, 1 -- rldimi r8, r0, MSR_TM_LG, 63-MSR_TM_LG -- mtmsrd r8 -- - /* Load up POWER8-specific registers */ - ld r5, VCPU_IAMR(r4) - lwz r6, VCPU_PSPB(r4) -@@ -1436,106 +1326,8 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) - - #ifdef CONFIG_PPC_TRANSACTIONAL_MEM - BEGIN_FTR_SECTION -- b 2f --END_FTR_SECTION_IFCLR(CPU_FTR_TM) -- /* Turn on TM. */ -- mfmsr r8 -- li r0, 1 -- rldimi r8, r0, MSR_TM_LG, 63-MSR_TM_LG -- mtmsrd r8 -- -- ld r5, VCPU_MSR(r9) -- rldicl. r5, r5, 64 - MSR_TS_S_LG, 62 -- beq 1f /* TM not active in guest. */ -- -- li r3, TM_CAUSE_KVM_RESCHED -- -- /* Clear the MSR RI since r1, r13 are all going to be foobar. */ -- li r5, 0 -- mtmsrd r5, 1 -- -- /* All GPRs are volatile at this point. */ -- TRECLAIM(R3) -- -- /* Temporarily store r13 and r9 so we have some regs to play with */ -- SET_SCRATCH0(r13) -- GET_PACA(r13) -- std r9, PACATMSCRATCH(r13) -- ld r9, HSTATE_KVM_VCPU(r13) -- -- /* Get a few more GPRs free. */ -- std r29, VCPU_GPRS_TM(29)(r9) -- std r30, VCPU_GPRS_TM(30)(r9) -- std r31, VCPU_GPRS_TM(31)(r9) -- -- /* Save away PPR and DSCR soon so don't run with user values. */ -- mfspr r31, SPRN_PPR -- HMT_MEDIUM -- mfspr r30, SPRN_DSCR -- ld r29, HSTATE_DSCR(r13) -- mtspr SPRN_DSCR, r29 -- -- /* Save all but r9, r13 & r29-r31 */ -- reg = 0 -- .rept 29 -- .if (reg != 9) && (reg != 13) -- std reg, VCPU_GPRS_TM(reg)(r9) -- .endif -- reg = reg + 1 -- .endr -- /* ... now save r13 */ -- GET_SCRATCH0(r4) -- std r4, VCPU_GPRS_TM(13)(r9) -- /* ... and save r9 */ -- ld r4, PACATMSCRATCH(r13) -- std r4, VCPU_GPRS_TM(9)(r9) -- -- /* Reload stack pointer and TOC. */ -- ld r1, HSTATE_HOST_R1(r13) -- ld r2, PACATOC(r13) -- -- /* Set MSR RI now we have r1 and r13 back. */ -- li r5, MSR_RI -- mtmsrd r5, 1 -- -- /* Save away checkpinted SPRs. */ -- std r31, VCPU_PPR_TM(r9) -- std r30, VCPU_DSCR_TM(r9) -- mflr r5 -- mfcr r6 -- mfctr r7 -- mfspr r8, SPRN_AMR -- mfspr r10, SPRN_TAR -- std r5, VCPU_LR_TM(r9) -- stw r6, VCPU_CR_TM(r9) -- std r7, VCPU_CTR_TM(r9) -- std r8, VCPU_AMR_TM(r9) -- std r10, VCPU_TAR_TM(r9) -- -- /* Restore r12 as trap number. */ -- lwz r12, VCPU_TRAP(r9) -- -- /* Save FP/VSX. */ -- addi r3, r9, VCPU_FPRS_TM -- bl store_fp_state -- addi r3, r9, VCPU_VRS_TM -- bl store_vr_state -- mfspr r6, SPRN_VRSAVE -- stw r6, VCPU_VRSAVE_TM(r9) --1: -- /* -- * We need to save these SPRs after the treclaim so that the software -- * error code is recorded correctly in the TEXASR. Also the user may -- * change these outside of a transaction, so they must always be -- * context switched. -- */ -- mfspr r5, SPRN_TFHAR -- mfspr r6, SPRN_TFIAR -- mfspr r7, SPRN_TEXASR -- std r5, VCPU_TFHAR(r9) -- std r6, VCPU_TFIAR(r9) -- std r7, VCPU_TEXASR(r9) --2: -+ bl kvmppc_save_tm -+END_FTR_SECTION_IFSET(CPU_FTR_TM) - #endif - - /* Increment yield count if they have a VPA */ -@@ -2245,6 +2037,13 @@ _GLOBAL(kvmppc_h_cede) /* r3 = vcpu pointer, r11 = msr, r13 = paca */ - /* save FP state */ - bl kvmppc_save_fp - -+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM -+BEGIN_FTR_SECTION -+ ld r9, HSTATE_KVM_VCPU(r13) -+ bl kvmppc_save_tm -+END_FTR_SECTION_IFSET(CPU_FTR_TM) -+#endif -+ - /* - * Set DEC to the smaller of DEC and HDEC, so that we wake - * no later than the end of our timeslice (HDEC interrupts -@@ -2321,6 +2120,12 @@ kvm_end_cede: - bl kvmhv_accumulate_time - #endif - -+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM -+BEGIN_FTR_SECTION -+ bl kvmppc_restore_tm -+END_FTR_SECTION_IFSET(CPU_FTR_TM) -+#endif -+ - /* load up FP state */ - bl kvmppc_load_fp - -@@ -2631,6 +2436,239 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC) - mr r4,r31 - blr - -+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM -+/* -+ * Save transactional state and TM-related registers. -+ * Called with r9 pointing to the vcpu struct. -+ * This can modify all checkpointed registers, but -+ * restores r1, r2 and r9 (vcpu pointer) before exit. -+ */ -+kvmppc_save_tm: -+ mflr r0 -+ std r0, PPC_LR_STKOFF(r1) -+ -+ /* Turn on TM. */ -+ mfmsr r8 -+ li r0, 1 -+ rldimi r8, r0, MSR_TM_LG, 63-MSR_TM_LG -+ mtmsrd r8 -+ -+ ld r5, VCPU_MSR(r9) -+ rldicl. r5, r5, 64 - MSR_TS_S_LG, 62 -+ beq 1f /* TM not active in guest. */ -+ -+ std r1, HSTATE_HOST_R1(r13) -+ li r3, TM_CAUSE_KVM_RESCHED -+ -+ /* Clear the MSR RI since r1, r13 are all going to be foobar. */ -+ li r5, 0 -+ mtmsrd r5, 1 -+ -+ /* All GPRs are volatile at this point. */ -+ TRECLAIM(R3) -+ -+ /* Temporarily store r13 and r9 so we have some regs to play with */ -+ SET_SCRATCH0(r13) -+ GET_PACA(r13) -+ std r9, PACATMSCRATCH(r13) -+ ld r9, HSTATE_KVM_VCPU(r13) -+ -+ /* Get a few more GPRs free. */ -+ std r29, VCPU_GPRS_TM(29)(r9) -+ std r30, VCPU_GPRS_TM(30)(r9) -+ std r31, VCPU_GPRS_TM(31)(r9) -+ -+ /* Save away PPR and DSCR soon so don't run with user values. */ -+ mfspr r31, SPRN_PPR -+ HMT_MEDIUM -+ mfspr r30, SPRN_DSCR -+ ld r29, HSTATE_DSCR(r13) -+ mtspr SPRN_DSCR, r29 -+ -+ /* Save all but r9, r13 & r29-r31 */ -+ reg = 0 -+ .rept 29 -+ .if (reg != 9) && (reg != 13) -+ std reg, VCPU_GPRS_TM(reg)(r9) -+ .endif -+ reg = reg + 1 -+ .endr -+ /* ... now save r13 */ -+ GET_SCRATCH0(r4) -+ std r4, VCPU_GPRS_TM(13)(r9) -+ /* ... and save r9 */ -+ ld r4, PACATMSCRATCH(r13) -+ std r4, VCPU_GPRS_TM(9)(r9) -+ -+ /* Reload stack pointer and TOC. */ -+ ld r1, HSTATE_HOST_R1(r13) -+ ld r2, PACATOC(r13) -+ -+ /* Set MSR RI now we have r1 and r13 back. */ -+ li r5, MSR_RI -+ mtmsrd r5, 1 -+ -+ /* Save away checkpinted SPRs. */ -+ std r31, VCPU_PPR_TM(r9) -+ std r30, VCPU_DSCR_TM(r9) -+ mflr r5 -+ mfcr r6 -+ mfctr r7 -+ mfspr r8, SPRN_AMR -+ mfspr r10, SPRN_TAR -+ std r5, VCPU_LR_TM(r9) -+ stw r6, VCPU_CR_TM(r9) -+ std r7, VCPU_CTR_TM(r9) -+ std r8, VCPU_AMR_TM(r9) -+ std r10, VCPU_TAR_TM(r9) -+ -+ /* Restore r12 as trap number. */ -+ lwz r12, VCPU_TRAP(r9) -+ -+ /* Save FP/VSX. */ -+ addi r3, r9, VCPU_FPRS_TM -+ bl store_fp_state -+ addi r3, r9, VCPU_VRS_TM -+ bl store_vr_state -+ mfspr r6, SPRN_VRSAVE -+ stw r6, VCPU_VRSAVE_TM(r9) -+1: -+ /* -+ * We need to save these SPRs after the treclaim so that the software -+ * error code is recorded correctly in the TEXASR. Also the user may -+ * change these outside of a transaction, so they must always be -+ * context switched. -+ */ -+ mfspr r5, SPRN_TFHAR -+ mfspr r6, SPRN_TFIAR -+ mfspr r7, SPRN_TEXASR -+ std r5, VCPU_TFHAR(r9) -+ std r6, VCPU_TFIAR(r9) -+ std r7, VCPU_TEXASR(r9) -+ -+ ld r0, PPC_LR_STKOFF(r1) -+ mtlr r0 -+ blr -+ -+/* -+ * Restore transactional state and TM-related registers. -+ * Called with r4 pointing to the vcpu struct. -+ * This potentially modifies all checkpointed registers. -+ * It restores r1, r2, r4 from the PACA. -+ */ -+kvmppc_restore_tm: -+ mflr r0 -+ std r0, PPC_LR_STKOFF(r1) -+ -+ /* Turn on TM/FP/VSX/VMX so we can restore them. */ -+ mfmsr r5 -+ li r6, MSR_TM >> 32 -+ sldi r6, r6, 32 -+ or r5, r5, r6 -+ ori r5, r5, MSR_FP -+ oris r5, r5, (MSR_VEC | MSR_VSX)@h -+ mtmsrd r5 -+ -+ /* -+ * The user may change these outside of a transaction, so they must -+ * always be context switched. -+ */ -+ ld r5, VCPU_TFHAR(r4) -+ ld r6, VCPU_TFIAR(r4) -+ ld r7, VCPU_TEXASR(r4) -+ mtspr SPRN_TFHAR, r5 -+ mtspr SPRN_TFIAR, r6 -+ mtspr SPRN_TEXASR, r7 -+ -+ ld r5, VCPU_MSR(r4) -+ rldicl. r5, r5, 64 - MSR_TS_S_LG, 62 -+ beqlr /* TM not active in guest */ -+ std r1, HSTATE_HOST_R1(r13) -+ -+ /* Make sure the failure summary is set, otherwise we'll program check -+ * when we trechkpt. It's possible that this might have been not set -+ * on a kvmppc_set_one_reg() call but we shouldn't let this crash the -+ * host. -+ */ -+ oris r7, r7, (TEXASR_FS)@h -+ mtspr SPRN_TEXASR, r7 -+ -+ /* -+ * We need to load up the checkpointed state for the guest. -+ * We need to do this early as it will blow away any GPRs, VSRs and -+ * some SPRs. -+ */ -+ -+ mr r31, r4 -+ addi r3, r31, VCPU_FPRS_TM -+ bl load_fp_state -+ addi r3, r31, VCPU_VRS_TM -+ bl load_vr_state -+ mr r4, r31 -+ lwz r7, VCPU_VRSAVE_TM(r4) -+ mtspr SPRN_VRSAVE, r7 -+ -+ ld r5, VCPU_LR_TM(r4) -+ lwz r6, VCPU_CR_TM(r4) -+ ld r7, VCPU_CTR_TM(r4) -+ ld r8, VCPU_AMR_TM(r4) -+ ld r9, VCPU_TAR_TM(r4) -+ mtlr r5 -+ mtcr r6 -+ mtctr r7 -+ mtspr SPRN_AMR, r8 -+ mtspr SPRN_TAR, r9 -+ -+ /* -+ * Load up PPR and DSCR values but don't put them in the actual SPRs -+ * till the last moment to avoid running with userspace PPR and DSCR for -+ * too long. -+ */ -+ ld r29, VCPU_DSCR_TM(r4) -+ ld r30, VCPU_PPR_TM(r4) -+ -+ std r2, PACATMSCRATCH(r13) /* Save TOC */ -+ -+ /* Clear the MSR RI since r1, r13 are all going to be foobar. */ -+ li r5, 0 -+ mtmsrd r5, 1 -+ -+ /* Load GPRs r0-r28 */ -+ reg = 0 -+ .rept 29 -+ ld reg, VCPU_GPRS_TM(reg)(r31) -+ reg = reg + 1 -+ .endr -+ -+ mtspr SPRN_DSCR, r29 -+ mtspr SPRN_PPR, r30 -+ -+ /* Load final GPRs */ -+ ld 29, VCPU_GPRS_TM(29)(r31) -+ ld 30, VCPU_GPRS_TM(30)(r31) -+ ld 31, VCPU_GPRS_TM(31)(r31) -+ -+ /* TM checkpointed state is now setup. All GPRs are now volatile. */ -+ TRECHKPT -+ -+ /* Now let's get back the state we need. */ -+ HMT_MEDIUM -+ GET_PACA(r13) -+ ld r29, HSTATE_DSCR(r13) -+ mtspr SPRN_DSCR, r29 -+ ld r4, HSTATE_KVM_VCPU(r13) -+ ld r1, HSTATE_HOST_R1(r13) -+ ld r2, PACATMSCRATCH(r13) -+ -+ /* Set the MSR RI since we have our registers back. */ -+ li r5, MSR_RI -+ mtmsrd r5, 1 -+ -+ ld r0, PPC_LR_STKOFF(r1) -+ mtlr r0 -+ blr -+#endif -+ - /* - * We come here if we get any exception or interrupt while we are - * executing host real mode code while in guest MMU context. -diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h -index 18d2beb..42b968a8 100644 ---- a/arch/s390/include/asm/pgtable.h -+++ b/arch/s390/include/asm/pgtable.h -@@ -893,7 +893,7 @@ void ptep_zap_key(struct mm_struct *mm, unsigned long addr, pte_t *ptep); - bool test_and_clear_guest_dirty(struct mm_struct *mm, unsigned long address); - int set_guest_storage_key(struct mm_struct *mm, unsigned long addr, - unsigned char key, bool nq); --unsigned char get_guest_storage_key(struct mm_struct *mm, unsigned long addr); -+unsigned long get_guest_storage_key(struct mm_struct *mm, unsigned long addr); - - /* - * Certain architectures need to do special things when PTEs -diff --git a/arch/s390/include/asm/tlbflush.h b/arch/s390/include/asm/tlbflush.h -index a2e6ef3..0a20316 100644 ---- a/arch/s390/include/asm/tlbflush.h -+++ b/arch/s390/include/asm/tlbflush.h -@@ -81,7 +81,8 @@ static inline void __tlb_flush_full(struct mm_struct *mm) - } - - /* -- * Flush TLB entries for a specific ASCE on all CPUs. -+ * Flush TLB entries for a specific ASCE on all CPUs. Should never be used -+ * when more than one asce (e.g. gmap) ran on this mm. - */ - static inline void __tlb_flush_asce(struct mm_struct *mm, unsigned long asce) - { -diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c -index cace818..313c3b8 100644 ---- a/arch/s390/mm/gmap.c -+++ b/arch/s390/mm/gmap.c -@@ -85,7 +85,7 @@ EXPORT_SYMBOL_GPL(gmap_alloc); - static void gmap_flush_tlb(struct gmap *gmap) - { - if (MACHINE_HAS_IDTE) -- __tlb_flush_asce(gmap->mm, gmap->asce); -+ __tlb_flush_idte(gmap->asce); - else - __tlb_flush_global(); - } -@@ -124,7 +124,7 @@ void gmap_free(struct gmap *gmap) - - /* Flush tlb. */ - if (MACHINE_HAS_IDTE) -- __tlb_flush_asce(gmap->mm, gmap->asce); -+ __tlb_flush_idte(gmap->asce); - else - __tlb_flush_global(); - -diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c -index 9f0ce0e..ebb4f87 100644 ---- a/arch/s390/mm/pgtable.c -+++ b/arch/s390/mm/pgtable.c -@@ -543,7 +543,7 @@ int set_guest_storage_key(struct mm_struct *mm, unsigned long addr, - } - EXPORT_SYMBOL(set_guest_storage_key); - --unsigned char get_guest_storage_key(struct mm_struct *mm, unsigned long addr) -+unsigned long get_guest_storage_key(struct mm_struct *mm, unsigned long addr) - { - unsigned char key; - spinlock_t *ptl; -diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c -index 8acaf4e..a86d7cc 100644 ---- a/arch/um/os-Linux/signal.c -+++ b/arch/um/os-Linux/signal.c -@@ -15,6 +15,7 @@ - #include <kern_util.h> - #include <os.h> - #include <sysdep/mcontext.h> -+#include <um_malloc.h> - - void (*sig_info[NSIG])(int, struct siginfo *, struct uml_pt_regs *) = { - [SIGTRAP] = relay_signal, -@@ -32,7 +33,7 @@ static void sig_handler_common(int sig, struct siginfo *si, mcontext_t *mc) - struct uml_pt_regs *r; - int save_errno = errno; - -- r = malloc(sizeof(struct uml_pt_regs)); -+ r = uml_kmalloc(sizeof(struct uml_pt_regs), UM_GFP_ATOMIC); - if (!r) - panic("out of memory"); - -@@ -91,7 +92,7 @@ static void timer_real_alarm_handler(mcontext_t *mc) - { - struct uml_pt_regs *regs; - -- regs = malloc(sizeof(struct uml_pt_regs)); -+ regs = uml_kmalloc(sizeof(struct uml_pt_regs), UM_GFP_ATOMIC); - if (!regs) - panic("out of memory"); - -diff --git a/arch/unicore32/include/asm/mmu_context.h b/arch/unicore32/include/asm/mmu_context.h -index e35632e..62dfc64 100644 ---- a/arch/unicore32/include/asm/mmu_context.h -+++ b/arch/unicore32/include/asm/mmu_context.h -@@ -98,7 +98,7 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm, - } - - static inline bool arch_vma_access_permitted(struct vm_area_struct *vma, -- bool write, bool foreign) -+ bool write, bool execute, bool foreign) - { - /* by default, allow everything */ - return true; -diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c -index 874e8bd..bd136ac 100644 ---- a/arch/x86/events/intel/uncore_snbep.c -+++ b/arch/x86/events/intel/uncore_snbep.c -@@ -2546,7 +2546,7 @@ void hswep_uncore_cpu_init(void) - - static struct intel_uncore_type hswep_uncore_ha = { - .name = "ha", -- .num_counters = 5, -+ .num_counters = 4, - .num_boxes = 2, - .perf_ctr_bits = 48, - SNBEP_UNCORE_PCI_COMMON_INIT(), -@@ -2565,7 +2565,7 @@ static struct uncore_event_desc hswep_uncore_imc_events[] = { - - static struct intel_uncore_type hswep_uncore_imc = { - .name = "imc", -- .num_counters = 5, -+ .num_counters = 4, - .num_boxes = 8, - .perf_ctr_bits = 48, - .fixed_ctr_bits = 48, -@@ -2611,7 +2611,7 @@ static struct intel_uncore_type hswep_uncore_irp = { - - static struct intel_uncore_type hswep_uncore_qpi = { - .name = "qpi", -- .num_counters = 5, -+ .num_counters = 4, - .num_boxes = 3, - .perf_ctr_bits = 48, - .perf_ctr = SNBEP_PCI_PMON_CTR0, -@@ -2693,7 +2693,7 @@ static struct event_constraint hswep_uncore_r3qpi_constraints[] = { - - static struct intel_uncore_type hswep_uncore_r3qpi = { - .name = "r3qpi", -- .num_counters = 4, -+ .num_counters = 3, - .num_boxes = 3, - .perf_ctr_bits = 44, - .constraints = hswep_uncore_r3qpi_constraints, -@@ -2892,7 +2892,7 @@ static struct intel_uncore_type bdx_uncore_ha = { - - static struct intel_uncore_type bdx_uncore_imc = { - .name = "imc", -- .num_counters = 5, -+ .num_counters = 4, - .num_boxes = 8, - .perf_ctr_bits = 48, - .fixed_ctr_bits = 48, -diff --git a/arch/x86/kvm/mtrr.c b/arch/x86/kvm/mtrr.c -index c146f3c..0149ac5 100644 ---- a/arch/x86/kvm/mtrr.c -+++ b/arch/x86/kvm/mtrr.c -@@ -539,6 +539,7 @@ static void mtrr_lookup_var_start(struct mtrr_iter *iter) - - iter->fixed = false; - iter->start_max = iter->start; -+ iter->range = NULL; - iter->range = list_prepare_entry(iter->range, &mtrr_state->head, node); - - __mtrr_lookup_var_next(iter); -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 64a79f2..8326d68 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -8224,6 +8224,7 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu) - if ((vectoring_info & VECTORING_INFO_VALID_MASK) && - (exit_reason != EXIT_REASON_EXCEPTION_NMI && - exit_reason != EXIT_REASON_EPT_VIOLATION && -+ exit_reason != EXIT_REASON_PML_FULL && - exit_reason != EXIT_REASON_TASK_SWITCH)) { - vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR; - vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV; -@@ -8854,6 +8855,22 @@ static void vmx_load_vmcs01(struct kvm_vcpu *vcpu) - put_cpu(); - } - -+/* -+ * Ensure that the current vmcs of the logical processor is the -+ * vmcs01 of the vcpu before calling free_nested(). -+ */ -+static void vmx_free_vcpu_nested(struct kvm_vcpu *vcpu) -+{ -+ struct vcpu_vmx *vmx = to_vmx(vcpu); -+ int r; -+ -+ r = vcpu_load(vcpu); -+ BUG_ON(r); -+ vmx_load_vmcs01(vcpu); -+ free_nested(vmx); -+ vcpu_put(vcpu); -+} -+ - static void vmx_free_vcpu(struct kvm_vcpu *vcpu) - { - struct vcpu_vmx *vmx = to_vmx(vcpu); -@@ -8862,8 +8879,7 @@ static void vmx_free_vcpu(struct kvm_vcpu *vcpu) - vmx_destroy_pml_buffer(vmx); - free_vpid(vmx->vpid); - leave_guest_mode(vcpu); -- vmx_load_vmcs01(vcpu); -- free_nested(vmx); -+ vmx_free_vcpu_nested(vcpu); - free_loaded_vmcs(vmx->loaded_vmcs); - kfree(vmx->guest_msrs); - kvm_vcpu_uninit(vcpu); -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 7da5dd2..fea2c57 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -91,6 +91,7 @@ static u64 __read_mostly efer_reserved_bits = ~((u64)EFER_SCE); - - static void update_cr8_intercept(struct kvm_vcpu *vcpu); - static void process_nmi(struct kvm_vcpu *vcpu); -+static void process_smi(struct kvm_vcpu *vcpu); - static void __kvm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags); - - struct kvm_x86_ops *kvm_x86_ops __read_mostly; -@@ -5296,13 +5297,8 @@ static void kvm_smm_changed(struct kvm_vcpu *vcpu) - /* This is a good place to trace that we are exiting SMM. */ - trace_kvm_enter_smm(vcpu->vcpu_id, vcpu->arch.smbase, false); - -- if (unlikely(vcpu->arch.smi_pending)) { -- kvm_make_request(KVM_REQ_SMI, vcpu); -- vcpu->arch.smi_pending = 0; -- } else { -- /* Process a latched INIT, if any. */ -- kvm_make_request(KVM_REQ_EVENT, vcpu); -- } -+ /* Process a latched INIT or SMI, if any. */ -+ kvm_make_request(KVM_REQ_EVENT, vcpu); - } - - kvm_mmu_reset_context(vcpu); -@@ -6102,7 +6098,10 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win) - } - - /* try to inject new event if pending */ -- if (vcpu->arch.nmi_pending && kvm_x86_ops->nmi_allowed(vcpu)) { -+ if (vcpu->arch.smi_pending && !is_smm(vcpu)) { -+ vcpu->arch.smi_pending = false; -+ process_smi(vcpu); -+ } else if (vcpu->arch.nmi_pending && kvm_x86_ops->nmi_allowed(vcpu)) { - --vcpu->arch.nmi_pending; - vcpu->arch.nmi_injected = true; - kvm_x86_ops->set_nmi(vcpu); -@@ -6312,11 +6311,6 @@ static void process_smi(struct kvm_vcpu *vcpu) - char buf[512]; - u32 cr0; - -- if (is_smm(vcpu)) { -- vcpu->arch.smi_pending = true; -- return; -- } -- - trace_kvm_enter_smm(vcpu->vcpu_id, vcpu->arch.smbase, true); - vcpu->arch.hflags |= HF_SMM_MASK; - memset(buf, 0, 512); -@@ -6379,6 +6373,12 @@ static void process_smi(struct kvm_vcpu *vcpu) - kvm_mmu_reset_context(vcpu); - } - -+static void process_smi_request(struct kvm_vcpu *vcpu) -+{ -+ vcpu->arch.smi_pending = true; -+ kvm_make_request(KVM_REQ_EVENT, vcpu); -+} -+ - void kvm_make_scan_ioapic_request(struct kvm *kvm) - { - kvm_make_all_cpus_request(kvm, KVM_REQ_SCAN_IOAPIC); -@@ -6500,7 +6500,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - if (kvm_check_request(KVM_REQ_STEAL_UPDATE, vcpu)) - record_steal_time(vcpu); - if (kvm_check_request(KVM_REQ_SMI, vcpu)) -- process_smi(vcpu); -+ process_smi_request(vcpu); - if (kvm_check_request(KVM_REQ_NMI, vcpu)) - process_nmi(vcpu); - if (kvm_check_request(KVM_REQ_PMU, vcpu)) -@@ -6573,8 +6573,18 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - - if (inject_pending_event(vcpu, req_int_win) != 0) - req_immediate_exit = true; -- /* enable NMI/IRQ window open exits if needed */ - else { -+ /* Enable NMI/IRQ window open exits if needed. -+ * -+ * SMIs have two cases: 1) they can be nested, and -+ * then there is nothing to do here because RSM will -+ * cause a vmexit anyway; 2) or the SMI can be pending -+ * because inject_pending_event has completed the -+ * injection of an IRQ or NMI from the previous vmexit, -+ * and then we request an immediate exit to inject the SMI. -+ */ -+ if (vcpu->arch.smi_pending && !is_smm(vcpu)) -+ req_immediate_exit = true; - if (vcpu->arch.nmi_pending) - kvm_x86_ops->enable_nmi_window(vcpu); - if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win) -@@ -6625,8 +6635,10 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - - kvm_load_guest_xcr0(vcpu); - -- if (req_immediate_exit) -+ if (req_immediate_exit) { -+ kvm_make_request(KVM_REQ_EVENT, vcpu); - smp_send_reschedule(vcpu->cpu); -+ } - - trace_kvm_entry(vcpu->vcpu_id); - wait_lapic_expire(vcpu); -@@ -7427,6 +7439,7 @@ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event) - { - vcpu->arch.hflags = 0; - -+ vcpu->arch.smi_pending = 0; - atomic_set(&vcpu->arch.nmi_queued, 0); - vcpu->arch.nmi_pending = 0; - vcpu->arch.nmi_injected = false; -diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c -index 8b93e63..ae97f24 100644 ---- a/arch/x86/pci/intel_mid_pci.c -+++ b/arch/x86/pci/intel_mid_pci.c -@@ -37,6 +37,7 @@ - - /* Quirks for the listed devices */ - #define PCI_DEVICE_ID_INTEL_MRFL_MMC 0x1190 -+#define PCI_DEVICE_ID_INTEL_MRFL_HSU 0x1191 - - /* Fixed BAR fields */ - #define PCIE_VNDR_CAP_ID_FIXED_BAR 0x00 /* Fixed BAR (TBD) */ -@@ -225,13 +226,20 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev) - /* Special treatment for IRQ0 */ - if (dev->irq == 0) { - /* -+ * Skip HS UART common registers device since it has -+ * IRQ0 assigned and not used by the kernel. -+ */ -+ if (dev->device == PCI_DEVICE_ID_INTEL_MRFL_HSU) -+ return -EBUSY; -+ /* - * TNG has IRQ0 assigned to eMMC controller. But there - * are also other devices with bogus PCI configuration - * that have IRQ0 assigned. This check ensures that -- * eMMC gets it. -+ * eMMC gets it. The rest of devices still could be -+ * enabled without interrupt line being allocated. - */ - if (dev->device != PCI_DEVICE_ID_INTEL_MRFL_MMC) -- return -EBUSY; -+ return 0; - } - break; - default: -diff --git a/block/bio.c b/block/bio.c -index 0e4aa42..4623869 100644 ---- a/block/bio.c -+++ b/block/bio.c -@@ -579,6 +579,8 @@ void __bio_clone_fast(struct bio *bio, struct bio *bio_src) - bio->bi_rw = bio_src->bi_rw; - bio->bi_iter = bio_src->bi_iter; - bio->bi_io_vec = bio_src->bi_io_vec; -+ -+ bio_clone_blkcg_association(bio, bio_src); - } - EXPORT_SYMBOL(__bio_clone_fast); - -@@ -684,6 +686,8 @@ integrity_clone: - } - } - -+ bio_clone_blkcg_association(bio, bio_src); -+ - return bio; - } - EXPORT_SYMBOL(bio_clone_bioset); -@@ -2005,6 +2009,17 @@ void bio_disassociate_task(struct bio *bio) - } - } - -+/** -+ * bio_clone_blkcg_association - clone blkcg association from src to dst bio -+ * @dst: destination bio -+ * @src: source bio -+ */ -+void bio_clone_blkcg_association(struct bio *dst, struct bio *src) -+{ -+ if (src->bi_css) -+ WARN_ON(bio_associate_blkcg(dst, src->bi_css)); -+} -+ - #endif /* CONFIG_BLK_CGROUP */ - - static void __init biovec_init_slabs(void) -diff --git a/block/genhd.c b/block/genhd.c -index 3eebd25..086f1a3 100644 ---- a/block/genhd.c -+++ b/block/genhd.c -@@ -613,7 +613,7 @@ void add_disk(struct gendisk *disk) - - /* Register BDI before referencing it from bdev */ - bdi = &disk->queue->backing_dev_info; -- bdi_register_dev(bdi, disk_devt(disk)); -+ bdi_register_owner(bdi, disk_to_dev(disk)); - - blk_register_region(disk_devt(disk), disk->minors, NULL, - exact_match, exact_lock, disk); -diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c -index 290d6f5..f4218df 100644 ---- a/drivers/acpi/ec.c -+++ b/drivers/acpi/ec.c -@@ -101,6 +101,7 @@ enum ec_command { - #define ACPI_EC_UDELAY_POLL 550 /* Wait 1ms for EC transaction polling */ - #define ACPI_EC_CLEAR_MAX 100 /* Maximum number of events to query - * when trying to clear the EC */ -+#define ACPI_EC_MAX_QUERIES 16 /* Maximum number of parallel queries */ - - enum { - EC_FLAGS_QUERY_PENDING, /* Query is pending */ -@@ -121,6 +122,10 @@ static unsigned int ec_delay __read_mostly = ACPI_EC_DELAY; - module_param(ec_delay, uint, 0644); - MODULE_PARM_DESC(ec_delay, "Timeout(ms) waited until an EC command completes"); - -+static unsigned int ec_max_queries __read_mostly = ACPI_EC_MAX_QUERIES; -+module_param(ec_max_queries, uint, 0644); -+MODULE_PARM_DESC(ec_max_queries, "Maximum parallel _Qxx evaluations"); -+ - static bool ec_busy_polling __read_mostly; - module_param(ec_busy_polling, bool, 0644); - MODULE_PARM_DESC(ec_busy_polling, "Use busy polling to advance EC transaction"); -@@ -174,6 +179,7 @@ static void acpi_ec_event_processor(struct work_struct *work); - - struct acpi_ec *boot_ec, *first_ec; - EXPORT_SYMBOL(first_ec); -+static struct workqueue_struct *ec_query_wq; - - static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */ - static int EC_FLAGS_QUERY_HANDSHAKE; /* Needs QR_EC issued when SCI_EVT set */ -@@ -1098,7 +1104,7 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 *data) - * work queue execution. - */ - ec_dbg_evt("Query(0x%02x) scheduled", value); -- if (!schedule_work(&q->work)) { -+ if (!queue_work(ec_query_wq, &q->work)) { - ec_dbg_evt("Query(0x%02x) overlapped", value); - result = -EBUSY; - } -@@ -1660,15 +1666,41 @@ static struct acpi_driver acpi_ec_driver = { - }, - }; - -+static inline int acpi_ec_query_init(void) -+{ -+ if (!ec_query_wq) { -+ ec_query_wq = alloc_workqueue("kec_query", 0, -+ ec_max_queries); -+ if (!ec_query_wq) -+ return -ENODEV; -+ } -+ return 0; -+} -+ -+static inline void acpi_ec_query_exit(void) -+{ -+ if (ec_query_wq) { -+ destroy_workqueue(ec_query_wq); -+ ec_query_wq = NULL; -+ } -+} -+ - int __init acpi_ec_init(void) - { -- int result = 0; -+ int result; - -+ /* register workqueue for _Qxx evaluations */ -+ result = acpi_ec_query_init(); -+ if (result) -+ goto err_exit; - /* Now register the driver for the EC */ - result = acpi_bus_register_driver(&acpi_ec_driver); -- if (result < 0) -- return -ENODEV; -+ if (result) -+ goto err_exit; - -+err_exit: -+ if (result) -+ acpi_ec_query_exit(); - return result; - } - -@@ -1678,5 +1710,6 @@ static void __exit acpi_ec_exit(void) - { - - acpi_bus_unregister_driver(&acpi_ec_driver); -+ acpi_ec_query_exit(); - } - #endif /* 0 */ -diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c -index cae5385..bd46569 100644 ---- a/drivers/bcma/host_pci.c -+++ b/drivers/bcma/host_pci.c -@@ -295,6 +295,7 @@ static const struct pci_device_id bcma_pci_bridge_tbl[] = { - { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4359) }, - { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4360) }, - { PCI_DEVICE_SUB(PCI_VENDOR_ID_BROADCOM, 0x4365, PCI_VENDOR_ID_DELL, 0x0016) }, -+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_BROADCOM, 0x4365, PCI_VENDOR_ID_FOXCONN, 0xe092) }, - { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a0) }, - { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) }, - { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) }, -diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c -index 84708a5..a1dcf12 100644 ---- a/drivers/block/floppy.c -+++ b/drivers/block/floppy.c -@@ -3663,11 +3663,6 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) - - opened_bdev[drive] = bdev; - -- if (!(mode & (FMODE_READ|FMODE_WRITE))) { -- res = -EINVAL; -- goto out; -- } -- - res = -ENXIO; - - if (!floppy_track_buffer) { -@@ -3711,13 +3706,15 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) - if (UFDCS->rawcmd == 1) - UFDCS->rawcmd = 2; - -- UDRS->last_checked = 0; -- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); -- check_disk_change(bdev); -- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) -- goto out; -- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) -- goto out; -+ if (mode & (FMODE_READ|FMODE_WRITE)) { -+ UDRS->last_checked = 0; -+ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); -+ check_disk_change(bdev); -+ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) -+ goto out; -+ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) -+ goto out; -+ } - - res = -EROFS; - -diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c -index 2589468..fadba88 100644 ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -123,6 +123,7 @@ static const struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x13d3, 0x3472) }, - { USB_DEVICE(0x13d3, 0x3474) }, - { USB_DEVICE(0x13d3, 0x3487) }, -+ { USB_DEVICE(0x13d3, 0x3490) }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xE02C) }, -@@ -190,6 +191,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { - { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU22 with sflash firmware */ - { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 }, -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index a3be65e..9f40c34 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -237,6 +237,7 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, -diff --git a/drivers/char/random.c b/drivers/char/random.c -index 87ab9f6..d72c6d1 100644 ---- a/drivers/char/random.c -+++ b/drivers/char/random.c -@@ -949,6 +949,7 @@ void add_interrupt_randomness(int irq, int irq_flags) - /* award one bit for the contents of the fast pool */ - credit_entropy_bits(r, credit + 1); - } -+EXPORT_SYMBOL_GPL(add_interrupt_randomness); - - #ifdef CONFIG_BLOCK - void add_disk_randomness(struct gendisk *disk) -@@ -1461,12 +1462,16 @@ random_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos) - static ssize_t - urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos) - { -+ static int maxwarn = 10; - int ret; - -- if (unlikely(nonblocking_pool.initialized == 0)) -- printk_once(KERN_NOTICE "random: %s urandom read " -- "with %d bits of entropy available\n", -- current->comm, nonblocking_pool.entropy_total); -+ if (unlikely(nonblocking_pool.initialized == 0) && -+ maxwarn > 0) { -+ maxwarn--; -+ printk(KERN_NOTICE "random: %s: uninitialized urandom read " -+ "(%zd bytes read, %d bits of entropy available)\n", -+ current->comm, nbytes, nonblocking_pool.entropy_total); -+ } - - nbytes = min_t(size_t, nbytes, INT_MAX >> (ENTROPY_SHIFT + 3)); - ret = extract_entropy_user(&nonblocking_pool, buf, nbytes); -@@ -1774,13 +1779,15 @@ int random_int_secret_init(void) - return 0; - } - -+static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash) -+ __aligned(sizeof(unsigned long)); -+ - /* - * Get a random word for internal kernel use only. Similar to urandom but - * with the goal of minimal entropy pool depletion. As a result, the random - * value is not cryptographically secure but for several uses the cost of - * depleting entropy is too high - */ --static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash); - unsigned int get_random_int(void) - { - __u32 *hash; -@@ -1850,12 +1857,18 @@ void add_hwgenerator_randomness(const char *buffer, size_t count, - { - struct entropy_store *poolp = &input_pool; - -- /* Suspend writing if we're above the trickle threshold. -- * We'll be woken up again once below random_write_wakeup_thresh, -- * or when the calling thread is about to terminate. -- */ -- wait_event_interruptible(random_write_wait, kthread_should_stop() || -+ if (unlikely(nonblocking_pool.initialized == 0)) -+ poolp = &nonblocking_pool; -+ else { -+ /* Suspend writing if we're above the trickle -+ * threshold. We'll be woken up again once below -+ * random_write_wakeup_thresh, or when the calling -+ * thread is about to terminate. -+ */ -+ wait_event_interruptible(random_write_wait, -+ kthread_should_stop() || - ENTROPY_BITS(&input_pool) <= random_write_wakeup_bits); -+ } - mix_pool_bytes(poolp, buffer, count); - credit_entropy_bits(poolp, entropy); - } -diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c -index a12b319..e9fd1d8 100644 ---- a/drivers/char/tpm/tpm_crb.c -+++ b/drivers/char/tpm/tpm_crb.c -@@ -246,7 +246,7 @@ static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv, - - /* Detect a 64 bit address on a 32 bit system */ - if (start != new_res.start) -- return ERR_PTR(-EINVAL); -+ return (void __iomem *) ERR_PTR(-EINVAL); - - if (!resource_contains(&priv->res, &new_res)) - return devm_ioremap_resource(dev, &new_res); -diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c -index 8059a8d..31b77f7 100644 ---- a/drivers/clk/rockchip/clk-rk3399.c -+++ b/drivers/clk/rockchip/clk-rk3399.c -@@ -586,7 +586,7 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = { - RK3399_CLKGATE_CON(8), 15, GFLAGS), - - COMPOSITE(SCLK_SPDIF_REC_DPTX, "clk_spdif_rec_dptx", mux_pll_src_cpll_gpll_p, 0, -- RK3399_CLKSEL_CON(32), 15, 1, MFLAGS, 0, 5, DFLAGS, -+ RK3399_CLKSEL_CON(32), 15, 1, MFLAGS, 8, 5, DFLAGS, - RK3399_CLKGATE_CON(10), 6, GFLAGS), - /* i2s */ - COMPOSITE(0, "clk_i2s0_div", mux_pll_src_cpll_gpll_p, 0, -diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index 1fa1a32..1b15917 100644 ---- a/drivers/cpufreq/intel_pstate.c -+++ b/drivers/cpufreq/intel_pstate.c -@@ -944,7 +944,7 @@ static int core_get_max_pstate(void) - if (err) - goto skip_tar; - -- tdp_msr = MSR_CONFIG_TDP_NOMINAL + tdp_ctrl; -+ tdp_msr = MSR_CONFIG_TDP_NOMINAL + (tdp_ctrl & 0x3); - err = rdmsrl_safe(tdp_msr, &tdp_ratio); - if (err) - goto skip_tar; -diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c -index 10c305b..4e0f8e7 100644 ---- a/drivers/edac/edac_mc_sysfs.c -+++ b/drivers/edac/edac_mc_sysfs.c -@@ -313,7 +313,6 @@ static struct device_type csrow_attr_type = { - * possible dynamic channel DIMM Label attribute files - * - */ -- - DEVICE_CHANNEL(ch0_dimm_label, S_IRUGO | S_IWUSR, - channel_dimm_label_show, channel_dimm_label_store, 0); - DEVICE_CHANNEL(ch1_dimm_label, S_IRUGO | S_IWUSR, -@@ -326,6 +325,10 @@ DEVICE_CHANNEL(ch4_dimm_label, S_IRUGO | S_IWUSR, - channel_dimm_label_show, channel_dimm_label_store, 4); - DEVICE_CHANNEL(ch5_dimm_label, S_IRUGO | S_IWUSR, - channel_dimm_label_show, channel_dimm_label_store, 5); -+DEVICE_CHANNEL(ch6_dimm_label, S_IRUGO | S_IWUSR, -+ channel_dimm_label_show, channel_dimm_label_store, 6); -+DEVICE_CHANNEL(ch7_dimm_label, S_IRUGO | S_IWUSR, -+ channel_dimm_label_show, channel_dimm_label_store, 7); - - /* Total possible dynamic DIMM Label attribute file table */ - static struct attribute *dynamic_csrow_dimm_attr[] = { -@@ -335,6 +338,8 @@ static struct attribute *dynamic_csrow_dimm_attr[] = { - &dev_attr_legacy_ch3_dimm_label.attr.attr, - &dev_attr_legacy_ch4_dimm_label.attr.attr, - &dev_attr_legacy_ch5_dimm_label.attr.attr, -+ &dev_attr_legacy_ch6_dimm_label.attr.attr, -+ &dev_attr_legacy_ch7_dimm_label.attr.attr, - NULL - }; - -@@ -351,6 +356,10 @@ DEVICE_CHANNEL(ch4_ce_count, S_IRUGO, - channel_ce_count_show, NULL, 4); - DEVICE_CHANNEL(ch5_ce_count, S_IRUGO, - channel_ce_count_show, NULL, 5); -+DEVICE_CHANNEL(ch6_ce_count, S_IRUGO, -+ channel_ce_count_show, NULL, 6); -+DEVICE_CHANNEL(ch7_ce_count, S_IRUGO, -+ channel_ce_count_show, NULL, 7); - - /* Total possible dynamic ce_count attribute file table */ - static struct attribute *dynamic_csrow_ce_count_attr[] = { -@@ -360,6 +369,8 @@ static struct attribute *dynamic_csrow_ce_count_attr[] = { - &dev_attr_legacy_ch3_ce_count.attr.attr, - &dev_attr_legacy_ch4_ce_count.attr.attr, - &dev_attr_legacy_ch5_ce_count.attr.attr, -+ &dev_attr_legacy_ch6_ce_count.attr.attr, -+ &dev_attr_legacy_ch7_ce_count.attr.attr, - NULL - }; - -@@ -371,9 +382,16 @@ static umode_t csrow_dev_is_visible(struct kobject *kobj, - - if (idx >= csrow->nr_channels) - return 0; -+ -+ if (idx >= ARRAY_SIZE(dynamic_csrow_ce_count_attr) - 1) { -+ WARN_ONCE(1, "idx: %d\n", idx); -+ return 0; -+ } -+ - /* Only expose populated DIMMs */ - if (!csrow->channels[idx]->dimm->nr_pages) - return 0; -+ - return attr->mode; - } - -diff --git a/drivers/gpio/gpio-intel-mid.c b/drivers/gpio/gpio-intel-mid.c -index cdaba13..c0f7cce 100644 ---- a/drivers/gpio/gpio-intel-mid.c -+++ b/drivers/gpio/gpio-intel-mid.c -@@ -17,7 +17,6 @@ - * Moorestown platform Langwell chip. - * Medfield platform Penwell chip. - * Clovertrail platform Cloverview chip. -- * Merrifield platform Tangier chip. - */ - - #include <linux/module.h> -@@ -64,10 +63,6 @@ enum GPIO_REG { - /* intel_mid gpio driver data */ - struct intel_mid_gpio_ddata { - u16 ngpio; /* number of gpio pins */ -- u32 gplr_offset; /* offset of first GPLR register from base */ -- u32 flis_base; /* base address of FLIS registers */ -- u32 flis_len; /* length of FLIS registers */ -- u32 (*get_flis_offset)(int gpio); - u32 chip_irq_type; /* chip interrupt type */ - }; - -@@ -252,15 +247,6 @@ static const struct intel_mid_gpio_ddata gpio_cloverview_core = { - .chip_irq_type = INTEL_MID_IRQ_TYPE_EDGE, - }; - --static const struct intel_mid_gpio_ddata gpio_tangier = { -- .ngpio = 192, -- .gplr_offset = 4, -- .flis_base = 0xff0c0000, -- .flis_len = 0x8000, -- .get_flis_offset = NULL, -- .chip_irq_type = INTEL_MID_IRQ_TYPE_EDGE, --}; -- - static const struct pci_device_id intel_gpio_ids[] = { - { - /* Lincroft */ -@@ -287,11 +273,6 @@ static const struct pci_device_id intel_gpio_ids[] = { - PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x08f7), - .driver_data = (kernel_ulong_t)&gpio_cloverview_core, - }, -- { -- /* Tangier */ -- PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x1199), -- .driver_data = (kernel_ulong_t)&gpio_tangier, -- }, - { 0 } - }; - MODULE_DEVICE_TABLE(pci, intel_gpio_ids); -@@ -401,7 +382,7 @@ static int intel_gpio_probe(struct pci_dev *pdev, - spin_lock_init(&priv->lock); - - pci_set_drvdata(pdev, priv); -- retval = gpiochip_add_data(&priv->chip, priv); -+ retval = devm_gpiochip_add_data(&pdev->dev, &priv->chip, priv); - if (retval) { - dev_err(&pdev->dev, "gpiochip_add error %d\n", retval); - return retval; -diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c -index 5e3be32..3745de6 100644 ---- a/drivers/gpio/gpio-pca953x.c -+++ b/drivers/gpio/gpio-pca953x.c -@@ -90,7 +90,7 @@ MODULE_DEVICE_TABLE(acpi, pca953x_acpi_ids); - #define MAX_BANK 5 - #define BANK_SZ 8 - --#define NBANK(chip) (chip->gpio_chip.ngpio / BANK_SZ) -+#define NBANK(chip) DIV_ROUND_UP(chip->gpio_chip.ngpio, BANK_SZ) - - struct pca953x_chip { - unsigned gpio_start; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -index 9df1bcb..9831753 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -@@ -551,28 +551,19 @@ int amdgpu_atombios_get_clock_info(struct amdgpu_device *adev) - le16_to_cpu(firmware_info->info.usReferenceClock); - ppll->reference_div = 0; - -- if (crev < 2) -- ppll->pll_out_min = -- le16_to_cpu(firmware_info->info.usMinPixelClockPLL_Output); -- else -- ppll->pll_out_min = -- le32_to_cpu(firmware_info->info_12.ulMinPixelClockPLL_Output); -+ ppll->pll_out_min = -+ le32_to_cpu(firmware_info->info_12.ulMinPixelClockPLL_Output); - ppll->pll_out_max = - le32_to_cpu(firmware_info->info.ulMaxPixelClockPLL_Output); - -- if (crev >= 4) { -- ppll->lcd_pll_out_min = -- le16_to_cpu(firmware_info->info_14.usLcdMinPixelClockPLL_Output) * 100; -- if (ppll->lcd_pll_out_min == 0) -- ppll->lcd_pll_out_min = ppll->pll_out_min; -- ppll->lcd_pll_out_max = -- le16_to_cpu(firmware_info->info_14.usLcdMaxPixelClockPLL_Output) * 100; -- if (ppll->lcd_pll_out_max == 0) -- ppll->lcd_pll_out_max = ppll->pll_out_max; -- } else { -+ ppll->lcd_pll_out_min = -+ le16_to_cpu(firmware_info->info_14.usLcdMinPixelClockPLL_Output) * 100; -+ if (ppll->lcd_pll_out_min == 0) - ppll->lcd_pll_out_min = ppll->pll_out_min; -+ ppll->lcd_pll_out_max = -+ le16_to_cpu(firmware_info->info_14.usLcdMaxPixelClockPLL_Output) * 100; -+ if (ppll->lcd_pll_out_max == 0) - ppll->lcd_pll_out_max = ppll->pll_out_max; -- } - - if (ppll->pll_out_min == 0) - ppll->pll_out_min = 64800; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c -index 35a1248..1b4c069 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c -@@ -10,6 +10,7 @@ - #include <linux/slab.h> - #include <linux/acpi.h> - #include <linux/pci.h> -+#include <linux/delay.h> - - #include "amd_acpi.h" - -@@ -259,6 +260,10 @@ static int amdgpu_atpx_set_discrete_state(struct amdgpu_atpx *atpx, u8 state) - if (!info) - return -EIO; - kfree(info); -+ -+ /* 200ms delay is required after off */ -+ if (state == 0) -+ msleep(200); - } - return 0; - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -index cb07da4..ff0b55a 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -@@ -1690,7 +1690,6 @@ amdgpu_connector_add(struct amdgpu_device *adev, - DRM_MODE_SCALE_NONE); - /* no HPD on analog connectors */ - amdgpu_connector->hpd.hpd = AMDGPU_HPD_NONE; -- connector->polled = DRM_CONNECTOR_POLL_CONNECT; - connector->interlace_allowed = true; - connector->doublescan_allowed = true; - break; -@@ -1893,8 +1892,10 @@ amdgpu_connector_add(struct amdgpu_device *adev, - } - - if (amdgpu_connector->hpd.hpd == AMDGPU_HPD_NONE) { -- if (i2c_bus->valid) -- connector->polled = DRM_CONNECTOR_POLL_CONNECT; -+ if (i2c_bus->valid) { -+ connector->polled = DRM_CONNECTOR_POLL_CONNECT | -+ DRM_CONNECTOR_POLL_DISCONNECT; -+ } - } else - connector->polled = DRM_CONNECTOR_POLL_HPD; - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index 6e92008..b7f5650 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -1841,7 +1841,23 @@ int amdgpu_resume_kms(struct drm_device *dev, bool resume, bool fbcon) - } - - drm_kms_helper_poll_enable(dev); -+ -+ /* -+ * Most of the connector probing functions try to acquire runtime pm -+ * refs to ensure that the GPU is powered on when connector polling is -+ * performed. Since we're calling this from a runtime PM callback, -+ * trying to acquire rpm refs will cause us to deadlock. -+ * -+ * Since we're guaranteed to be holding the rpm lock, it's safe to -+ * temporarily disable the rpm helpers so this doesn't deadlock us. -+ */ -+#ifdef CONFIG_PM -+ dev->dev->power.disable_depth++; -+#endif - drm_helper_hpd_irq_event(dev); -+#ifdef CONFIG_PM -+ dev->dev->power.disable_depth--; -+#endif - - if (fbcon) { - amdgpu_fbdev_set_suspend(adev, 0); -diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c -index 48b6bd6..c32eca2 100644 ---- a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c -+++ b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c -@@ -98,6 +98,7 @@ amdgpu_atombios_encoder_set_backlight_level(struct amdgpu_encoder *amdgpu_encode - case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA: - case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1: - case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2: -+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY3: - if (dig->backlight_level == 0) - amdgpu_atombios_encoder_setup_dig_transmitter(encoder, - ATOM_TRANSMITTER_ACTION_LCD_BLOFF, 0, 0); -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -index 1feb643..9269548 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -@@ -167,6 +167,7 @@ static int gmc_v7_0_init_microcode(struct amdgpu_device *adev) - break; - case CHIP_KAVERI: - case CHIP_KABINI: -+ case CHIP_MULLINS: - return 0; - default: BUG(); - } -diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c -index 90b35c5..ffc7c0d 100644 ---- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c -+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c -@@ -592,12 +592,12 @@ bool atomctrl_get_pp_assign_pin( - const uint32_t pinId, - pp_atomctrl_gpio_pin_assignment *gpio_pin_assignment) - { -- bool bRet = 0; -+ bool bRet = false; - ATOM_GPIO_PIN_LUT *gpio_lookup_table = - get_gpio_lookup_table(hwmgr->device); - - PP_ASSERT_WITH_CODE((NULL != gpio_lookup_table), -- "Could not find GPIO lookup Table in BIOS.", return -1); -+ "Could not find GPIO lookup Table in BIOS.", return false); - - bRet = atomctrl_lookup_gpio_pin(gpio_lookup_table, pinId, - gpio_pin_assignment); -diff --git a/drivers/gpu/drm/drm_cache.c b/drivers/gpu/drm/drm_cache.c -index 059f7c3..a7916e5 100644 ---- a/drivers/gpu/drm/drm_cache.c -+++ b/drivers/gpu/drm/drm_cache.c -@@ -136,6 +136,7 @@ drm_clflush_virt_range(void *addr, unsigned long length) - mb(); - for (; addr < end; addr += size) - clflushopt(addr); -+ clflushopt(end - 1); /* force serialisation */ - mb(); - return; - } -diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c -index eeaf5a7..67b28f8 100644 ---- a/drivers/gpu/drm/drm_dp_helper.c -+++ b/drivers/gpu/drm/drm_dp_helper.c -@@ -203,7 +203,7 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, - - ret = aux->transfer(aux, &msg); - -- if (ret > 0) { -+ if (ret >= 0) { - native_reply = msg.reply & DP_AUX_NATIVE_REPLY_MASK; - if (native_reply == DP_AUX_NATIVE_REPLY_ACK) { - if (ret == size) -diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c -index 7df26d4..2cb472b 100644 ---- a/drivers/gpu/drm/drm_edid.c -+++ b/drivers/gpu/drm/drm_edid.c -@@ -74,6 +74,8 @@ - #define EDID_QUIRK_FORCE_8BPC (1 << 8) - /* Force 12bpc */ - #define EDID_QUIRK_FORCE_12BPC (1 << 9) -+/* Force 6bpc */ -+#define EDID_QUIRK_FORCE_6BPC (1 << 10) - - struct detailed_mode_closure { - struct drm_connector *connector; -@@ -100,6 +102,9 @@ static struct edid_quirk { - /* Unknown Acer */ - { "ACR", 2423, EDID_QUIRK_FIRST_DETAILED_PREFERRED }, - -+ /* AEO model 0 reports 8 bpc, but is a 6 bpc panel */ -+ { "AEO", 0, EDID_QUIRK_FORCE_6BPC }, -+ - /* Belinea 10 15 55 */ - { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 }, - { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 }, -@@ -4082,6 +4087,9 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid) - - drm_add_display_info(edid, &connector->display_info, connector); - -+ if (quirks & EDID_QUIRK_FORCE_6BPC) -+ connector->display_info.bpc = 6; -+ - if (quirks & EDID_QUIRK_FORCE_8BPC) - connector->display_info.bpc = 8; - -diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h -index bc3f2e6..227a63e 100644 ---- a/drivers/gpu/drm/i915/i915_drv.h -+++ b/drivers/gpu/drm/i915/i915_drv.h -@@ -2591,6 +2591,8 @@ struct drm_i915_cmd_table { - #define SKL_REVID_D0 0x3 - #define SKL_REVID_E0 0x4 - #define SKL_REVID_F0 0x5 -+#define SKL_REVID_G0 0x6 -+#define SKL_REVID_H0 0x7 - - #define IS_SKL_REVID(p, since, until) (IS_SKYLAKE(p) && IS_REVID(p, since, until)) - -diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h -index 3fcf7dd..bc3b6dd 100644 ---- a/drivers/gpu/drm/i915/i915_reg.h -+++ b/drivers/gpu/drm/i915/i915_reg.h -@@ -1672,6 +1672,9 @@ enum skl_disp_power_wells { - - #define GEN7_TLB_RD_ADDR _MMIO(0x4700) - -+#define GEN9_GAMT_ECO_REG_RW_IA _MMIO(0x4ab0) -+#define GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS (1<<18) -+ - #define GAMT_CHKN_BIT_REG _MMIO(0x4ab8) - #define GAMT_CHKN_DISABLE_DYNAMIC_CREDIT_SHARING (1<<28) - -@@ -7538,6 +7541,8 @@ enum skl_disp_power_wells { - - #define CDCLK_FREQ _MMIO(0x46200) - -+#define CDCLK_FREQ _MMIO(0x46200) -+ - #define _TRANSA_MSA_MISC 0x60410 - #define _TRANSB_MSA_MISC 0x61410 - #define _TRANSC_MSA_MISC 0x62410 -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 3074c56..3289319 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -9700,6 +9700,8 @@ static void broadwell_set_cdclk(struct drm_device *dev, int cdclk) - - I915_WRITE(CDCLK_FREQ, DIV_ROUND_CLOSEST(cdclk, 1000) - 1); - -+ I915_WRITE(CDCLK_FREQ, DIV_ROUND_CLOSEST(cdclk, 1000) - 1); -+ - intel_update_cdclk(dev); - - WARN(cdclk != dev_priv->cdclk_freq, -@@ -12095,21 +12097,11 @@ connected_sink_compute_bpp(struct intel_connector *connector, - pipe_config->pipe_bpp = connector->base.display_info.bpc*3; - } - -- /* Clamp bpp to default limit on screens without EDID 1.4 */ -- if (connector->base.display_info.bpc == 0) { -- int type = connector->base.connector_type; -- int clamp_bpp = 24; -- -- /* Fall back to 18 bpp when DP sink capability is unknown. */ -- if (type == DRM_MODE_CONNECTOR_DisplayPort || -- type == DRM_MODE_CONNECTOR_eDP) -- clamp_bpp = 18; -- -- if (bpp > clamp_bpp) { -- DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of %d\n", -- bpp, clamp_bpp); -- pipe_config->pipe_bpp = clamp_bpp; -- } -+ /* Clamp bpp to 8 on screens without EDID 1.4 */ -+ if (connector->base.display_info.bpc == 0 && bpp > 24) { -+ DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of 24\n", -+ bpp); -+ pipe_config->pipe_bpp = 24; - } - } - -diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c -index 2863b92..c1ca5a7 100644 ---- a/drivers/gpu/drm/i915/intel_pm.c -+++ b/drivers/gpu/drm/i915/intel_pm.c -@@ -4563,7 +4563,8 @@ void gen6_rps_idle(struct drm_i915_private *dev_priv) - else - gen6_set_rps(dev_priv->dev, dev_priv->rps.idle_freq); - dev_priv->rps.last_adj = 0; -- I915_WRITE(GEN6_PMINTRMSK, 0xffffffff); -+ I915_WRITE(GEN6_PMINTRMSK, -+ gen6_sanitize_rps_pm_mask(dev_priv, ~0)); - } - mutex_unlock(&dev_priv->rps.hw_lock); - -diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c -index 68c5af0..9d778f3 100644 ---- a/drivers/gpu/drm/i915/intel_ringbuffer.c -+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c -@@ -1135,6 +1135,11 @@ static int skl_init_workarounds(struct intel_engine_cs *engine) - /* WaDisableGafsUnitClkGating:skl */ - WA_SET_BIT(GEN7_UCGCTL4, GEN8_EU_GAUNIT_CLOCK_GATE_DISABLE); - -+ /* WaInPlaceDecompressionHang:skl */ -+ if (IS_SKL_REVID(dev_priv, SKL_REVID_H0, REVID_FOREVER)) -+ WA_SET_BIT(GEN9_GAMT_ECO_REG_RW_IA, -+ GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS); -+ - /* WaDisableLSQCROPERFforOCL:skl */ - ret = wa_ring_whitelist_reg(engine, GEN8_L3SQCREG4); - if (ret) -@@ -1194,6 +1199,11 @@ static int bxt_init_workarounds(struct intel_engine_cs *engine) - WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2, - GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION); - -+ /* WaInPlaceDecompressionHang:bxt */ -+ if (IS_BXT_REVID(dev_priv, BXT_REVID_C0, REVID_FOREVER)) -+ WA_SET_BIT(GEN9_GAMT_ECO_REG_RW_IA, -+ GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS); -+ - return 0; - } - -@@ -1241,6 +1251,10 @@ static int kbl_init_workarounds(struct intel_engine_cs *engine) - GEN7_HALF_SLICE_CHICKEN1, - GEN7_SBE_SS_CACHE_DISPATCH_PORT_SHARING_DISABLE); - -+ /* WaInPlaceDecompressionHang:kbl */ -+ WA_SET_BIT(GEN9_GAMT_ECO_REG_RW_IA, -+ GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS); -+ - /* WaDisableLSQCROPERFforOCL:kbl */ - ret = wa_ring_whitelist_reg(engine, GEN8_L3SQCREG4); - if (ret) -diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c -index 11f8dd9..d6c134b 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_drm.c -+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c -@@ -324,7 +324,16 @@ static int nouveau_drm_probe(struct pci_dev *pdev, - !vga_switcheroo_handler_flags()) - return -EPROBE_DEFER; - -- /* remove conflicting drivers (vesafb, efifb etc) */ -+ /* We need to check that the chipset is supported before booting -+ * fbdev off the hardware, as there's no way to put it back. -+ */ -+ ret = nvkm_device_pci_new(pdev, NULL, "error", true, false, 0, &device); -+ if (ret) -+ return ret; -+ -+ nvkm_device_del(&device); -+ -+ /* Remove conflicting drivers (vesafb, efifb etc). */ - aper = alloc_apertures(3); - if (!aper) - return -ENOMEM; -diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c -index 7d9248b..da8fd5f 100644 ---- a/drivers/gpu/drm/nouveau/nv04_fbcon.c -+++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c -@@ -107,11 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) - ((image->dx + image->width) & 0xffff)); - OUT_RING(chan, bg); - OUT_RING(chan, fg); -- OUT_RING(chan, (image->height << 16) | image->width); -+ OUT_RING(chan, (image->height << 16) | ALIGN(image->width, 8)); - OUT_RING(chan, (image->height << 16) | image->width); - OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff)); - -- dsize = ALIGN(image->width * image->height, 32) >> 5; -+ dsize = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5; - while (dsize) { - int iter_len = dsize > 128 ? 128 : dsize; - -diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c -index 1aeb698..af3d3c4 100644 ---- a/drivers/gpu/drm/nouveau/nv50_fbcon.c -+++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c -@@ -125,7 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) - OUT_RING(chan, 0); - OUT_RING(chan, image->dy); - -- dwords = ALIGN(image->width * image->height, 32) >> 5; -+ dwords = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5; - while (dwords) { - int push = dwords > 2047 ? 2047 : dwords; - -diff --git a/drivers/gpu/drm/nouveau/nvc0_fbcon.c b/drivers/gpu/drm/nouveau/nvc0_fbcon.c -index 839f4c8..054b6a0 100644 ---- a/drivers/gpu/drm/nouveau/nvc0_fbcon.c -+++ b/drivers/gpu/drm/nouveau/nvc0_fbcon.c -@@ -125,7 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) - OUT_RING (chan, 0); - OUT_RING (chan, image->dy); - -- dwords = ALIGN(image->width * image->height, 32) >> 5; -+ dwords = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5; - while (dwords) { - int push = dwords > 2047 ? 2047 : dwords; - -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c -index 69de8c6..f1e15a4 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c -@@ -76,8 +76,8 @@ nv30_gr_chan_new(struct nvkm_gr *base, struct nvkm_fifo_chan *fifoch, - nvkm_wo32(chan->inst, i, 0x00040004); - for (i = 0x1f18; i <= 0x3088 ; i += 16) { - nvkm_wo32(chan->inst, i + 0, 0x10700ff9); -- nvkm_wo32(chan->inst, i + 1, 0x0436086c); -- nvkm_wo32(chan->inst, i + 2, 0x000c001b); -+ nvkm_wo32(chan->inst, i + 4, 0x0436086c); -+ nvkm_wo32(chan->inst, i + 8, 0x000c001b); - } - for (i = 0x30b8; i < 0x30c8; i += 4) - nvkm_wo32(chan->inst, i, 0x0000ffff); -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c -index 2207dac2..300f5ed 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c -@@ -75,8 +75,8 @@ nv34_gr_chan_new(struct nvkm_gr *base, struct nvkm_fifo_chan *fifoch, - nvkm_wo32(chan->inst, i, 0x00040004); - for (i = 0x15ac; i <= 0x271c ; i += 16) { - nvkm_wo32(chan->inst, i + 0, 0x10700ff9); -- nvkm_wo32(chan->inst, i + 1, 0x0436086c); -- nvkm_wo32(chan->inst, i + 2, 0x000c001b); -+ nvkm_wo32(chan->inst, i + 4, 0x0436086c); -+ nvkm_wo32(chan->inst, i + 8, 0x000c001b); - } - for (i = 0x274c; i < 0x275c; i += 4) - nvkm_wo32(chan->inst, i, 0x0000ffff); -diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c -index 587cae4..56bb758 100644 ---- a/drivers/gpu/drm/radeon/atombios_encoders.c -+++ b/drivers/gpu/drm/radeon/atombios_encoders.c -@@ -120,6 +120,7 @@ atombios_set_backlight_level(struct radeon_encoder *radeon_encoder, u8 level) - case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA: - case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1: - case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2: -+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY3: - if (dig->backlight_level == 0) - atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_LCD_BLOFF, 0, 0); - else { -diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c -index f8097a0..5df3ec7 100644 ---- a/drivers/gpu/drm/radeon/radeon_atombios.c -+++ b/drivers/gpu/drm/radeon/radeon_atombios.c -@@ -1155,7 +1155,7 @@ bool radeon_atom_get_clock_info(struct drm_device *dev) - le16_to_cpu(firmware_info->info.usReferenceClock); - p1pll->reference_div = 0; - -- if (crev < 2) -+ if ((frev < 2) && (crev < 2)) - p1pll->pll_out_min = - le16_to_cpu(firmware_info->info.usMinPixelClockPLL_Output); - else -@@ -1164,7 +1164,7 @@ bool radeon_atom_get_clock_info(struct drm_device *dev) - p1pll->pll_out_max = - le32_to_cpu(firmware_info->info.ulMaxPixelClockPLL_Output); - -- if (crev >= 4) { -+ if (((frev < 2) && (crev >= 4)) || (frev >= 2)) { - p1pll->lcd_pll_out_min = - le16_to_cpu(firmware_info->info_14.usLcdMinPixelClockPLL_Output) * 100; - if (p1pll->lcd_pll_out_min == 0) -diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c -index 95f4fea..1b3f4e5 100644 ---- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c -+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c -@@ -10,6 +10,7 @@ - #include <linux/slab.h> - #include <linux/acpi.h> - #include <linux/pci.h> -+#include <linux/delay.h> - - #include "radeon_acpi.h" - -@@ -258,6 +259,10 @@ static int radeon_atpx_set_discrete_state(struct radeon_atpx *atpx, u8 state) - if (!info) - return -EIO; - kfree(info); -+ -+ /* 200ms delay is required after off */ -+ if (state == 0) -+ msleep(200); - } - return 0; - } -diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c -index 81a63d7..b79f3b0 100644 ---- a/drivers/gpu/drm/radeon/radeon_connectors.c -+++ b/drivers/gpu/drm/radeon/radeon_connectors.c -@@ -2064,7 +2064,6 @@ radeon_add_atom_connector(struct drm_device *dev, - RADEON_OUTPUT_CSC_BYPASS); - /* no HPD on analog connectors */ - radeon_connector->hpd.hpd = RADEON_HPD_NONE; -- connector->polled = DRM_CONNECTOR_POLL_CONNECT; - connector->interlace_allowed = true; - connector->doublescan_allowed = true; - break; -@@ -2314,8 +2313,10 @@ radeon_add_atom_connector(struct drm_device *dev, - } - - if (radeon_connector->hpd.hpd == RADEON_HPD_NONE) { -- if (i2c_bus->valid) -- connector->polled = DRM_CONNECTOR_POLL_CONNECT; -+ if (i2c_bus->valid) { -+ connector->polled = DRM_CONNECTOR_POLL_CONNECT | -+ DRM_CONNECTOR_POLL_DISCONNECT; -+ } - } else - connector->polled = DRM_CONNECTOR_POLL_HPD; - -@@ -2391,7 +2392,6 @@ radeon_add_legacy_connector(struct drm_device *dev, - 1); - /* no HPD on analog connectors */ - radeon_connector->hpd.hpd = RADEON_HPD_NONE; -- connector->polled = DRM_CONNECTOR_POLL_CONNECT; - connector->interlace_allowed = true; - connector->doublescan_allowed = true; - break; -@@ -2476,10 +2476,13 @@ radeon_add_legacy_connector(struct drm_device *dev, - } - - if (radeon_connector->hpd.hpd == RADEON_HPD_NONE) { -- if (i2c_bus->valid) -- connector->polled = DRM_CONNECTOR_POLL_CONNECT; -+ if (i2c_bus->valid) { -+ connector->polled = DRM_CONNECTOR_POLL_CONNECT | -+ DRM_CONNECTOR_POLL_DISCONNECT; -+ } - } else - connector->polled = DRM_CONNECTOR_POLL_HPD; -+ - connector->display_info.subpixel_order = subpixel_order; - drm_connector_register(connector); - } -diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c -index 1c4d5b5..b167323 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c -+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c -@@ -1048,6 +1048,17 @@ static void vop_crtc_destroy(struct drm_crtc *crtc) - drm_crtc_cleanup(crtc); - } - -+static void vop_crtc_reset(struct drm_crtc *crtc) -+{ -+ if (crtc->state) -+ __drm_atomic_helper_crtc_destroy_state(crtc->state); -+ kfree(crtc->state); -+ -+ crtc->state = kzalloc(sizeof(struct rockchip_crtc_state), GFP_KERNEL); -+ if (crtc->state) -+ crtc->state->crtc = crtc; -+} -+ - static struct drm_crtc_state *vop_crtc_duplicate_state(struct drm_crtc *crtc) - { - struct rockchip_crtc_state *rockchip_state; -@@ -1073,7 +1084,7 @@ static const struct drm_crtc_funcs vop_crtc_funcs = { - .set_config = drm_atomic_helper_set_config, - .page_flip = drm_atomic_helper_page_flip, - .destroy = vop_crtc_destroy, -- .reset = drm_atomic_helper_crtc_reset, -+ .reset = vop_crtc_reset, - .atomic_duplicate_state = vop_crtc_duplicate_state, - .atomic_destroy_state = vop_crtc_destroy_state, - }; -diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c -index 16b6f11..99ec3ff 100644 ---- a/drivers/hid/uhid.c -+++ b/drivers/hid/uhid.c -@@ -51,10 +51,26 @@ struct uhid_device { - u32 report_id; - u32 report_type; - struct uhid_event report_buf; -+ struct work_struct worker; - }; - - static struct miscdevice uhid_misc; - -+static void uhid_device_add_worker(struct work_struct *work) -+{ -+ struct uhid_device *uhid = container_of(work, struct uhid_device, worker); -+ int ret; -+ -+ ret = hid_add_device(uhid->hid); -+ if (ret) { -+ hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret); -+ -+ hid_destroy_device(uhid->hid); -+ uhid->hid = NULL; -+ uhid->running = false; -+ } -+} -+ - static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev) - { - __u8 newhead; -@@ -498,18 +514,14 @@ static int uhid_dev_create2(struct uhid_device *uhid, - uhid->hid = hid; - uhid->running = true; - -- ret = hid_add_device(hid); -- if (ret) { -- hid_err(hid, "Cannot register HID device\n"); -- goto err_hid; -- } -+ /* Adding of a HID device is done through a worker, to allow HID drivers -+ * which use feature requests during .probe to work, without they would -+ * be blocked on devlock, which is held by uhid_char_write. -+ */ -+ schedule_work(&uhid->worker); - - return 0; - --err_hid: -- hid_destroy_device(hid); -- uhid->hid = NULL; -- uhid->running = false; - err_free: - kfree(uhid->rd_data); - uhid->rd_data = NULL; -@@ -550,6 +562,8 @@ static int uhid_dev_destroy(struct uhid_device *uhid) - uhid->running = false; - wake_up_interruptible(&uhid->report_wait); - -+ cancel_work_sync(&uhid->worker); -+ - hid_destroy_device(uhid->hid); - kfree(uhid->rd_data); - -@@ -612,6 +626,7 @@ static int uhid_char_open(struct inode *inode, struct file *file) - init_waitqueue_head(&uhid->waitq); - init_waitqueue_head(&uhid->report_wait); - uhid->running = false; -+ INIT_WORK(&uhid->worker, uhid_device_add_worker); - - file->private_data = uhid; - nonseekable_open(inode, file); -diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c -index 952f20f..e82f7e1 100644 ---- a/drivers/hv/vmbus_drv.c -+++ b/drivers/hv/vmbus_drv.c -@@ -42,6 +42,7 @@ - #include <linux/screen_info.h> - #include <linux/kdebug.h> - #include <linux/efi.h> -+#include <linux/random.h> - #include "hyperv_vmbus.h" - - static struct acpi_device *hv_acpi_dev; -@@ -806,6 +807,8 @@ static void vmbus_isr(void) - else - tasklet_schedule(hv_context.msg_dpc[cpu]); - } -+ -+ add_interrupt_randomness(HYPERVISOR_CALLBACK_VECTOR, 0); - } - - -diff --git a/drivers/i2c/busses/i2c-efm32.c b/drivers/i2c/busses/i2c-efm32.c -index 8eff627..e253598 100644 ---- a/drivers/i2c/busses/i2c-efm32.c -+++ b/drivers/i2c/busses/i2c-efm32.c -@@ -433,7 +433,7 @@ static int efm32_i2c_probe(struct platform_device *pdev) - ret = request_irq(ddata->irq, efm32_i2c_irq, 0, DRIVER_NAME, ddata); - if (ret < 0) { - dev_err(&pdev->dev, "failed to request irq (%d)\n", ret); -- return ret; -+ goto err_disable_clk; - } - - ret = i2c_add_adapter(&ddata->adapter); -diff --git a/drivers/infiniband/core/rw.c b/drivers/infiniband/core/rw.c -index 1eb9b12..dbfd854 100644 ---- a/drivers/infiniband/core/rw.c -+++ b/drivers/infiniband/core/rw.c -@@ -58,19 +58,13 @@ static inline bool rdma_rw_io_needs_mr(struct ib_device *dev, u8 port_num, - return false; - } - --static inline u32 rdma_rw_max_sge(struct ib_device *dev, -- enum dma_data_direction dir) --{ -- return dir == DMA_TO_DEVICE ? -- dev->attrs.max_sge : dev->attrs.max_sge_rd; --} -- - static inline u32 rdma_rw_fr_page_list_len(struct ib_device *dev) - { - /* arbitrary limit to avoid allocating gigantic resources */ - return min_t(u32, dev->attrs.max_fast_reg_page_list_len, 256); - } - -+/* Caller must have zero-initialized *reg. */ - static int rdma_rw_init_one_mr(struct ib_qp *qp, u8 port_num, - struct rdma_rw_reg_ctx *reg, struct scatterlist *sg, - u32 sg_cnt, u32 offset) -@@ -114,6 +108,7 @@ static int rdma_rw_init_mr_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp, - u8 port_num, struct scatterlist *sg, u32 sg_cnt, u32 offset, - u64 remote_addr, u32 rkey, enum dma_data_direction dir) - { -+ struct rdma_rw_reg_ctx *prev = NULL; - u32 pages_per_mr = rdma_rw_fr_page_list_len(qp->pd->device); - int i, j, ret = 0, count = 0; - -@@ -125,7 +120,6 @@ static int rdma_rw_init_mr_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp, - } - - for (i = 0; i < ctx->nr_ops; i++) { -- struct rdma_rw_reg_ctx *prev = i ? &ctx->reg[i - 1] : NULL; - struct rdma_rw_reg_ctx *reg = &ctx->reg[i]; - u32 nents = min(sg_cnt, pages_per_mr); - -@@ -162,9 +156,13 @@ static int rdma_rw_init_mr_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp, - sg_cnt -= nents; - for (j = 0; j < nents; j++) - sg = sg_next(sg); -+ prev = reg; - offset = 0; - } - -+ if (prev) -+ prev->wr.wr.next = NULL; -+ - ctx->type = RDMA_RW_MR; - return count; - -@@ -181,7 +179,8 @@ static int rdma_rw_init_map_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp, - u64 remote_addr, u32 rkey, enum dma_data_direction dir) - { - struct ib_device *dev = qp->pd->device; -- u32 max_sge = rdma_rw_max_sge(dev, dir); -+ u32 max_sge = dir == DMA_TO_DEVICE ? qp->max_write_sge : -+ qp->max_read_sge; - struct ib_sge *sge; - u32 total_len = 0, i, j; - -@@ -205,11 +204,10 @@ static int rdma_rw_init_map_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp, - rdma_wr->wr.opcode = IB_WR_RDMA_READ; - rdma_wr->remote_addr = remote_addr + total_len; - rdma_wr->rkey = rkey; -+ rdma_wr->wr.num_sge = nr_sge; - rdma_wr->wr.sg_list = sge; - - for (j = 0; j < nr_sge; j++, sg = sg_next(sg)) { -- rdma_wr->wr.num_sge++; -- - sge->addr = ib_sg_dma_address(dev, sg) + offset; - sge->length = ib_sg_dma_len(dev, sg) - offset; - sge->lkey = qp->pd->local_dma_lkey; -@@ -220,8 +218,8 @@ static int rdma_rw_init_map_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp, - offset = 0; - } - -- if (i + 1 < ctx->nr_ops) -- rdma_wr->wr.next = &ctx->map.wrs[i + 1].wr; -+ rdma_wr->wr.next = i + 1 < ctx->nr_ops ? -+ &ctx->map.wrs[i + 1].wr : NULL; - } - - ctx->type = RDMA_RW_MULTI_WR; -diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c -index 6298f54..e39a0b5 100644 ---- a/drivers/infiniband/core/verbs.c -+++ b/drivers/infiniband/core/verbs.c -@@ -814,6 +814,15 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd, - } - } - -+ /* -+ * Note: all hw drivers guarantee that max_send_sge is lower than -+ * the device RDMA WRITE SGE limit but not all hw drivers ensure that -+ * max_send_sge <= max_sge_rd. -+ */ -+ qp->max_write_sge = qp_init_attr->cap.max_send_sge; -+ qp->max_read_sge = min_t(u32, qp_init_attr->cap.max_send_sge, -+ device->attrs.max_sge_rd); -+ - return qp; - } - EXPORT_SYMBOL(ib_create_qp); -diff --git a/drivers/infiniband/hw/mlx5/gsi.c b/drivers/infiniband/hw/mlx5/gsi.c -index 53e03c8..79e6309 100644 ---- a/drivers/infiniband/hw/mlx5/gsi.c -+++ b/drivers/infiniband/hw/mlx5/gsi.c -@@ -69,15 +69,6 @@ static bool mlx5_ib_deth_sqpn_cap(struct mlx5_ib_dev *dev) - return MLX5_CAP_GEN(dev->mdev, set_deth_sqpn); - } - --static u32 next_outstanding(struct mlx5_ib_gsi_qp *gsi, u32 index) --{ -- return ++index % gsi->cap.max_send_wr; --} -- --#define for_each_outstanding_wr(gsi, index) \ -- for (index = gsi->outstanding_ci; index != gsi->outstanding_pi; \ -- index = next_outstanding(gsi, index)) -- - /* Call with gsi->lock locked */ - static void generate_completions(struct mlx5_ib_gsi_qp *gsi) - { -@@ -85,8 +76,9 @@ static void generate_completions(struct mlx5_ib_gsi_qp *gsi) - struct mlx5_ib_gsi_wr *wr; - u32 index; - -- for_each_outstanding_wr(gsi, index) { -- wr = &gsi->outstanding_wrs[index]; -+ for (index = gsi->outstanding_ci; index != gsi->outstanding_pi; -+ index++) { -+ wr = &gsi->outstanding_wrs[index % gsi->cap.max_send_wr]; - - if (!wr->completed) - break; -@@ -430,8 +422,9 @@ static int mlx5_ib_add_outstanding_wr(struct mlx5_ib_gsi_qp *gsi, - return -ENOMEM; - } - -- gsi_wr = &gsi->outstanding_wrs[gsi->outstanding_pi]; -- gsi->outstanding_pi = next_outstanding(gsi, gsi->outstanding_pi); -+ gsi_wr = &gsi->outstanding_wrs[gsi->outstanding_pi % -+ gsi->cap.max_send_wr]; -+ gsi->outstanding_pi++; - - if (!wc) { - memset(&gsi_wr->wc, 0, sizeof(gsi_wr->wc)); -diff --git a/drivers/infiniband/sw/rdmavt/Kconfig b/drivers/infiniband/sw/rdmavt/Kconfig -index 11aa6a3..1da8d01 100644 ---- a/drivers/infiniband/sw/rdmavt/Kconfig -+++ b/drivers/infiniband/sw/rdmavt/Kconfig -@@ -1,6 +1,5 @@ - config INFINIBAND_RDMAVT - tristate "RDMA verbs transport library" - depends on 64BIT -- default m - ---help--- - This is a common software verbs provider for RDMA networks. -diff --git a/drivers/infiniband/sw/rdmavt/cq.c b/drivers/infiniband/sw/rdmavt/cq.c -index 6ca6fa8..f2f229e 100644 ---- a/drivers/infiniband/sw/rdmavt/cq.c -+++ b/drivers/infiniband/sw/rdmavt/cq.c -@@ -510,6 +510,7 @@ int rvt_driver_cq_init(struct rvt_dev_info *rdi) - - if (rdi->worker) - return 0; -+ spin_lock_init(&rdi->n_cqs_lock); - rdi->worker = kzalloc(sizeof(*rdi->worker), GFP_KERNEL); - if (!rdi->worker) - return -ENOMEM; -diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c -index 4a41556..9a3b954 100644 ---- a/drivers/infiniband/ulp/srpt/ib_srpt.c -+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c -@@ -1601,6 +1601,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch) - struct ib_qp_init_attr *qp_init; - struct srpt_port *sport = ch->sport; - struct srpt_device *sdev = sport->sdev; -+ const struct ib_device_attr *attrs = &sdev->device->attrs; - u32 srp_sq_size = sport->port_attrib.srp_sq_size; - int ret; - -@@ -1638,7 +1639,7 @@ retry: - */ - qp_init->cap.max_send_wr = srp_sq_size / 2; - qp_init->cap.max_rdma_ctxs = srp_sq_size / 2; -- qp_init->cap.max_send_sge = SRPT_DEF_SG_PER_WQE; -+ qp_init->cap.max_send_sge = min(attrs->max_sge, SRPT_MAX_SG_PER_WQE); - qp_init->port_num = ch->sport->port; - - ch->qp = ib_create_qp(sdev->pd, qp_init); -diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.h b/drivers/infiniband/ulp/srpt/ib_srpt.h -index 3890304..5818787 100644 ---- a/drivers/infiniband/ulp/srpt/ib_srpt.h -+++ b/drivers/infiniband/ulp/srpt/ib_srpt.h -@@ -106,7 +106,11 @@ enum { - SRP_LOGIN_RSP_MULTICHAN_MAINTAINED = 0x2, - - SRPT_DEF_SG_TABLESIZE = 128, -- SRPT_DEF_SG_PER_WQE = 16, -+ /* -+ * An experimentally determined value that avoids that QP creation -+ * fails due to "swiotlb buffer is full" on systems using the swiotlb. -+ */ -+ SRPT_MAX_SG_PER_WQE = 16, - - MIN_SRPT_SQ_SIZE = 16, - DEF_SRPT_SQ_SIZE = 4096, -diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c -index 2f58985..d15b338 100644 ---- a/drivers/input/mouse/elan_i2c_core.c -+++ b/drivers/input/mouse/elan_i2c_core.c -@@ -4,7 +4,8 @@ - * Copyright (c) 2013 ELAN Microelectronics Corp. - * - * Author: æž—æ”¿ç¶ (Duson Lin) <dusonlin@emc.com.tw> -- * Version: 1.6.0 -+ * Author: KT Liao <kt.liao@emc.com.tw> -+ * Version: 1.6.2 - * - * Based on cyapa driver: - * copyright (c) 2011-2012 Cypress Semiconductor, Inc. -@@ -40,7 +41,7 @@ - #include "elan_i2c.h" - - #define DRIVER_NAME "elan_i2c" --#define ELAN_DRIVER_VERSION "1.6.1" -+#define ELAN_DRIVER_VERSION "1.6.2" - #define ELAN_VENDOR_ID 0x04f3 - #define ETP_MAX_PRESSURE 255 - #define ETP_FWIDTH_REDUCE 90 -@@ -199,9 +200,41 @@ static int elan_sleep(struct elan_tp_data *data) - return error; - } - -+static int elan_query_product(struct elan_tp_data *data) -+{ -+ int error; -+ -+ error = data->ops->get_product_id(data->client, &data->product_id); -+ if (error) -+ return error; -+ -+ error = data->ops->get_sm_version(data->client, &data->ic_type, -+ &data->sm_version); -+ if (error) -+ return error; -+ -+ return 0; -+} -+ -+static int elan_check_ASUS_special_fw(struct elan_tp_data *data) -+{ -+ if (data->ic_type != 0x0E) -+ return false; -+ -+ switch (data->product_id) { -+ case 0x05 ... 0x07: -+ case 0x09: -+ case 0x13: -+ return true; -+ default: -+ return false; -+ } -+} -+ - static int __elan_initialize(struct elan_tp_data *data) - { - struct i2c_client *client = data->client; -+ bool woken_up = false; - int error; - - error = data->ops->initialize(client); -@@ -210,6 +243,27 @@ static int __elan_initialize(struct elan_tp_data *data) - return error; - } - -+ error = elan_query_product(data); -+ if (error) -+ return error; -+ -+ /* -+ * Some ASUS devices were shipped with firmware that requires -+ * touchpads to be woken up first, before attempting to switch -+ * them into absolute reporting mode. -+ */ -+ if (elan_check_ASUS_special_fw(data)) { -+ error = data->ops->sleep_control(client, false); -+ if (error) { -+ dev_err(&client->dev, -+ "failed to wake device up: %d\n", error); -+ return error; -+ } -+ -+ msleep(200); -+ woken_up = true; -+ } -+ - data->mode |= ETP_ENABLE_ABS; - error = data->ops->set_mode(client, data->mode); - if (error) { -@@ -218,11 +272,13 @@ static int __elan_initialize(struct elan_tp_data *data) - return error; - } - -- error = data->ops->sleep_control(client, false); -- if (error) { -- dev_err(&client->dev, -- "failed to wake device up: %d\n", error); -- return error; -+ if (!woken_up) { -+ error = data->ops->sleep_control(client, false); -+ if (error) { -+ dev_err(&client->dev, -+ "failed to wake device up: %d\n", error); -+ return error; -+ } - } - - return 0; -@@ -248,10 +304,6 @@ static int elan_query_device_info(struct elan_tp_data *data) - { - int error; - -- error = data->ops->get_product_id(data->client, &data->product_id); -- if (error) -- return error; -- - error = data->ops->get_version(data->client, false, &data->fw_version); - if (error) - return error; -@@ -261,11 +313,6 @@ static int elan_query_device_info(struct elan_tp_data *data) - if (error) - return error; - -- error = data->ops->get_sm_version(data->client, &data->ic_type, -- &data->sm_version); -- if (error) -- return error; -- - error = data->ops->get_version(data->client, true, &data->iap_version); - if (error) - return error; -diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c -index 880c40b..b7e8c11 100644 ---- a/drivers/input/touchscreen/sur40.c -+++ b/drivers/input/touchscreen/sur40.c -@@ -126,7 +126,7 @@ struct sur40_image_header { - #define VIDEO_PACKET_SIZE 16384 - - /* polling interval (ms) */ --#define POLL_INTERVAL 4 -+#define POLL_INTERVAL 1 - - /* maximum number of contacts FIXME: this is a guess? */ - #define MAX_CONTACTS 64 -@@ -448,7 +448,7 @@ static void sur40_process_video(struct sur40_state *sur40) - - /* return error if streaming was stopped in the meantime */ - if (sur40->sequence == -1) -- goto err_poll; -+ return; - - /* mark as finished */ - new_buf->vb.vb2_buf.timestamp = ktime_get_ns(); -@@ -736,6 +736,7 @@ static int sur40_start_streaming(struct vb2_queue *vq, unsigned int count) - static void sur40_stop_streaming(struct vb2_queue *vq) - { - struct sur40_state *sur40 = vb2_get_drv_priv(vq); -+ vb2_wait_for_all_buffers(vq); - sur40->sequence = -1; - - /* Release all active buffers */ -diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c -index 634f636..2511c8b 100644 ---- a/drivers/iommu/amd_iommu.c -+++ b/drivers/iommu/amd_iommu.c -@@ -466,9 +466,11 @@ static void init_iommu_group(struct device *dev) - if (!domain) - goto out; - -- dma_domain = to_pdomain(domain)->priv; -+ if (to_pdomain(domain)->flags == PD_DMA_OPS_MASK) { -+ dma_domain = to_pdomain(domain)->priv; -+ init_unity_mappings_for_device(dev, dma_domain); -+ } - -- init_unity_mappings_for_device(dev, dma_domain); - out: - iommu_group_put(group); - } -@@ -2512,8 +2514,15 @@ static void update_device_table(struct protection_domain *domain) - { - struct iommu_dev_data *dev_data; - -- list_for_each_entry(dev_data, &domain->dev_list, list) -+ list_for_each_entry(dev_data, &domain->dev_list, list) { - set_dte_entry(dev_data->devid, domain, dev_data->ats.enabled); -+ -+ if (dev_data->devid == dev_data->alias) -+ continue; -+ -+ /* There is an alias, update device table entry for it */ -+ set_dte_entry(dev_data->alias, domain, dev_data->ats.enabled); -+ } - } - - static void update_domain(struct protection_domain *domain) -@@ -3103,9 +3112,7 @@ static struct iommu_domain *amd_iommu_domain_alloc(unsigned type) - static void amd_iommu_domain_free(struct iommu_domain *dom) - { - struct protection_domain *domain; -- -- if (!dom) -- return; -+ struct dma_ops_domain *dma_dom; - - domain = to_pdomain(dom); - -@@ -3114,13 +3121,24 @@ static void amd_iommu_domain_free(struct iommu_domain *dom) - - BUG_ON(domain->dev_cnt != 0); - -- if (domain->mode != PAGE_MODE_NONE) -- free_pagetable(domain); -+ if (!dom) -+ return; -+ -+ switch (dom->type) { -+ case IOMMU_DOMAIN_DMA: -+ dma_dom = domain->priv; -+ dma_ops_domain_free(dma_dom); -+ break; -+ default: -+ if (domain->mode != PAGE_MODE_NONE) -+ free_pagetable(domain); - -- if (domain->flags & PD_IOMMUV2_MASK) -- free_gcr3_table(domain); -+ if (domain->flags & PD_IOMMUV2_MASK) -+ free_gcr3_table(domain); - -- protection_domain_free(domain); -+ protection_domain_free(domain); -+ break; -+ } - } - - static void amd_iommu_detach_device(struct iommu_domain *dom, -diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c -index 5ecc86c..e27e3b7df 100644 ---- a/drivers/iommu/exynos-iommu.c -+++ b/drivers/iommu/exynos-iommu.c -@@ -709,6 +709,7 @@ static struct platform_driver exynos_sysmmu_driver __refdata = { - .name = "exynos-sysmmu", - .of_match_table = sysmmu_of_match, - .pm = &sysmmu_pm_ops, -+ .suppress_bind_attrs = true, - } - }; - -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index 323dac9..d416242 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -2076,7 +2076,7 @@ out_unlock: - spin_unlock(&iommu->lock); - spin_unlock_irqrestore(&device_domain_lock, flags); - -- return 0; -+ return ret; - } - - struct domain_context_mapping_data { -diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c -index a1ed1b7..f5c90e1 100644 ---- a/drivers/iommu/io-pgtable-arm.c -+++ b/drivers/iommu/io-pgtable-arm.c -@@ -576,7 +576,7 @@ static phys_addr_t arm_lpae_iova_to_phys(struct io_pgtable_ops *ops, - return 0; - - found_translation: -- iova &= (ARM_LPAE_GRANULE(data) - 1); -+ iova &= (ARM_LPAE_BLOCK_SIZE(lvl, data) - 1); - return ((phys_addr_t)iopte_to_pfn(pte,data) << data->pg_shift) | iova; - } - -diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c -index b7341de..4bb49cd 100644 ---- a/drivers/md/dm-flakey.c -+++ b/drivers/md/dm-flakey.c -@@ -289,10 +289,16 @@ static int flakey_map(struct dm_target *ti, struct bio *bio) - pb->bio_submitted = true; - - /* -- * Map reads as normal. -+ * Map reads as normal only if corrupt_bio_byte set. - */ -- if (bio_data_dir(bio) == READ) -- goto map_bio; -+ if (bio_data_dir(bio) == READ) { -+ /* If flags were specified, only corrupt those that match. */ -+ if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) && -+ all_corrupt_bio_flags_match(bio, fc)) -+ goto map_bio; -+ else -+ return -EIO; -+ } - - /* - * Drop writes? -@@ -330,12 +336,13 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, int error) - - /* - * Corrupt successful READs while in down state. -- * If flags were specified, only corrupt those that match. - */ -- if (fc->corrupt_bio_byte && !error && pb->bio_submitted && -- (bio_data_dir(bio) == READ) && (fc->corrupt_bio_rw == READ) && -- all_corrupt_bio_flags_match(bio, fc)) -- corrupt_bio_data(bio, fc); -+ if (!error && pb->bio_submitted && (bio_data_dir(bio) == READ)) { -+ if (fc->corrupt_bio_byte) -+ corrupt_bio_data(bio, fc); -+ else -+ return -EIO; -+ } - - return error; - } -diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c -index 459a9f8..0f0eb8a 100644 ---- a/drivers/md/dm-verity-fec.c -+++ b/drivers/md/dm-verity-fec.c -@@ -453,9 +453,7 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io, - */ - - offset = block << v->data_dev_block_bits; -- -- res = offset; -- div64_u64(res, v->fec->rounds << v->data_dev_block_bits); -+ res = div64_u64(offset, v->fec->rounds << v->data_dev_block_bits); - - /* - * The base RS block we can feed to the interleaver to find out all -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 1b2f962..fd40bcb 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -2175,7 +2175,7 @@ static void dm_request_fn(struct request_queue *q) - md_in_flight(md) && rq->bio && rq->bio->bi_vcnt == 1 && - md->last_rq_pos == pos && md->last_rq_rw == rq_data_dir(rq)) || - (ti->type->busy && ti->type->busy(ti))) { -- blk_delay_queue(q, HZ / 100); -+ blk_delay_queue(q, 10); - return; - } - -@@ -3128,7 +3128,8 @@ static void unlock_fs(struct mapped_device *md) - * Caller must hold md->suspend_lock - */ - static int __dm_suspend(struct mapped_device *md, struct dm_table *map, -- unsigned suspend_flags, int interruptible) -+ unsigned suspend_flags, int interruptible, -+ int dmf_suspended_flag) - { - bool do_lockfs = suspend_flags & DM_SUSPEND_LOCKFS_FLAG; - bool noflush = suspend_flags & DM_SUSPEND_NOFLUSH_FLAG; -@@ -3195,6 +3196,8 @@ static int __dm_suspend(struct mapped_device *md, struct dm_table *map, - * to finish. - */ - r = dm_wait_for_completion(md, interruptible); -+ if (!r) -+ set_bit(dmf_suspended_flag, &md->flags); - - if (noflush) - clear_bit(DMF_NOFLUSH_SUSPENDING, &md->flags); -@@ -3256,12 +3259,10 @@ retry: - - map = rcu_dereference_protected(md->map, lockdep_is_held(&md->suspend_lock)); - -- r = __dm_suspend(md, map, suspend_flags, TASK_INTERRUPTIBLE); -+ r = __dm_suspend(md, map, suspend_flags, TASK_INTERRUPTIBLE, DMF_SUSPENDED); - if (r) - goto out_unlock; - -- set_bit(DMF_SUSPENDED, &md->flags); -- - dm_table_postsuspend_targets(map); - - out_unlock: -@@ -3355,9 +3356,8 @@ static void __dm_internal_suspend(struct mapped_device *md, unsigned suspend_fla - * would require changing .presuspend to return an error -- avoid this - * until there is a need for more elaborate variants of internal suspend. - */ -- (void) __dm_suspend(md, map, suspend_flags, TASK_UNINTERRUPTIBLE); -- -- set_bit(DMF_SUSPENDED_INTERNALLY, &md->flags); -+ (void) __dm_suspend(md, map, suspend_flags, TASK_UNINTERRUPTIBLE, -+ DMF_SUSPENDED_INTERNALLY); - - dm_table_postsuspend_targets(map); - } -diff --git a/drivers/media/dvb-core/dvb_ringbuffer.c b/drivers/media/dvb-core/dvb_ringbuffer.c -index 1100e98..7df7fb3 100644 ---- a/drivers/media/dvb-core/dvb_ringbuffer.c -+++ b/drivers/media/dvb-core/dvb_ringbuffer.c -@@ -55,7 +55,13 @@ void dvb_ringbuffer_init(struct dvb_ringbuffer *rbuf, void *data, size_t len) - - int dvb_ringbuffer_empty(struct dvb_ringbuffer *rbuf) - { -- return (rbuf->pread==rbuf->pwrite); -+ /* smp_load_acquire() to load write pointer on reader side -+ * this pairs with smp_store_release() in dvb_ringbuffer_write(), -+ * dvb_ringbuffer_write_user(), or dvb_ringbuffer_reset() -+ * -+ * for memory barriers also see Documentation/circular-buffers.txt -+ */ -+ return (rbuf->pread == smp_load_acquire(&rbuf->pwrite)); - } - - -@@ -64,7 +70,12 @@ ssize_t dvb_ringbuffer_free(struct dvb_ringbuffer *rbuf) - { - ssize_t free; - -- free = rbuf->pread - rbuf->pwrite; -+ /* ACCESS_ONCE() to load read pointer on writer side -+ * this pairs with smp_store_release() in dvb_ringbuffer_read(), -+ * dvb_ringbuffer_read_user(), dvb_ringbuffer_flush(), -+ * or dvb_ringbuffer_reset() -+ */ -+ free = ACCESS_ONCE(rbuf->pread) - rbuf->pwrite; - if (free <= 0) - free += rbuf->size; - return free-1; -@@ -76,7 +87,11 @@ ssize_t dvb_ringbuffer_avail(struct dvb_ringbuffer *rbuf) - { - ssize_t avail; - -- avail = rbuf->pwrite - rbuf->pread; -+ /* smp_load_acquire() to load write pointer on reader side -+ * this pairs with smp_store_release() in dvb_ringbuffer_write(), -+ * dvb_ringbuffer_write_user(), or dvb_ringbuffer_reset() -+ */ -+ avail = smp_load_acquire(&rbuf->pwrite) - rbuf->pread; - if (avail < 0) - avail += rbuf->size; - return avail; -@@ -86,14 +101,25 @@ ssize_t dvb_ringbuffer_avail(struct dvb_ringbuffer *rbuf) - - void dvb_ringbuffer_flush(struct dvb_ringbuffer *rbuf) - { -- rbuf->pread = rbuf->pwrite; -+ /* dvb_ringbuffer_flush() counts as read operation -+ * smp_load_acquire() to load write pointer -+ * smp_store_release() to update read pointer, this ensures that the -+ * correct pointer is visible for subsequent dvb_ringbuffer_free() -+ * calls on other cpu cores -+ */ -+ smp_store_release(&rbuf->pread, smp_load_acquire(&rbuf->pwrite)); - rbuf->error = 0; - } - EXPORT_SYMBOL(dvb_ringbuffer_flush); - - void dvb_ringbuffer_reset(struct dvb_ringbuffer *rbuf) - { -- rbuf->pread = rbuf->pwrite = 0; -+ /* dvb_ringbuffer_reset() counts as read and write operation -+ * smp_store_release() to update read pointer -+ */ -+ smp_store_release(&rbuf->pread, 0); -+ /* smp_store_release() to update write pointer */ -+ smp_store_release(&rbuf->pwrite, 0); - rbuf->error = 0; - } - -@@ -119,12 +145,17 @@ ssize_t dvb_ringbuffer_read_user(struct dvb_ringbuffer *rbuf, u8 __user *buf, si - return -EFAULT; - buf += split; - todo -= split; -- rbuf->pread = 0; -+ /* smp_store_release() for read pointer update to ensure -+ * that buf is not overwritten until read is complete, -+ * this pairs with ACCESS_ONCE() in dvb_ringbuffer_free() -+ */ -+ smp_store_release(&rbuf->pread, 0); - } - if (copy_to_user(buf, rbuf->data+rbuf->pread, todo)) - return -EFAULT; - -- rbuf->pread = (rbuf->pread + todo) % rbuf->size; -+ /* smp_store_release() to update read pointer, see above */ -+ smp_store_release(&rbuf->pread, (rbuf->pread + todo) % rbuf->size); - - return len; - } -@@ -139,11 +170,16 @@ void dvb_ringbuffer_read(struct dvb_ringbuffer *rbuf, u8 *buf, size_t len) - memcpy(buf, rbuf->data+rbuf->pread, split); - buf += split; - todo -= split; -- rbuf->pread = 0; -+ /* smp_store_release() for read pointer update to ensure -+ * that buf is not overwritten until read is complete, -+ * this pairs with ACCESS_ONCE() in dvb_ringbuffer_free() -+ */ -+ smp_store_release(&rbuf->pread, 0); - } - memcpy(buf, rbuf->data+rbuf->pread, todo); - -- rbuf->pread = (rbuf->pread + todo) % rbuf->size; -+ /* smp_store_release() to update read pointer, see above */ -+ smp_store_release(&rbuf->pread, (rbuf->pread + todo) % rbuf->size); - } - - -@@ -158,10 +194,16 @@ ssize_t dvb_ringbuffer_write(struct dvb_ringbuffer *rbuf, const u8 *buf, size_t - memcpy(rbuf->data+rbuf->pwrite, buf, split); - buf += split; - todo -= split; -- rbuf->pwrite = 0; -+ /* smp_store_release() for write pointer update to ensure that -+ * written data is visible on other cpu cores before the pointer -+ * update, this pairs with smp_load_acquire() in -+ * dvb_ringbuffer_empty() or dvb_ringbuffer_avail() -+ */ -+ smp_store_release(&rbuf->pwrite, 0); - } - memcpy(rbuf->data+rbuf->pwrite, buf, todo); -- rbuf->pwrite = (rbuf->pwrite + todo) % rbuf->size; -+ /* smp_store_release() for write pointer update, see above */ -+ smp_store_release(&rbuf->pwrite, (rbuf->pwrite + todo) % rbuf->size); - - return len; - } -@@ -181,12 +223,18 @@ ssize_t dvb_ringbuffer_write_user(struct dvb_ringbuffer *rbuf, - return len - todo; - buf += split; - todo -= split; -- rbuf->pwrite = 0; -+ /* smp_store_release() for write pointer update to ensure that -+ * written data is visible on other cpu cores before the pointer -+ * update, this pairs with smp_load_acquire() in -+ * dvb_ringbuffer_empty() or dvb_ringbuffer_avail() -+ */ -+ smp_store_release(&rbuf->pwrite, 0); - } - status = copy_from_user(rbuf->data+rbuf->pwrite, buf, todo); - if (status) - return len - todo; -- rbuf->pwrite = (rbuf->pwrite + todo) % rbuf->size; -+ /* smp_store_release() for write pointer update, see above */ -+ smp_store_release(&rbuf->pwrite, (rbuf->pwrite + todo) % rbuf->size); - - return len; - } -diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c -index b16466f..beb4fd5 100644 ---- a/drivers/media/platform/s5p-mfc/s5p_mfc.c -+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c -@@ -1050,6 +1050,11 @@ static int match_child(struct device *dev, void *data) - return !strcmp(dev_name(dev), (char *)data); - } - -+static void s5p_mfc_memdev_release(struct device *dev) -+{ -+ dma_release_declared_memory(dev); -+} -+ - static void *mfc_get_drv_data(struct platform_device *pdev); - - static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev) -@@ -1062,6 +1067,9 @@ static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev) - mfc_err("Not enough memory\n"); - return -ENOMEM; - } -+ -+ dev_set_name(dev->mem_dev_l, "%s", "s5p-mfc-l"); -+ dev->mem_dev_l->release = s5p_mfc_memdev_release; - device_initialize(dev->mem_dev_l); - of_property_read_u32_array(dev->plat_dev->dev.of_node, - "samsung,mfc-l", mem_info, 2); -@@ -1079,6 +1087,9 @@ static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev) - mfc_err("Not enough memory\n"); - return -ENOMEM; - } -+ -+ dev_set_name(dev->mem_dev_r, "%s", "s5p-mfc-r"); -+ dev->mem_dev_r->release = s5p_mfc_memdev_release; - device_initialize(dev->mem_dev_r); - of_property_read_u32_array(dev->plat_dev->dev.of_node, - "samsung,mfc-r", mem_info, 2); -diff --git a/drivers/media/rc/ir-rc5-decoder.c b/drivers/media/rc/ir-rc5-decoder.c -index 6ffe776..a0fd4e6 100644 ---- a/drivers/media/rc/ir-rc5-decoder.c -+++ b/drivers/media/rc/ir-rc5-decoder.c -@@ -29,7 +29,7 @@ - #define RC5_BIT_START (1 * RC5_UNIT) - #define RC5_BIT_END (1 * RC5_UNIT) - #define RC5X_SPACE (4 * RC5_UNIT) --#define RC5_TRAILER (10 * RC5_UNIT) /* In reality, approx 100 */ -+#define RC5_TRAILER (6 * RC5_UNIT) /* In reality, approx 100 */ - - enum rc5_state { - STATE_INACTIVE, -diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c -index 99b303b..e8ceb0e 100644 ---- a/drivers/media/rc/nuvoton-cir.c -+++ b/drivers/media/rc/nuvoton-cir.c -@@ -401,6 +401,7 @@ static int nvt_hw_detect(struct nvt_dev *nvt) - /* Check if we're wired for the alternate EFER setup */ - nvt->chip_major = nvt_cr_read(nvt, CR_CHIP_ID_HI); - if (nvt->chip_major == 0xff) { -+ nvt_efm_disable(nvt); - nvt->cr_efir = CR_EFIR2; - nvt->cr_efdr = CR_EFDR2; - nvt_efm_enable(nvt); -diff --git a/drivers/media/usb/usbtv/usbtv-audio.c b/drivers/media/usb/usbtv/usbtv-audio.c -index 78c12d2..5dab024 100644 ---- a/drivers/media/usb/usbtv/usbtv-audio.c -+++ b/drivers/media/usb/usbtv/usbtv-audio.c -@@ -278,6 +278,9 @@ static void snd_usbtv_trigger(struct work_struct *work) - { - struct usbtv *chip = container_of(work, struct usbtv, snd_trigger); - -+ if (!chip->snd) -+ return; -+ - if (atomic_read(&chip->snd_stream)) - usbtv_audio_start(chip); - else -@@ -378,6 +381,8 @@ err: - - void usbtv_audio_free(struct usbtv *usbtv) - { -+ cancel_work_sync(&usbtv->snd_trigger); -+ - if (usbtv->snd && usbtv->udev) { - snd_card_free(usbtv->snd); - usbtv->snd = NULL; -diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c -index 9fbcb67..633fc1a 100644 ---- a/drivers/media/v4l2-core/videobuf2-core.c -+++ b/drivers/media/v4l2-core/videobuf2-core.c -@@ -1648,7 +1648,7 @@ static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb, - void *pb, int nonblocking) - { - unsigned long flags; -- int ret; -+ int ret = 0; - - /* - * Wait for at least one buffer to become available on the done_list. -@@ -1664,10 +1664,12 @@ static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb, - spin_lock_irqsave(&q->done_lock, flags); - *vb = list_first_entry(&q->done_list, struct vb2_buffer, done_entry); - /* -- * Only remove the buffer from done_list if v4l2_buffer can handle all -- * the planes. -+ * Only remove the buffer from done_list if all planes can be -+ * handled. Some cases such as V4L2 file I/O and DVB have pb -+ * == NULL; skip the check then as there's nothing to verify. - */ -- ret = call_bufop(q, verify_planes_array, *vb, pb); -+ if (pb) -+ ret = call_bufop(q, verify_planes_array, *vb, pb); - if (!ret) - list_del(&(*vb)->done_entry); - spin_unlock_irqrestore(&q->done_lock, flags); -diff --git a/drivers/media/v4l2-core/videobuf2-v4l2.c b/drivers/media/v4l2-core/videobuf2-v4l2.c -index 0b1b8c7..7f366f1 100644 ---- a/drivers/media/v4l2-core/videobuf2-v4l2.c -+++ b/drivers/media/v4l2-core/videobuf2-v4l2.c -@@ -74,6 +74,11 @@ static int __verify_planes_array(struct vb2_buffer *vb, const struct v4l2_buffer - return 0; - } - -+static int __verify_planes_array_core(struct vb2_buffer *vb, const void *pb) -+{ -+ return __verify_planes_array(vb, pb); -+} -+ - /** - * __verify_length() - Verify that the bytesused value for each plane fits in - * the plane length and that the data offset doesn't exceed the bytesused value. -@@ -437,6 +442,7 @@ static int __fill_vb2_buffer(struct vb2_buffer *vb, - } - - static const struct vb2_buf_ops v4l2_buf_ops = { -+ .verify_planes_array = __verify_planes_array_core, - .fill_user_buffer = __fill_v4l2_buffer, - .fill_vb2_buffer = __fill_vb2_buffer, - .copy_timestamp = __copy_timestamp, -diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c -index 1be47ad..880d469 100644 ---- a/drivers/mfd/qcom_rpm.c -+++ b/drivers/mfd/qcom_rpm.c -@@ -34,7 +34,13 @@ struct qcom_rpm_resource { - struct qcom_rpm_data { - u32 version; - const struct qcom_rpm_resource *resource_table; -- unsigned n_resources; -+ unsigned int n_resources; -+ unsigned int req_ctx_off; -+ unsigned int req_sel_off; -+ unsigned int ack_ctx_off; -+ unsigned int ack_sel_off; -+ unsigned int req_sel_size; -+ unsigned int ack_sel_size; - }; - - struct qcom_rpm { -@@ -61,11 +67,7 @@ struct qcom_rpm { - - #define RPM_REQUEST_TIMEOUT (5 * HZ) - --#define RPM_REQUEST_CONTEXT 3 --#define RPM_REQ_SELECT 11 --#define RPM_ACK_CONTEXT 15 --#define RPM_ACK_SELECTOR 23 --#define RPM_SELECT_SIZE 7 -+#define RPM_MAX_SEL_SIZE 7 - - #define RPM_NOTIFICATION BIT(30) - #define RPM_REJECTED BIT(31) -@@ -157,6 +159,12 @@ static const struct qcom_rpm_data apq8064_template = { - .version = 3, - .resource_table = apq8064_rpm_resource_table, - .n_resources = ARRAY_SIZE(apq8064_rpm_resource_table), -+ .req_ctx_off = 3, -+ .req_sel_off = 11, -+ .ack_ctx_off = 15, -+ .ack_sel_off = 23, -+ .req_sel_size = 4, -+ .ack_sel_size = 7, - }; - - static const struct qcom_rpm_resource msm8660_rpm_resource_table[] = { -@@ -240,6 +248,12 @@ static const struct qcom_rpm_data msm8660_template = { - .version = 2, - .resource_table = msm8660_rpm_resource_table, - .n_resources = ARRAY_SIZE(msm8660_rpm_resource_table), -+ .req_ctx_off = 3, -+ .req_sel_off = 11, -+ .ack_ctx_off = 19, -+ .ack_sel_off = 27, -+ .req_sel_size = 7, -+ .ack_sel_size = 7, - }; - - static const struct qcom_rpm_resource msm8960_rpm_resource_table[] = { -@@ -322,6 +336,12 @@ static const struct qcom_rpm_data msm8960_template = { - .version = 3, - .resource_table = msm8960_rpm_resource_table, - .n_resources = ARRAY_SIZE(msm8960_rpm_resource_table), -+ .req_ctx_off = 3, -+ .req_sel_off = 11, -+ .ack_ctx_off = 15, -+ .ack_sel_off = 23, -+ .req_sel_size = 4, -+ .ack_sel_size = 7, - }; - - static const struct qcom_rpm_resource ipq806x_rpm_resource_table[] = { -@@ -362,6 +382,12 @@ static const struct qcom_rpm_data ipq806x_template = { - .version = 3, - .resource_table = ipq806x_rpm_resource_table, - .n_resources = ARRAY_SIZE(ipq806x_rpm_resource_table), -+ .req_ctx_off = 3, -+ .req_sel_off = 11, -+ .ack_ctx_off = 15, -+ .ack_sel_off = 23, -+ .req_sel_size = 4, -+ .ack_sel_size = 7, - }; - - static const struct of_device_id qcom_rpm_of_match[] = { -@@ -380,7 +406,7 @@ int qcom_rpm_write(struct qcom_rpm *rpm, - { - const struct qcom_rpm_resource *res; - const struct qcom_rpm_data *data = rpm->data; -- u32 sel_mask[RPM_SELECT_SIZE] = { 0 }; -+ u32 sel_mask[RPM_MAX_SEL_SIZE] = { 0 }; - int left; - int ret = 0; - int i; -@@ -398,12 +424,12 @@ int qcom_rpm_write(struct qcom_rpm *rpm, - writel_relaxed(buf[i], RPM_REQ_REG(rpm, res->target_id + i)); - - bitmap_set((unsigned long *)sel_mask, res->select_id, 1); -- for (i = 0; i < ARRAY_SIZE(sel_mask); i++) { -+ for (i = 0; i < rpm->data->req_sel_size; i++) { - writel_relaxed(sel_mask[i], -- RPM_CTRL_REG(rpm, RPM_REQ_SELECT + i)); -+ RPM_CTRL_REG(rpm, rpm->data->req_sel_off + i)); - } - -- writel_relaxed(BIT(state), RPM_CTRL_REG(rpm, RPM_REQUEST_CONTEXT)); -+ writel_relaxed(BIT(state), RPM_CTRL_REG(rpm, rpm->data->req_ctx_off)); - - reinit_completion(&rpm->ack); - regmap_write(rpm->ipc_regmap, rpm->ipc_offset, BIT(rpm->ipc_bit)); -@@ -426,10 +452,11 @@ static irqreturn_t qcom_rpm_ack_interrupt(int irq, void *dev) - u32 ack; - int i; - -- ack = readl_relaxed(RPM_CTRL_REG(rpm, RPM_ACK_CONTEXT)); -- for (i = 0; i < RPM_SELECT_SIZE; i++) -- writel_relaxed(0, RPM_CTRL_REG(rpm, RPM_ACK_SELECTOR + i)); -- writel(0, RPM_CTRL_REG(rpm, RPM_ACK_CONTEXT)); -+ ack = readl_relaxed(RPM_CTRL_REG(rpm, rpm->data->ack_ctx_off)); -+ for (i = 0; i < rpm->data->ack_sel_size; i++) -+ writel_relaxed(0, -+ RPM_CTRL_REG(rpm, rpm->data->ack_sel_off + i)); -+ writel(0, RPM_CTRL_REG(rpm, rpm->data->ack_ctx_off)); - - if (ack & RPM_NOTIFICATION) { - dev_warn(rpm->dev, "ignoring notification!\n"); -diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c -index 0b0dc29..77533f7 100644 ---- a/drivers/mtd/nand/nand_base.c -+++ b/drivers/mtd/nand/nand_base.c -@@ -2610,7 +2610,7 @@ static int nand_do_write_ops(struct mtd_info *mtd, loff_t to, - int cached = writelen > bytes && page != blockmask; - uint8_t *wbuf = buf; - int use_bufpoi; -- int part_pagewr = (column || writelen < (mtd->writesize - 1)); -+ int part_pagewr = (column || writelen < mtd->writesize); - - if (part_pagewr) - use_bufpoi = 1; -diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c -index ef36182..0680516 100644 ---- a/drivers/mtd/ubi/build.c -+++ b/drivers/mtd/ubi/build.c -@@ -874,7 +874,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, - for (i = 0; i < UBI_MAX_DEVICES; i++) { - ubi = ubi_devices[i]; - if (ubi && mtd->index == ubi->mtd->index) { -- ubi_err(ubi, "mtd%d is already attached to ubi%d", -+ pr_err("ubi: mtd%d is already attached to ubi%d", - mtd->index, i); - return -EEXIST; - } -@@ -889,7 +889,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, - * no sense to attach emulated MTD devices, so we prohibit this. - */ - if (mtd->type == MTD_UBIVOLUME) { -- ubi_err(ubi, "refuse attaching mtd%d - it is already emulated on top of UBI", -+ pr_err("ubi: refuse attaching mtd%d - it is already emulated on top of UBI", - mtd->index); - return -EINVAL; - } -@@ -900,7 +900,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, - if (!ubi_devices[ubi_num]) - break; - if (ubi_num == UBI_MAX_DEVICES) { -- ubi_err(ubi, "only %d UBI devices may be created", -+ pr_err("ubi: only %d UBI devices may be created", - UBI_MAX_DEVICES); - return -ENFILE; - } -@@ -910,7 +910,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, - - /* Make sure ubi_num is not busy */ - if (ubi_devices[ubi_num]) { -- ubi_err(ubi, "already exists"); -+ pr_err("ubi: ubi%i already exists", ubi_num); - return -EEXIST; - } - } -@@ -992,6 +992,9 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, - goto out_detach; - } - -+ /* Make device "available" before it becomes accessible via sysfs */ -+ ubi_devices[ubi_num] = ubi; -+ - err = uif_init(ubi, &ref); - if (err) - goto out_detach; -@@ -1036,7 +1039,6 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, - wake_up_process(ubi->bgt_thread); - spin_unlock(&ubi->wl_lock); - -- ubi_devices[ubi_num] = ubi; - ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL); - return ubi_num; - -@@ -1047,6 +1049,7 @@ out_uif: - ubi_assert(ref); - uif_close(ubi); - out_detach: -+ ubi_devices[ubi_num] = NULL; - ubi_wl_close(ubi); - ubi_free_internal_volumes(ubi); - vfree(ubi->vtbl); -diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c -index 10059df..0138f52 100644 ---- a/drivers/mtd/ubi/vmt.c -+++ b/drivers/mtd/ubi/vmt.c -@@ -488,13 +488,6 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs) - spin_unlock(&ubi->volumes_lock); - } - -- /* Change volume table record */ -- vtbl_rec = ubi->vtbl[vol_id]; -- vtbl_rec.reserved_pebs = cpu_to_be32(reserved_pebs); -- err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec); -- if (err) -- goto out_acc; -- - if (pebs < 0) { - for (i = 0; i < -pebs; i++) { - err = ubi_eba_unmap_leb(ubi, vol, reserved_pebs + i); -@@ -512,6 +505,24 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs) - spin_unlock(&ubi->volumes_lock); - } - -+ /* -+ * When we shrink a volume we have to flush all pending (erase) work. -+ * Otherwise it can happen that upon next attach UBI finds a LEB with -+ * lnum > highest_lnum and refuses to attach. -+ */ -+ if (pebs < 0) { -+ err = ubi_wl_flush(ubi, vol_id, UBI_ALL); -+ if (err) -+ goto out_acc; -+ } -+ -+ /* Change volume table record */ -+ vtbl_rec = ubi->vtbl[vol_id]; -+ vtbl_rec.reserved_pebs = cpu_to_be32(reserved_pebs); -+ err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec); -+ if (err) -+ goto out_acc; -+ - vol->reserved_pebs = reserved_pebs; - if (vol->vol_type == UBI_DYNAMIC_VOLUME) { - vol->used_ebs = reserved_pebs; -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c -index 5b30922..2ce3199 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c -@@ -2469,10 +2469,22 @@ void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb) - void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked) - { - struct brcmf_fws_info *fws = drvr->fws; -+ struct brcmf_if *ifp; -+ int i; - -- fws->bus_flow_blocked = flow_blocked; -- if (!flow_blocked) -- brcmf_fws_schedule_deq(fws); -- else -- fws->stats.bus_flow_block++; -+ if (fws->avoid_queueing) { -+ for (i = 0; i < BRCMF_MAX_IFS; i++) { -+ ifp = drvr->iflist[i]; -+ if (!ifp || !ifp->ndev) -+ continue; -+ brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FLOW, -+ flow_blocked); -+ } -+ } else { -+ fws->bus_flow_blocked = flow_blocked; -+ if (!flow_blocked) -+ brcmf_fws_schedule_deq(fws); -+ else -+ fws->stats.bus_flow_block++; -+ } - } -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c -index a588b05..6f020e4 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c -@@ -433,6 +433,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = { - /* 8000 Series */ - {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x1010, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x10B0, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0130, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x1130, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0132, iwl8260_2ac_cfg)}, -@@ -454,6 +455,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { - {IWL_PCI_DEVICE(0x24F3, 0xD010, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0xC050, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0xD050, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0xD0B0, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0xB0B0, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x8010, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x8110, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x9010, iwl8260_2ac_cfg)}, -@@ -481,6 +484,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { - {IWL_PCI_DEVICE(0x24FD, 0x0010, iwl8265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24FD, 0x0110, iwl8265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24FD, 0x1110, iwl8265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24FD, 0x1130, iwl8265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24FD, 0x0130, iwl8265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24FD, 0x1010, iwl8265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24FD, 0x0050, iwl8265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24FD, 0x0150, iwl8265_2ac_cfg)}, -@@ -491,6 +496,10 @@ static const struct pci_device_id iwl_hw_card_ids[] = { - {IWL_PCI_DEVICE(0x24FD, 0x0810, iwl8265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24FD, 0x9110, iwl8265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24FD, 0x8130, iwl8265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24FD, 0x0910, iwl8265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24FD, 0x0930, iwl8265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24FD, 0x0950, iwl8265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24FD, 0x0850, iwl8265_2ac_cfg)}, - - /* 9000 Series */ - {IWL_PCI_DEVICE(0x2526, 0x0000, iwl9260_2ac_cfg)}, -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h -index de6974f..2d8cce2 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h -@@ -496,7 +496,7 @@ void iwl_pcie_dump_csr(struct iwl_trans *trans); - /***************************************************** - * Helpers - ******************************************************/ --static inline void iwl_disable_interrupts(struct iwl_trans *trans) -+static inline void _iwl_disable_interrupts(struct iwl_trans *trans) - { - struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); - -@@ -519,7 +519,16 @@ static inline void iwl_disable_interrupts(struct iwl_trans *trans) - IWL_DEBUG_ISR(trans, "Disabled interrupts\n"); - } - --static inline void iwl_enable_interrupts(struct iwl_trans *trans) -+static inline void iwl_disable_interrupts(struct iwl_trans *trans) -+{ -+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); -+ -+ spin_lock(&trans_pcie->irq_lock); -+ _iwl_disable_interrupts(trans); -+ spin_unlock(&trans_pcie->irq_lock); -+} -+ -+static inline void _iwl_enable_interrupts(struct iwl_trans *trans) - { - struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); - -@@ -542,6 +551,14 @@ static inline void iwl_enable_interrupts(struct iwl_trans *trans) - } - } - -+static inline void iwl_enable_interrupts(struct iwl_trans *trans) -+{ -+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); -+ -+ spin_lock(&trans_pcie->irq_lock); -+ _iwl_enable_interrupts(trans); -+ spin_unlock(&trans_pcie->irq_lock); -+} - static inline void iwl_enable_hw_int_msk_msix(struct iwl_trans *trans, u32 msk) - { - struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c -index 0a4a3c5..aaaf2ad 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c -@@ -1507,7 +1507,7 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id) - * have anything to service - */ - if (test_bit(STATUS_INT_ENABLED, &trans->status)) -- iwl_enable_interrupts(trans); -+ _iwl_enable_interrupts(trans); - spin_unlock(&trans_pcie->irq_lock); - lock_map_release(&trans->sync_cmd_lockdep_map); - return IRQ_NONE; -@@ -1699,15 +1699,17 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id) - inta & ~trans_pcie->inta_mask); - } - -+ spin_lock(&trans_pcie->irq_lock); -+ /* only Re-enable all interrupt if disabled by irq */ -+ if (test_bit(STATUS_INT_ENABLED, &trans->status)) -+ _iwl_enable_interrupts(trans); - /* we are loading the firmware, enable FH_TX interrupt only */ -- if (handled & CSR_INT_BIT_FH_TX) -+ else if (handled & CSR_INT_BIT_FH_TX) - iwl_enable_fw_load_int(trans); -- /* only Re-enable all interrupt if disabled by irq */ -- else if (test_bit(STATUS_INT_ENABLED, &trans->status)) -- iwl_enable_interrupts(trans); - /* Re-enable RF_KILL if it occurred */ - else if (handled & CSR_INT_BIT_RF_KILL) - iwl_enable_rfkill_int(trans); -+ spin_unlock(&trans_pcie->irq_lock); - - out: - lock_map_release(&trans->sync_cmd_lockdep_map); -@@ -1771,7 +1773,7 @@ void iwl_pcie_reset_ict(struct iwl_trans *trans) - return; - - spin_lock(&trans_pcie->irq_lock); -- iwl_disable_interrupts(trans); -+ _iwl_disable_interrupts(trans); - - memset(trans_pcie->ict_tbl, 0, ICT_SIZE); - -@@ -1787,7 +1789,7 @@ void iwl_pcie_reset_ict(struct iwl_trans *trans) - trans_pcie->use_ict = true; - trans_pcie->ict_index = 0; - iwl_write32(trans, CSR_INT, trans_pcie->inta_mask); -- iwl_enable_interrupts(trans); -+ _iwl_enable_interrupts(trans); - spin_unlock(&trans_pcie->irq_lock); - } - -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -index f603d78..d9f1394 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -@@ -801,6 +801,8 @@ static int iwl_pcie_load_cpu_sections_8000(struct iwl_trans *trans, - - *first_ucode_section = last_read_idx; - -+ iwl_enable_interrupts(trans); -+ - if (cpu == 1) - iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFF); - else -@@ -980,6 +982,8 @@ static int iwl_pcie_load_given_ucode(struct iwl_trans *trans, - iwl_pcie_apply_destination(trans); - } - -+ iwl_enable_interrupts(trans); -+ - /* release CPU reset */ - iwl_write32(trans, CSR_RESET, 0); - -@@ -1033,9 +1037,7 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power) - was_hw_rfkill = iwl_is_rfkill_set(trans); - - /* tell the device to stop sending interrupts */ -- spin_lock(&trans_pcie->irq_lock); - iwl_disable_interrupts(trans); -- spin_unlock(&trans_pcie->irq_lock); - - /* device going down, Stop using ICT table */ - iwl_pcie_disable_ict(trans); -@@ -1079,9 +1081,7 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power) - * the time, unless the interrupt is ACKed even if the interrupt - * should be masked. Re-ACK all the interrupts here. - */ -- spin_lock(&trans_pcie->irq_lock); - iwl_disable_interrupts(trans); -- spin_unlock(&trans_pcie->irq_lock); - - /* clear all status bits */ - clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status); -@@ -1215,7 +1215,6 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans, - ret = iwl_pcie_load_given_ucode_8000(trans, fw); - else - ret = iwl_pcie_load_given_ucode(trans, fw); -- iwl_enable_interrupts(trans); - - /* re-check RF-Kill state since we may have missed the interrupt */ - hw_rfkill = iwl_is_rfkill_set(trans); -@@ -1567,15 +1566,11 @@ static void iwl_trans_pcie_op_mode_leave(struct iwl_trans *trans) - mutex_lock(&trans_pcie->mutex); - - /* disable interrupts - don't enable HW RF kill interrupt */ -- spin_lock(&trans_pcie->irq_lock); - iwl_disable_interrupts(trans); -- spin_unlock(&trans_pcie->irq_lock); - - iwl_pcie_apm_stop(trans, true); - -- spin_lock(&trans_pcie->irq_lock); - iwl_disable_interrupts(trans); -- spin_unlock(&trans_pcie->irq_lock); - - iwl_pcie_disable_ict(trans); - -diff --git a/drivers/of/base.c b/drivers/of/base.c -index ebf84e3..8bb3d1a 100644 ---- a/drivers/of/base.c -+++ b/drivers/of/base.c -@@ -112,6 +112,7 @@ static ssize_t of_node_property_read(struct file *filp, struct kobject *kobj, - return memory_read_from_buffer(buf, count, &offset, pp->value, pp->length); - } - -+/* always return newly allocated name, caller must free after use */ - static const char *safe_name(struct kobject *kobj, const char *orig_name) - { - const char *name = orig_name; -@@ -126,9 +127,12 @@ static const char *safe_name(struct kobject *kobj, const char *orig_name) - name = kasprintf(GFP_KERNEL, "%s#%i", orig_name, ++i); - } - -- if (name != orig_name) -+ if (name == orig_name) { -+ name = kstrdup(orig_name, GFP_KERNEL); -+ } else { - pr_warn("device-tree: Duplicate name in %s, renamed to \"%s\"\n", - kobject_name(kobj), name); -+ } - return name; - } - -@@ -159,6 +163,7 @@ int __of_add_property_sysfs(struct device_node *np, struct property *pp) - int __of_attach_node_sysfs(struct device_node *np) - { - const char *name; -+ struct kobject *parent; - struct property *pp; - int rc; - -@@ -171,15 +176,16 @@ int __of_attach_node_sysfs(struct device_node *np) - np->kobj.kset = of_kset; - if (!np->parent) { - /* Nodes without parents are new top level trees */ -- rc = kobject_add(&np->kobj, NULL, "%s", -- safe_name(&of_kset->kobj, "base")); -+ name = safe_name(&of_kset->kobj, "base"); -+ parent = NULL; - } else { - name = safe_name(&np->parent->kobj, kbasename(np->full_name)); -- if (!name || !name[0]) -- return -EINVAL; -- -- rc = kobject_add(&np->kobj, &np->parent->kobj, "%s", name); -+ parent = &np->parent->kobj; - } -+ if (!name) -+ return -ENOMEM; -+ rc = kobject_add(&np->kobj, parent, "%s", name); -+ kfree(name); - if (rc) - return rc; - -@@ -1815,6 +1821,12 @@ int __of_remove_property(struct device_node *np, struct property *prop) - return 0; - } - -+void __of_sysfs_remove_bin_file(struct device_node *np, struct property *prop) -+{ -+ sysfs_remove_bin_file(&np->kobj, &prop->attr); -+ kfree(prop->attr.attr.name); -+} -+ - void __of_remove_property_sysfs(struct device_node *np, struct property *prop) - { - if (!IS_ENABLED(CONFIG_SYSFS)) -@@ -1822,7 +1834,7 @@ void __of_remove_property_sysfs(struct device_node *np, struct property *prop) - - /* at early boot, bail here and defer setup to of_init() */ - if (of_kset && of_node_is_attached(np)) -- sysfs_remove_bin_file(&np->kobj, &prop->attr); -+ __of_sysfs_remove_bin_file(np, prop); - } - - /** -@@ -1895,7 +1907,7 @@ void __of_update_property_sysfs(struct device_node *np, struct property *newprop - return; - - if (oldprop) -- sysfs_remove_bin_file(&np->kobj, &oldprop->attr); -+ __of_sysfs_remove_bin_file(np, oldprop); - __of_add_property_sysfs(np, newprop); - } - -diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c -index 3033fa3..a201559 100644 ---- a/drivers/of/dynamic.c -+++ b/drivers/of/dynamic.c -@@ -55,7 +55,7 @@ void __of_detach_node_sysfs(struct device_node *np) - /* only remove properties if on sysfs */ - if (of_node_is_attached(np)) { - for_each_property_of_node(np, pp) -- sysfs_remove_bin_file(&np->kobj, &pp->attr); -+ __of_sysfs_remove_bin_file(np, pp); - kobject_del(&np->kobj); - } - -diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h -index 829469f..18bbb451 100644 ---- a/drivers/of/of_private.h -+++ b/drivers/of/of_private.h -@@ -83,6 +83,9 @@ extern int __of_attach_node_sysfs(struct device_node *np); - extern void __of_detach_node(struct device_node *np); - extern void __of_detach_node_sysfs(struct device_node *np); - -+extern void __of_sysfs_remove_bin_file(struct device_node *np, -+ struct property *prop); -+ - /* iterators for transactions, used for overlays */ - /* forward iterator */ - #define for_each_transaction_entry(_oft, _te) \ -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index ee72ebe..7902fbf 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -3189,13 +3189,15 @@ static void quirk_no_bus_reset(struct pci_dev *dev) - } - - /* -- * Atheros AR93xx chips do not behave after a bus reset. The device will -- * throw a Link Down error on AER-capable systems and regardless of AER, -- * config space of the device is never accessible again and typically -- * causes the system to hang or reset when access is attempted. -+ * Some Atheros AR9xxx and QCA988x chips do not behave after a bus reset. -+ * The device will throw a Link Down error on AER-capable systems and -+ * regardless of AER, config space of the device is never accessible again -+ * and typically causes the system to hang or reset when access is attempted. - * http://www.spinics.net/lists/linux-pci/msg34797.html - */ - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset); -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset); -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset); - - static void quirk_no_pm_reset(struct pci_dev *dev) - { -diff --git a/drivers/phy/phy-rcar-gen3-usb2.c b/drivers/phy/phy-rcar-gen3-usb2.c -index 4be3f5d..31156c9 100644 ---- a/drivers/phy/phy-rcar-gen3-usb2.c -+++ b/drivers/phy/phy-rcar-gen3-usb2.c -@@ -21,6 +21,7 @@ - #include <linux/phy/phy.h> - #include <linux/platform_device.h> - #include <linux/regulator/consumer.h> -+#include <linux/workqueue.h> - - /******* USB2.0 Host registers (original offset is +0x200) *******/ - #define USB2_INT_ENABLE 0x000 -@@ -81,9 +82,25 @@ struct rcar_gen3_chan { - struct extcon_dev *extcon; - struct phy *phy; - struct regulator *vbus; -+ struct work_struct work; -+ bool extcon_host; - bool has_otg; - }; - -+static void rcar_gen3_phy_usb2_work(struct work_struct *work) -+{ -+ struct rcar_gen3_chan *ch = container_of(work, struct rcar_gen3_chan, -+ work); -+ -+ if (ch->extcon_host) { -+ extcon_set_cable_state_(ch->extcon, EXTCON_USB_HOST, true); -+ extcon_set_cable_state_(ch->extcon, EXTCON_USB, false); -+ } else { -+ extcon_set_cable_state_(ch->extcon, EXTCON_USB_HOST, false); -+ extcon_set_cable_state_(ch->extcon, EXTCON_USB, true); -+ } -+} -+ - static void rcar_gen3_set_host_mode(struct rcar_gen3_chan *ch, int host) - { - void __iomem *usb2_base = ch->base; -@@ -130,8 +147,8 @@ static void rcar_gen3_init_for_host(struct rcar_gen3_chan *ch) - rcar_gen3_set_host_mode(ch, 1); - rcar_gen3_enable_vbus_ctrl(ch, 1); - -- extcon_set_cable_state_(ch->extcon, EXTCON_USB_HOST, true); -- extcon_set_cable_state_(ch->extcon, EXTCON_USB, false); -+ ch->extcon_host = true; -+ schedule_work(&ch->work); - } - - static void rcar_gen3_init_for_peri(struct rcar_gen3_chan *ch) -@@ -140,8 +157,8 @@ static void rcar_gen3_init_for_peri(struct rcar_gen3_chan *ch) - rcar_gen3_set_host_mode(ch, 0); - rcar_gen3_enable_vbus_ctrl(ch, 0); - -- extcon_set_cable_state_(ch->extcon, EXTCON_USB_HOST, false); -- extcon_set_cable_state_(ch->extcon, EXTCON_USB, true); -+ ch->extcon_host = false; -+ schedule_work(&ch->work); - } - - static bool rcar_gen3_check_id(struct rcar_gen3_chan *ch) -@@ -301,6 +318,7 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) - if (irq >= 0) { - int ret; - -+ INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work); - irq = devm_request_irq(dev, irq, rcar_gen3_phy_usb2_irq, - IRQF_SHARED, dev_name(dev), channel); - if (irq < 0) -diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c -index ac4f564..bf65c94 100644 ---- a/drivers/pinctrl/intel/pinctrl-cherryview.c -+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c -@@ -160,7 +160,6 @@ struct chv_pin_context { - * @pctldev: Pointer to the pin controller device - * @chip: GPIO chip in this pin controller - * @regs: MMIO registers -- * @lock: Lock to serialize register accesses - * @intr_lines: Stores mapping between 16 HW interrupt wires and GPIO - * offset (in GPIO number space) - * @community: Community this pinctrl instance represents -@@ -174,7 +173,6 @@ struct chv_pinctrl { - struct pinctrl_dev *pctldev; - struct gpio_chip chip; - void __iomem *regs; -- raw_spinlock_t lock; - unsigned intr_lines[16]; - const struct chv_community *community; - u32 saved_intmask; -@@ -657,6 +655,17 @@ static const struct chv_community *chv_communities[] = { - &southeast_community, - }; - -+/* -+ * Lock to serialize register accesses -+ * -+ * Due to a silicon issue, a shared lock must be used to prevent -+ * concurrent accesses across the 4 GPIO controllers. -+ * -+ * See Intel Atom Z8000 Processor Series Specification Update (Rev. 005), -+ * errata #CHT34, for further information. -+ */ -+static DEFINE_RAW_SPINLOCK(chv_lock); -+ - static void __iomem *chv_padreg(struct chv_pinctrl *pctrl, unsigned offset, - unsigned reg) - { -@@ -718,13 +727,13 @@ static void chv_pin_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *s, - u32 ctrl0, ctrl1; - bool locked; - -- raw_spin_lock_irqsave(&pctrl->lock, flags); -+ raw_spin_lock_irqsave(&chv_lock, flags); - - ctrl0 = readl(chv_padreg(pctrl, offset, CHV_PADCTRL0)); - ctrl1 = readl(chv_padreg(pctrl, offset, CHV_PADCTRL1)); - locked = chv_pad_locked(pctrl, offset); - -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - - if (ctrl0 & CHV_PADCTRL0_GPIOEN) { - seq_puts(s, "GPIO "); -@@ -787,14 +796,14 @@ static int chv_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned function, - - grp = &pctrl->community->groups[group]; - -- raw_spin_lock_irqsave(&pctrl->lock, flags); -+ raw_spin_lock_irqsave(&chv_lock, flags); - - /* Check first that the pad is not locked */ - for (i = 0; i < grp->npins; i++) { - if (chv_pad_locked(pctrl, grp->pins[i])) { - dev_warn(pctrl->dev, "unable to set mode for locked pin %u\n", - grp->pins[i]); -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - return -EBUSY; - } - } -@@ -837,7 +846,7 @@ static int chv_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned function, - pin, altfunc->mode, altfunc->invert_oe ? "" : "not "); - } - -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - - return 0; - } -@@ -851,13 +860,13 @@ static int chv_gpio_request_enable(struct pinctrl_dev *pctldev, - void __iomem *reg; - u32 value; - -- raw_spin_lock_irqsave(&pctrl->lock, flags); -+ raw_spin_lock_irqsave(&chv_lock, flags); - - if (chv_pad_locked(pctrl, offset)) { - value = readl(chv_padreg(pctrl, offset, CHV_PADCTRL0)); - if (!(value & CHV_PADCTRL0_GPIOEN)) { - /* Locked so cannot enable */ -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - return -EBUSY; - } - } else { -@@ -897,7 +906,7 @@ static int chv_gpio_request_enable(struct pinctrl_dev *pctldev, - chv_writel(value, reg); - } - -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - - return 0; - } -@@ -911,13 +920,13 @@ static void chv_gpio_disable_free(struct pinctrl_dev *pctldev, - void __iomem *reg; - u32 value; - -- raw_spin_lock_irqsave(&pctrl->lock, flags); -+ raw_spin_lock_irqsave(&chv_lock, flags); - - reg = chv_padreg(pctrl, offset, CHV_PADCTRL0); - value = readl(reg) & ~CHV_PADCTRL0_GPIOEN; - chv_writel(value, reg); - -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - } - - static int chv_gpio_set_direction(struct pinctrl_dev *pctldev, -@@ -929,7 +938,7 @@ static int chv_gpio_set_direction(struct pinctrl_dev *pctldev, - unsigned long flags; - u32 ctrl0; - -- raw_spin_lock_irqsave(&pctrl->lock, flags); -+ raw_spin_lock_irqsave(&chv_lock, flags); - - ctrl0 = readl(reg) & ~CHV_PADCTRL0_GPIOCFG_MASK; - if (input) -@@ -938,7 +947,7 @@ static int chv_gpio_set_direction(struct pinctrl_dev *pctldev, - ctrl0 |= CHV_PADCTRL0_GPIOCFG_GPO << CHV_PADCTRL0_GPIOCFG_SHIFT; - chv_writel(ctrl0, reg); - -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - - return 0; - } -@@ -963,10 +972,10 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned pin, - u16 arg = 0; - u32 term; - -- raw_spin_lock_irqsave(&pctrl->lock, flags); -+ raw_spin_lock_irqsave(&chv_lock, flags); - ctrl0 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0)); - ctrl1 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL1)); -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - - term = (ctrl0 & CHV_PADCTRL0_TERM_MASK) >> CHV_PADCTRL0_TERM_SHIFT; - -@@ -1040,7 +1049,7 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin, - unsigned long flags; - u32 ctrl0, pull; - -- raw_spin_lock_irqsave(&pctrl->lock, flags); -+ raw_spin_lock_irqsave(&chv_lock, flags); - ctrl0 = readl(reg); - - switch (param) { -@@ -1063,7 +1072,7 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin, - pull = CHV_PADCTRL0_TERM_20K << CHV_PADCTRL0_TERM_SHIFT; - break; - default: -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - return -EINVAL; - } - -@@ -1081,7 +1090,7 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin, - pull = CHV_PADCTRL0_TERM_20K << CHV_PADCTRL0_TERM_SHIFT; - break; - default: -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - return -EINVAL; - } - -@@ -1089,12 +1098,12 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin, - break; - - default: -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - return -EINVAL; - } - - chv_writel(ctrl0, reg); -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - - return 0; - } -@@ -1160,9 +1169,9 @@ static int chv_gpio_get(struct gpio_chip *chip, unsigned offset) - unsigned long flags; - u32 ctrl0, cfg; - -- raw_spin_lock_irqsave(&pctrl->lock, flags); -+ raw_spin_lock_irqsave(&chv_lock, flags); - ctrl0 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0)); -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - - cfg = ctrl0 & CHV_PADCTRL0_GPIOCFG_MASK; - cfg >>= CHV_PADCTRL0_GPIOCFG_SHIFT; -@@ -1180,7 +1189,7 @@ static void chv_gpio_set(struct gpio_chip *chip, unsigned offset, int value) - void __iomem *reg; - u32 ctrl0; - -- raw_spin_lock_irqsave(&pctrl->lock, flags); -+ raw_spin_lock_irqsave(&chv_lock, flags); - - reg = chv_padreg(pctrl, pin, CHV_PADCTRL0); - ctrl0 = readl(reg); -@@ -1192,7 +1201,7 @@ static void chv_gpio_set(struct gpio_chip *chip, unsigned offset, int value) - - chv_writel(ctrl0, reg); - -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - } - - static int chv_gpio_get_direction(struct gpio_chip *chip, unsigned offset) -@@ -1202,9 +1211,9 @@ static int chv_gpio_get_direction(struct gpio_chip *chip, unsigned offset) - u32 ctrl0, direction; - unsigned long flags; - -- raw_spin_lock_irqsave(&pctrl->lock, flags); -+ raw_spin_lock_irqsave(&chv_lock, flags); - ctrl0 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0)); -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - - direction = ctrl0 & CHV_PADCTRL0_GPIOCFG_MASK; - direction >>= CHV_PADCTRL0_GPIOCFG_SHIFT; -@@ -1242,14 +1251,14 @@ static void chv_gpio_irq_ack(struct irq_data *d) - int pin = chv_gpio_offset_to_pin(pctrl, irqd_to_hwirq(d)); - u32 intr_line; - -- raw_spin_lock(&pctrl->lock); -+ raw_spin_lock(&chv_lock); - - intr_line = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0)); - intr_line &= CHV_PADCTRL0_INTSEL_MASK; - intr_line >>= CHV_PADCTRL0_INTSEL_SHIFT; - chv_writel(BIT(intr_line), pctrl->regs + CHV_INTSTAT); - -- raw_spin_unlock(&pctrl->lock); -+ raw_spin_unlock(&chv_lock); - } - - static void chv_gpio_irq_mask_unmask(struct irq_data *d, bool mask) -@@ -1260,7 +1269,7 @@ static void chv_gpio_irq_mask_unmask(struct irq_data *d, bool mask) - u32 value, intr_line; - unsigned long flags; - -- raw_spin_lock_irqsave(&pctrl->lock, flags); -+ raw_spin_lock_irqsave(&chv_lock, flags); - - intr_line = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0)); - intr_line &= CHV_PADCTRL0_INTSEL_MASK; -@@ -1273,7 +1282,7 @@ static void chv_gpio_irq_mask_unmask(struct irq_data *d, bool mask) - value |= BIT(intr_line); - chv_writel(value, pctrl->regs + CHV_INTMASK); - -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - } - - static void chv_gpio_irq_mask(struct irq_data *d) -@@ -1307,7 +1316,7 @@ static unsigned chv_gpio_irq_startup(struct irq_data *d) - unsigned long flags; - u32 intsel, value; - -- raw_spin_lock_irqsave(&pctrl->lock, flags); -+ raw_spin_lock_irqsave(&chv_lock, flags); - intsel = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0)); - intsel &= CHV_PADCTRL0_INTSEL_MASK; - intsel >>= CHV_PADCTRL0_INTSEL_SHIFT; -@@ -1322,7 +1331,7 @@ static unsigned chv_gpio_irq_startup(struct irq_data *d) - irq_set_handler_locked(d, handler); - pctrl->intr_lines[intsel] = offset; - } -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - } - - chv_gpio_irq_unmask(d); -@@ -1338,7 +1347,7 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned type) - unsigned long flags; - u32 value; - -- raw_spin_lock_irqsave(&pctrl->lock, flags); -+ raw_spin_lock_irqsave(&chv_lock, flags); - - /* - * Pins which can be used as shared interrupt are configured in -@@ -1387,7 +1396,7 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned type) - else if (type & IRQ_TYPE_LEVEL_MASK) - irq_set_handler_locked(d, handle_level_irq); - -- raw_spin_unlock_irqrestore(&pctrl->lock, flags); -+ raw_spin_unlock_irqrestore(&chv_lock, flags); - - return 0; - } -@@ -1499,7 +1508,6 @@ static int chv_pinctrl_probe(struct platform_device *pdev) - if (i == ARRAY_SIZE(chv_communities)) - return -ENODEV; - -- raw_spin_lock_init(&pctrl->lock); - pctrl->dev = &pdev->dev; - - #ifdef CONFIG_PM_SLEEP -diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c -index 6f145f2..96ffda4 100644 ---- a/drivers/platform/x86/hp-wmi.c -+++ b/drivers/platform/x86/hp-wmi.c -@@ -718,6 +718,11 @@ static int __init hp_wmi_rfkill_setup(struct platform_device *device) - if (err) - return err; - -+ err = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, &wireless, -+ sizeof(wireless), 0); -+ if (err) -+ return err; -+ - if (wireless & 0x1) { - wifi_rfkill = rfkill_alloc("hp-wifi", &device->dev, - RFKILL_TYPE_WLAN, -@@ -882,7 +887,7 @@ static int __init hp_wmi_bios_setup(struct platform_device *device) - wwan_rfkill = NULL; - rfkill2_count = 0; - -- if (hp_wmi_bios_2009_later() || hp_wmi_rfkill_setup(device)) -+ if (hp_wmi_rfkill_setup(device)) - hp_wmi_rfkill2_setup(device); - - err = device_create_file(&device->dev, &dev_attr_display); -diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c -index 02fb6b4..d838e77 100644 ---- a/drivers/regulator/s2mps11.c -+++ b/drivers/regulator/s2mps11.c -@@ -750,7 +750,7 @@ static const struct regulator_linear_range s2mps15_ldo_voltage_ranges3[] = { - - /* voltage range for s2mps15 LDO 7, 8, 9 and 10 */ - static const struct regulator_linear_range s2mps15_ldo_voltage_ranges4[] = { -- REGULATOR_LINEAR_RANGE(700000, 0xc, 0x18, 25000), -+ REGULATOR_LINEAR_RANGE(700000, 0x10, 0x20, 25000), - }; - - /* voltage range for s2mps15 LDO 1 */ -@@ -760,12 +760,12 @@ static const struct regulator_linear_range s2mps15_ldo_voltage_ranges5[] = { - - /* voltage range for s2mps15 BUCK 1, 2, 3, 4, 5, 6 and 7 */ - static const struct regulator_linear_range s2mps15_buck_voltage_ranges1[] = { -- REGULATOR_LINEAR_RANGE(500000, 0x20, 0xb0, 6250), -+ REGULATOR_LINEAR_RANGE(500000, 0x20, 0xc0, 6250), - }; - - /* voltage range for s2mps15 BUCK 8, 9 and 10 */ - static const struct regulator_linear_range s2mps15_buck_voltage_ranges2[] = { -- REGULATOR_LINEAR_RANGE(1000000, 0x20, 0xc0, 12500), -+ REGULATOR_LINEAR_RANGE(1000000, 0x20, 0x78, 12500), - }; - - static const struct regulator_desc s2mps15_regulators[] = { -diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c -index db3958b..fe0539e 100644 ---- a/drivers/remoteproc/remoteproc_core.c -+++ b/drivers/remoteproc/remoteproc_core.c -@@ -1264,11 +1264,6 @@ int rproc_add(struct rproc *rproc) - if (ret < 0) - return ret; - -- /* expose to rproc_get_by_phandle users */ -- mutex_lock(&rproc_list_mutex); -- list_add(&rproc->node, &rproc_list); -- mutex_unlock(&rproc_list_mutex); -- - dev_info(dev, "%s is available\n", rproc->name); - - dev_info(dev, "Note: remoteproc is still under development and considered experimental.\n"); -@@ -1276,8 +1271,16 @@ int rproc_add(struct rproc *rproc) - - /* create debugfs entries */ - rproc_create_debug_dir(rproc); -+ ret = rproc_add_virtio_devices(rproc); -+ if (ret < 0) -+ return ret; - -- return rproc_add_virtio_devices(rproc); -+ /* expose to rproc_get_by_phandle users */ -+ mutex_lock(&rproc_list_mutex); -+ list_add(&rproc->node, &rproc_list); -+ mutex_unlock(&rproc_list_mutex); -+ -+ return 0; - } - EXPORT_SYMBOL(rproc_add); - -diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c -index d01ad7e..4e823c4 100644 ---- a/drivers/rtc/rtc-s3c.c -+++ b/drivers/rtc/rtc-s3c.c -@@ -149,12 +149,14 @@ static int s3c_rtc_setfreq(struct s3c_rtc *info, int freq) - if (!is_power_of_2(freq)) - return -EINVAL; - -+ s3c_rtc_enable_clk(info); - spin_lock_irq(&info->pie_lock); - - if (info->data->set_freq) - info->data->set_freq(info, freq); - - spin_unlock_irq(&info->pie_lock); -+ s3c_rtc_disable_clk(info); - - return 0; - } -diff --git a/drivers/s390/cio/cmf.c b/drivers/s390/cio/cmf.c -index b2afad5..2a34eb5 100644 ---- a/drivers/s390/cio/cmf.c -+++ b/drivers/s390/cio/cmf.c -@@ -753,6 +753,17 @@ static void reset_cmb(struct ccw_device *cdev) - cmf_generic_reset(cdev); - } - -+static int cmf_enabled(struct ccw_device *cdev) -+{ -+ int enabled; -+ -+ spin_lock_irq(cdev->ccwlock); -+ enabled = !!cdev->private->cmb; -+ spin_unlock_irq(cdev->ccwlock); -+ -+ return enabled; -+} -+ - static struct attribute_group cmf_attr_group; - - static struct cmb_operations cmbops_basic = { -@@ -1153,13 +1164,8 @@ static ssize_t cmb_enable_show(struct device *dev, - char *buf) - { - struct ccw_device *cdev = to_ccwdev(dev); -- int enabled; - -- spin_lock_irq(cdev->ccwlock); -- enabled = !!cdev->private->cmb; -- spin_unlock_irq(cdev->ccwlock); -- -- return sprintf(buf, "%d\n", enabled); -+ return sprintf(buf, "%d\n", cmf_enabled(cdev)); - } - - static ssize_t cmb_enable_store(struct device *dev, -@@ -1199,15 +1205,20 @@ int ccw_set_cmf(struct ccw_device *cdev, int enable) - * @cdev: The ccw device to be enabled - * - * Returns %0 for success or a negative error value. -- * -+ * Note: If this is called on a device for which channel measurement is already -+ * enabled a reset of the measurement data is triggered. - * Context: - * non-atomic - */ - int enable_cmf(struct ccw_device *cdev) - { -- int ret; -+ int ret = 0; - - device_lock(&cdev->dev); -+ if (cmf_enabled(cdev)) { -+ cmbops->reset(cdev); -+ goto out_unlock; -+ } - get_device(&cdev->dev); - ret = cmbops->alloc(cdev); - if (ret) -@@ -1226,7 +1237,7 @@ int enable_cmf(struct ccw_device *cdev) - out: - if (ret) - put_device(&cdev->dev); -- -+out_unlock: - device_unlock(&cdev->dev); - return ret; - } -diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index 3bd0be6..c7e5695 100644 ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -3874,7 +3874,7 @@ int lpfc_sli4_scmd_to_wqidx_distr(struct lpfc_hba *phba, - uint32_t tag; - uint16_t hwq; - -- if (shost_use_blk_mq(cmnd->device->host)) { -+ if (cmnd && shost_use_blk_mq(cmnd->device->host)) { - tag = blk_mq_unique_tag(cmnd->request); - hwq = blk_mq_unique_tag_to_hwq(tag); - -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index f4b0690..2dab3dc 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -4079,6 +4079,12 @@ megasas_get_pd_list(struct megasas_instance *instance) - struct MR_PD_ADDRESS *pd_addr; - dma_addr_t ci_h = 0; - -+ if (instance->pd_list_not_supported) { -+ dev_info(&instance->pdev->dev, "MR_DCMD_PD_LIST_QUERY " -+ "not supported by firmware\n"); -+ return ret; -+ } -+ - cmd = megasas_get_cmd(instance); - - if (!cmd) { -diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c -index f1eed7f..9c2788b 100644 ---- a/drivers/soc/qcom/smp2p.c -+++ b/drivers/soc/qcom/smp2p.c -@@ -344,11 +344,12 @@ static int qcom_smp2p_outbound_entry(struct qcom_smp2p *smp2p, - /* Allocate an entry from the smem item */ - strlcpy(buf, entry->name, SMP2P_MAX_ENTRY_NAME); - memcpy_toio(out->entries[out->valid_entries].name, buf, SMP2P_MAX_ENTRY_NAME); -- out->valid_entries++; - - /* Make the logical entry reference the physical value */ - entry->value = &out->entries[out->valid_entries].value; - -+ out->valid_entries++; -+ - entry->state = qcom_smem_state_register(node, &smp2p_state_ops, entry); - if (IS_ERR(entry->state)) { - dev_err(smp2p->dev, "failed to register qcom_smem_state\n"); -diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c -index fe07c05..daf2844 100644 ---- a/drivers/spi/spi-pxa2xx.c -+++ b/drivers/spi/spi-pxa2xx.c -@@ -585,7 +585,14 @@ static void reset_sccr1(struct driver_data *drv_data) - u32 sccr1_reg; - - sccr1_reg = pxa2xx_spi_read(drv_data, SSCR1) & ~drv_data->int_cr1; -- sccr1_reg &= ~SSCR1_RFT; -+ switch (drv_data->ssp_type) { -+ case QUARK_X1000_SSP: -+ sccr1_reg &= ~QUARK_X1000_SSCR1_RFT; -+ break; -+ default: -+ sccr1_reg &= ~SSCR1_RFT; -+ break; -+ } - sccr1_reg |= chip->threshold; - pxa2xx_spi_write(drv_data, SSCR1, sccr1_reg); - } -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index 50f3d3a..39b928c 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -492,7 +492,8 @@ void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd) - bool scsi_cmd = (cmd->iscsi_opcode == ISCSI_OP_SCSI_CMD); - - spin_lock_bh(&conn->cmd_lock); -- if (!list_empty(&cmd->i_conn_node)) -+ if (!list_empty(&cmd->i_conn_node) && -+ !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP)) - list_del_init(&cmd->i_conn_node); - spin_unlock_bh(&conn->cmd_lock); - -@@ -4034,6 +4035,7 @@ int iscsi_target_rx_thread(void *arg) - - static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) - { -+ LIST_HEAD(tmp_list); - struct iscsi_cmd *cmd = NULL, *cmd_tmp = NULL; - struct iscsi_session *sess = conn->sess; - /* -@@ -4042,18 +4044,26 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) - * has been reset -> returned sleeping pre-handler state. - */ - spin_lock_bh(&conn->cmd_lock); -- list_for_each_entry_safe(cmd, cmd_tmp, &conn->conn_cmd_list, i_conn_node) { -+ list_splice_init(&conn->conn_cmd_list, &tmp_list); - -+ list_for_each_entry(cmd, &tmp_list, i_conn_node) { -+ struct se_cmd *se_cmd = &cmd->se_cmd; -+ -+ if (se_cmd->se_tfo != NULL) { -+ spin_lock(&se_cmd->t_state_lock); -+ se_cmd->transport_state |= CMD_T_FABRIC_STOP; -+ spin_unlock(&se_cmd->t_state_lock); -+ } -+ } -+ spin_unlock_bh(&conn->cmd_lock); -+ -+ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) { - list_del_init(&cmd->i_conn_node); -- spin_unlock_bh(&conn->cmd_lock); - - iscsit_increment_maxcmdsn(cmd, sess); -- - iscsit_free_cmd(cmd, true); - -- spin_lock_bh(&conn->cmd_lock); - } -- spin_unlock_bh(&conn->cmd_lock); - } - - static void iscsit_stop_timers_for_cmds( -diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c -index b5212f0..adf419f 100644 ---- a/drivers/target/iscsi/iscsi_target_login.c -+++ b/drivers/target/iscsi/iscsi_target_login.c -@@ -1371,8 +1371,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np) - } - login->zero_tsih = zero_tsih; - -- conn->sess->se_sess->sup_prot_ops = -- conn->conn_transport->iscsit_get_sup_prot_ops(conn); -+ if (conn->sess) -+ conn->sess->se_sess->sup_prot_ops = -+ conn->conn_transport->iscsit_get_sup_prot_ops(conn); - - tpg = conn->tpg; - if (!tpg) { -diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c -index a4046ca..6b42348 100644 ---- a/drivers/target/target_core_device.c -+++ b/drivers/target/target_core_device.c -@@ -821,13 +821,15 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) - * in ATA and we need to set TPE=1 - */ - bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib, -- struct request_queue *q, int block_size) -+ struct request_queue *q) - { -+ int block_size = queue_logical_block_size(q); -+ - if (!blk_queue_discard(q)) - return false; - -- attrib->max_unmap_lba_count = (q->limits.max_discard_sectors << 9) / -- block_size; -+ attrib->max_unmap_lba_count = -+ q->limits.max_discard_sectors >> (ilog2(block_size) - 9); - /* - * Currently hardcoded to 1 in Linux/SCSI code.. - */ -diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c -index 75f0f08..7929186 100644 ---- a/drivers/target/target_core_file.c -+++ b/drivers/target/target_core_file.c -@@ -161,8 +161,7 @@ static int fd_configure_device(struct se_device *dev) - dev_size, div_u64(dev_size, fd_dev->fd_block_size), - fd_dev->fd_block_size); - -- if (target_configure_unmap_from_queue(&dev->dev_attrib, q, -- fd_dev->fd_block_size)) -+ if (target_configure_unmap_from_queue(&dev->dev_attrib, q)) - pr_debug("IFILE: BLOCK Discard support available," - " disabled by default\n"); - /* -diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c -index 7c4efb4..2077bc2 100644 ---- a/drivers/target/target_core_iblock.c -+++ b/drivers/target/target_core_iblock.c -@@ -121,8 +121,7 @@ static int iblock_configure_device(struct se_device *dev) - dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q); - dev->dev_attrib.hw_queue_depth = q->nr_requests; - -- if (target_configure_unmap_from_queue(&dev->dev_attrib, q, -- dev->dev_attrib.hw_block_size)) -+ if (target_configure_unmap_from_queue(&dev->dev_attrib, q)) - pr_debug("IBLOCK: BLOCK Discard support available," - " disabled by default\n"); - -diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h -index fc91e85..e2c970a 100644 ---- a/drivers/target/target_core_internal.h -+++ b/drivers/target/target_core_internal.h -@@ -146,6 +146,7 @@ sense_reason_t target_cmd_size_check(struct se_cmd *cmd, unsigned int size); - void target_qf_do_work(struct work_struct *work); - bool target_check_wce(struct se_device *dev); - bool target_check_fua(struct se_device *dev); -+void __target_execute_cmd(struct se_cmd *, bool); - - /* target_core_stat.c */ - void target_stat_setup_dev_default_groups(struct se_device *); -diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c -index a9057aa..04f616b 100644 ---- a/drivers/target/target_core_sbc.c -+++ b/drivers/target/target_core_sbc.c -@@ -602,7 +602,7 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool succes - cmd->transport_state |= CMD_T_ACTIVE|CMD_T_BUSY|CMD_T_SENT; - spin_unlock_irq(&cmd->t_state_lock); - -- __target_execute_cmd(cmd); -+ __target_execute_cmd(cmd, false); - - kfree(buf); - return ret; -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 5ab3967..42c2a44 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -1303,23 +1303,6 @@ target_setup_cmd_from_cdb(struct se_cmd *cmd, unsigned char *cdb) - - trace_target_sequencer_start(cmd); - -- /* -- * Check for an existing UNIT ATTENTION condition -- */ -- ret = target_scsi3_ua_check(cmd); -- if (ret) -- return ret; -- -- ret = target_alua_state_check(cmd); -- if (ret) -- return ret; -- -- ret = target_check_reservation(cmd); -- if (ret) { -- cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT; -- return ret; -- } -- - ret = dev->transport->parse_cdb(cmd); - if (ret == TCM_UNSUPPORTED_SCSI_OPCODE) - pr_warn_ratelimited("%s/%s: Unsupported SCSI Opcode 0x%02x, sending CHECK_CONDITION.\n", -@@ -1761,20 +1744,45 @@ queue_full: - } - EXPORT_SYMBOL(transport_generic_request_failure); - --void __target_execute_cmd(struct se_cmd *cmd) -+void __target_execute_cmd(struct se_cmd *cmd, bool do_checks) - { - sense_reason_t ret; - -- if (cmd->execute_cmd) { -- ret = cmd->execute_cmd(cmd); -- if (ret) { -- spin_lock_irq(&cmd->t_state_lock); -- cmd->transport_state &= ~(CMD_T_BUSY|CMD_T_SENT); -- spin_unlock_irq(&cmd->t_state_lock); -+ if (!cmd->execute_cmd) { -+ ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; -+ goto err; -+ } -+ if (do_checks) { -+ /* -+ * Check for an existing UNIT ATTENTION condition after -+ * target_handle_task_attr() has done SAM task attr -+ * checking, and possibly have already defered execution -+ * out to target_restart_delayed_cmds() context. -+ */ -+ ret = target_scsi3_ua_check(cmd); -+ if (ret) -+ goto err; -+ -+ ret = target_alua_state_check(cmd); -+ if (ret) -+ goto err; - -- transport_generic_request_failure(cmd, ret); -+ ret = target_check_reservation(cmd); -+ if (ret) { -+ cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT; -+ goto err; - } - } -+ -+ ret = cmd->execute_cmd(cmd); -+ if (!ret) -+ return; -+err: -+ spin_lock_irq(&cmd->t_state_lock); -+ cmd->transport_state &= ~(CMD_T_BUSY|CMD_T_SENT); -+ spin_unlock_irq(&cmd->t_state_lock); -+ -+ transport_generic_request_failure(cmd, ret); - } - - static int target_write_prot_action(struct se_cmd *cmd) -@@ -1819,6 +1827,8 @@ static bool target_handle_task_attr(struct se_cmd *cmd) - if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH) - return false; - -+ cmd->se_cmd_flags |= SCF_TASK_ATTR_SET; -+ - /* - * Check for the existence of HEAD_OF_QUEUE, and if true return 1 - * to allow the passed struct se_cmd list of tasks to the front of the list. -@@ -1899,7 +1909,7 @@ void target_execute_cmd(struct se_cmd *cmd) - return; - } - -- __target_execute_cmd(cmd); -+ __target_execute_cmd(cmd, true); - } - EXPORT_SYMBOL(target_execute_cmd); - -@@ -1923,7 +1933,7 @@ static void target_restart_delayed_cmds(struct se_device *dev) - list_del(&cmd->se_delayed_node); - spin_unlock(&dev->delayed_cmd_lock); - -- __target_execute_cmd(cmd); -+ __target_execute_cmd(cmd, true); - - if (cmd->sam_task_attr == TCM_ORDERED_TAG) - break; -@@ -1941,6 +1951,9 @@ static void transport_complete_task_attr(struct se_cmd *cmd) - if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH) - return; - -+ if (!(cmd->se_cmd_flags & SCF_TASK_ATTR_SET)) -+ goto restart; -+ - if (cmd->sam_task_attr == TCM_SIMPLE_TAG) { - atomic_dec_mb(&dev->simple_cmds); - dev->dev_cur_ordered_id++; -@@ -1957,7 +1970,7 @@ static void transport_complete_task_attr(struct se_cmd *cmd) - pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n", - dev->dev_cur_ordered_id); - } -- -+restart: - target_restart_delayed_cmds(dev); - } - -@@ -2557,15 +2570,10 @@ static void target_release_cmd_kref(struct kref *kref) - bool fabric_stop; - - spin_lock_irqsave(&se_sess->sess_cmd_lock, flags); -- if (list_empty(&se_cmd->se_cmd_list)) { -- spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); -- target_free_cmd_mem(se_cmd); -- se_cmd->se_tfo->release_cmd(se_cmd); -- return; -- } - - spin_lock(&se_cmd->t_state_lock); -- fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP); -+ fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP) && -+ (se_cmd->transport_state & CMD_T_ABORTED); - spin_unlock(&se_cmd->t_state_lock); - - if (se_cmd->cmd_wait_set || fabric_stop) { -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index 954941d..f9c798c 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -482,19 +482,21 @@ static void atmel_start_tx(struct uart_port *port) - { - struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); - -- if (atmel_use_pdc_tx(port)) { -- if (atmel_uart_readl(port, ATMEL_PDC_PTSR) & ATMEL_PDC_TXTEN) -- /* The transmitter is already running. Yes, we -- really need this.*/ -- return; -+ if (atmel_use_pdc_tx(port) && (atmel_uart_readl(port, ATMEL_PDC_PTSR) -+ & ATMEL_PDC_TXTEN)) -+ /* The transmitter is already running. Yes, we -+ really need this.*/ -+ return; - -+ if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port)) - if ((port->rs485.flags & SER_RS485_ENABLED) && - !(port->rs485.flags & SER_RS485_RX_DURING_TX)) - atmel_stop_rx(port); - -+ if (atmel_use_pdc_tx(port)) - /* re-enable PDC transmit */ - atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTEN); -- } -+ - /* Enable interrupts */ - atmel_uart_writel(port, ATMEL_US_IER, atmel_port->tx_done_mask); - } -diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c -index b7d80bd..7d62610 100644 ---- a/drivers/tty/serial/msm_serial.c -+++ b/drivers/tty/serial/msm_serial.c -@@ -726,7 +726,7 @@ static void msm_handle_tx(struct uart_port *port) - return; - } - -- pio_count = CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE); -+ pio_count = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE); - dma_count = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE); - - dma_min = 1; /* Always DMA */ -diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c -index 99bb231..f0bd2ec 100644 ---- a/drivers/tty/serial/samsung.c -+++ b/drivers/tty/serial/samsung.c -@@ -1684,7 +1684,7 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport, - return -ENODEV; - - if (port->mapbase != 0) -- return 0; -+ return -EINVAL; - - /* setup info for port */ - port->dev = &platdev->dev; -@@ -1738,22 +1738,25 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport, - ourport->dma = devm_kzalloc(port->dev, - sizeof(*ourport->dma), - GFP_KERNEL); -- if (!ourport->dma) -- return -ENOMEM; -+ if (!ourport->dma) { -+ ret = -ENOMEM; -+ goto err; -+ } - } - - ourport->clk = clk_get(&platdev->dev, "uart"); - if (IS_ERR(ourport->clk)) { - pr_err("%s: Controller clock not found\n", - dev_name(&platdev->dev)); -- return PTR_ERR(ourport->clk); -+ ret = PTR_ERR(ourport->clk); -+ goto err; - } - - ret = clk_prepare_enable(ourport->clk); - if (ret) { - pr_err("uart: clock failed to prepare+enable: %d\n", ret); - clk_put(ourport->clk); -- return ret; -+ goto err; - } - - /* Keep all interrupts masked and cleared */ -@@ -1769,7 +1772,12 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport, - - /* reset the fifos (and setup the uart) */ - s3c24xx_serial_resetport(port, cfg); -+ - return 0; -+ -+err: -+ port->mapbase = 0; -+ return ret; - } - - /* Device driver serial port probe */ -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 944a6dc..d2e50a2 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -128,6 +128,9 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x04f3, 0x016f), .driver_info = - USB_QUIRK_DEVICE_QUALIFIER }, - -+ { USB_DEVICE(0x04f3, 0x0381), .driver_info = -+ USB_QUIRK_NO_LPM }, -+ - { USB_DEVICE(0x04f3, 0x21b8), .driver_info = - USB_QUIRK_DEVICE_QUALIFIER }, - -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 07248ff..716f4f0 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -258,11 +258,13 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep, - * We will also set SUSPHY bit to what it was before returning as stated - * by the same section on Synopsys databook. - */ -- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)); -- if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) { -- susphy = true; -- reg &= ~DWC3_GUSB2PHYCFG_SUSPHY; -- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg); -+ if (dwc->gadget.speed <= USB_SPEED_HIGH) { -+ reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)); -+ if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) { -+ susphy = true; -+ reg &= ~DWC3_GUSB2PHYCFG_SUSPHY; -+ dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg); -+ } - } - - if (cmd == DWC3_DEPCMD_STARTTRANSFER) { -@@ -2023,6 +2025,10 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep, - return 1; - } - -+ if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) -+ if ((event->status & DEPEVT_STATUS_IOC) && -+ (trb->ctrl & DWC3_TRB_CTRL_IOC)) -+ return 0; - return 1; - } - -diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c -index 18569de..bb1f6c8 100644 ---- a/drivers/usb/gadget/udc/atmel_usba_udc.c -+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c -@@ -1920,6 +1920,8 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev, - - udc->errata = match->data; - udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9g45-pmc"); -+ if (IS_ERR(udc->pmc)) -+ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9x5-pmc"); - if (udc->errata && IS_ERR(udc->pmc)) - return ERR_CAST(udc->pmc); - -diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c -index ebc51ec..7175142 100644 ---- a/drivers/usb/gadget/udc/pch_udc.c -+++ b/drivers/usb/gadget/udc/pch_udc.c -@@ -1477,11 +1477,11 @@ static void complete_req(struct pch_udc_ep *ep, struct pch_udc_request *req, - req->dma_mapped = 0; - } - ep->halted = 1; -- spin_lock(&dev->lock); -+ spin_unlock(&dev->lock); - if (!ep->in) - pch_udc_ep_clear_rrdy(ep); - usb_gadget_giveback_request(&ep->ep, &req->req); -- spin_unlock(&dev->lock); -+ spin_lock(&dev->lock); - ep->halted = halted; - } - -@@ -2573,9 +2573,9 @@ static void pch_udc_svc_ur_interrupt(struct pch_udc_dev *dev) - empty_req_queue(ep); - } - if (dev->driver) { -- spin_lock(&dev->lock); -- usb_gadget_udc_reset(&dev->gadget, dev->driver); - spin_unlock(&dev->lock); -+ usb_gadget_udc_reset(&dev->gadget, dev->driver); -+ spin_lock(&dev->lock); - } - } - -@@ -2654,9 +2654,9 @@ static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev) - dev->ep[i].halted = 0; - } - dev->stall = 0; -- spin_lock(&dev->lock); -- dev->driver->setup(&dev->gadget, &dev->setup_data); - spin_unlock(&dev->lock); -+ dev->driver->setup(&dev->gadget, &dev->setup_data); -+ spin_lock(&dev->lock); - } - - /** -@@ -2691,9 +2691,9 @@ static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev) - dev->stall = 0; - - /* call gadget zero with setup data received */ -- spin_lock(&dev->lock); -- dev->driver->setup(&dev->gadget, &dev->setup_data); - spin_unlock(&dev->lock); -+ dev->driver->setup(&dev->gadget, &dev->setup_data); -+ spin_lock(&dev->lock); - } - - /** -diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c -index 7be4e7d..280ed5f 100644 ---- a/drivers/usb/renesas_usbhs/fifo.c -+++ b/drivers/usb/renesas_usbhs/fifo.c -@@ -810,20 +810,27 @@ static void xfer_work(struct work_struct *work) - { - struct usbhs_pkt *pkt = container_of(work, struct usbhs_pkt, work); - struct usbhs_pipe *pipe = pkt->pipe; -- struct usbhs_fifo *fifo = usbhs_pipe_to_fifo(pipe); -+ struct usbhs_fifo *fifo; - struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe); - struct dma_async_tx_descriptor *desc; -- struct dma_chan *chan = usbhsf_dma_chan_get(fifo, pkt); -+ struct dma_chan *chan; - struct device *dev = usbhs_priv_to_dev(priv); - enum dma_transfer_direction dir; -+ unsigned long flags; - -+ usbhs_lock(priv, flags); -+ fifo = usbhs_pipe_to_fifo(pipe); -+ if (!fifo) -+ goto xfer_work_end; -+ -+ chan = usbhsf_dma_chan_get(fifo, pkt); - dir = usbhs_pipe_is_dir_in(pipe) ? DMA_DEV_TO_MEM : DMA_MEM_TO_DEV; - - desc = dmaengine_prep_slave_single(chan, pkt->dma + pkt->actual, - pkt->trans, dir, - DMA_PREP_INTERRUPT | DMA_CTRL_ACK); - if (!desc) -- return; -+ goto xfer_work_end; - - desc->callback = usbhsf_dma_complete; - desc->callback_param = pipe; -@@ -831,7 +838,7 @@ static void xfer_work(struct work_struct *work) - pkt->cookie = dmaengine_submit(desc); - if (pkt->cookie < 0) { - dev_err(dev, "Failed to submit dma descriptor\n"); -- return; -+ goto xfer_work_end; - } - - dev_dbg(dev, " %s %d (%d/ %d)\n", -@@ -842,6 +849,9 @@ static void xfer_work(struct work_struct *work) - usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans); - dma_async_issue_pending(chan); - usbhs_pipe_enable(pipe); -+ -+xfer_work_end: -+ usbhs_unlock(priv, flags); - } - - /* -diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c -index 30345c2..50f3363 100644 ---- a/drivers/usb/renesas_usbhs/mod_gadget.c -+++ b/drivers/usb/renesas_usbhs/mod_gadget.c -@@ -585,6 +585,9 @@ static int usbhsg_ep_enable(struct usb_ep *ep, - struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv); - struct usbhs_pipe *pipe; - int ret = -EIO; -+ unsigned long flags; -+ -+ usbhs_lock(priv, flags); - - /* - * if it already have pipe, -@@ -593,7 +596,8 @@ static int usbhsg_ep_enable(struct usb_ep *ep, - if (uep->pipe) { - usbhs_pipe_clear(uep->pipe); - usbhs_pipe_sequence_data0(uep->pipe); -- return 0; -+ ret = 0; -+ goto usbhsg_ep_enable_end; - } - - pipe = usbhs_pipe_malloc(priv, -@@ -621,6 +625,9 @@ static int usbhsg_ep_enable(struct usb_ep *ep, - ret = 0; - } - -+usbhsg_ep_enable_end: -+ usbhs_unlock(priv, flags); -+ - return ret; - } - -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index d96d423..8e07536 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -273,6 +273,7 @@ static void option_instat_callback(struct urb *urb); - #define TELIT_PRODUCT_LE922_USBCFG5 0x1045 - #define TELIT_PRODUCT_LE920 0x1200 - #define TELIT_PRODUCT_LE910 0x1201 -+#define TELIT_PRODUCT_LE910_USBCFG4 0x1206 - - /* ZTE PRODUCTS */ - #define ZTE_VENDOR_ID 0x19d2 -@@ -1198,6 +1199,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), - .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, -+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), -+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), - .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ -diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c -index 476c0e3..f6ea8f4 100644 ---- a/drivers/virtio/virtio_balloon.c -+++ b/drivers/virtio/virtio_balloon.c -@@ -202,6 +202,8 @@ static unsigned leak_balloon(struct virtio_balloon *vb, size_t num) - num = min(num, ARRAY_SIZE(vb->pfns)); - - mutex_lock(&vb->balloon_lock); -+ /* We can't release more pages than taken */ -+ num = min(num, (size_t)vb->num_pages); - for (vb->num_pfns = 0; vb->num_pfns < num; - vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE) { - page = balloon_page_dequeue(vb_dev_info); -diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c -index a2eec97..bb09de6 100644 ---- a/drivers/w1/masters/omap_hdq.c -+++ b/drivers/w1/masters/omap_hdq.c -@@ -390,8 +390,6 @@ static int hdq_read_byte(struct hdq_data *hdq_data, u8 *val) - goto out; - } - -- hdq_data->hdq_irqstatus = 0; -- - if (!(hdq_data->hdq_irqstatus & OMAP_HDQ_INT_STATUS_RXCOMPLETE)) { - hdq_reg_merge(hdq_data, OMAP_HDQ_CTRL_STATUS, - OMAP_HDQ_CTRL_STATUS_DIR | OMAP_HDQ_CTRL_STATUS_GO, -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 75533ad..92fe3f8 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -2696,12 +2696,6 @@ struct bio *btrfs_bio_clone(struct bio *bio, gfp_t gfp_mask) - btrfs_bio->csum = NULL; - btrfs_bio->csum_allocated = NULL; - btrfs_bio->end_io = NULL; -- --#ifdef CONFIG_BLK_CGROUP -- /* FIXME, put this into bio_clone_bioset */ -- if (bio->bi_css) -- bio_associate_blkcg(new, bio->bi_css); --#endif - } - return new; - } -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index 2234e88..b56887b 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -1629,13 +1629,11 @@ again: - * managed to copy. - */ - if (num_sectors > dirty_sectors) { -- /* -- * we round down because we don't want to count -- * any partial blocks actually sent through the -- * IO machines -- */ -- release_bytes = round_down(release_bytes - copied, -- root->sectorsize); -+ -+ /* release everything except the sectors we dirtied */ -+ release_bytes -= dirty_sectors << -+ root->fs_info->sb->s_blocksize_bits; -+ - if (copied > 0) { - spin_lock(&BTRFS_I(inode)->lock); - BTRFS_I(inode)->outstanding_extents++; -diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c -index 4ae7500..3f7c2cd 100644 ---- a/fs/cachefiles/namei.c -+++ b/fs/cachefiles/namei.c -@@ -263,6 +263,8 @@ requeue: - void cachefiles_mark_object_inactive(struct cachefiles_cache *cache, - struct cachefiles_object *object) - { -+ blkcnt_t i_blocks = d_backing_inode(object->dentry)->i_blocks; -+ - write_lock(&cache->active_lock); - rb_erase(&object->active_node, &cache->active_nodes); - clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags); -@@ -273,8 +275,7 @@ void cachefiles_mark_object_inactive(struct cachefiles_cache *cache, - /* This object can now be culled, so we need to let the daemon know - * that there is something it can remove if it needs to. - */ -- atomic_long_add(d_backing_inode(object->dentry)->i_blocks, -- &cache->b_released); -+ atomic_long_add(i_blocks, &cache->b_released); - if (atomic_inc_return(&cache->f_released)) - cachefiles_state_changed(cache); - } -diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h -index 3182273..1418daa 100644 ---- a/fs/cifs/cifs_fs_sb.h -+++ b/fs/cifs/cifs_fs_sb.h -@@ -46,6 +46,9 @@ - #define CIFS_MOUNT_CIFS_BACKUPUID 0x200000 /* backup intent bit for a user */ - #define CIFS_MOUNT_CIFS_BACKUPGID 0x400000 /* backup intent bit for a group */ - #define CIFS_MOUNT_MAP_SFM_CHR 0x800000 /* SFM/MAC mapping for illegal chars */ -+#define CIFS_MOUNT_USE_PREFIX_PATH 0x1000000 /* make subpath with unaccessible -+ * root mountable -+ */ - - struct cifs_sb_info { - struct rb_root tlink_tree; -@@ -67,5 +70,6 @@ struct cifs_sb_info { - struct backing_dev_info bdi; - struct delayed_work prune_tlinks; - struct rcu_head rcu; -+ char *prepath; - }; - #endif /* _CIFS_FS_SB_H */ -diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c -index 6aeb8d4..8347c90 100644 ---- a/fs/cifs/cifsencrypt.c -+++ b/fs/cifs/cifsencrypt.c -@@ -743,24 +743,26 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) - - memcpy(ses->auth_key.response + baselen, tiblob, tilen); - -+ mutex_lock(&ses->server->srv_mutex); -+ - rc = crypto_hmacmd5_alloc(ses->server); - if (rc) { - cifs_dbg(VFS, "could not crypto alloc hmacmd5 rc %d\n", rc); -- goto setup_ntlmv2_rsp_ret; -+ goto unlock; - } - - /* calculate ntlmv2_hash */ - rc = calc_ntlmv2_hash(ses, ntlmv2_hash, nls_cp); - if (rc) { - cifs_dbg(VFS, "could not get v2 hash rc %d\n", rc); -- goto setup_ntlmv2_rsp_ret; -+ goto unlock; - } - - /* calculate first part of the client response (CR1) */ - rc = CalcNTLMv2_response(ses, ntlmv2_hash); - if (rc) { - cifs_dbg(VFS, "Could not calculate CR1 rc: %d\n", rc); -- goto setup_ntlmv2_rsp_ret; -+ goto unlock; - } - - /* now calculate the session key for NTLMv2 */ -@@ -769,13 +771,13 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) - if (rc) { - cifs_dbg(VFS, "%s: Could not set NTLMV2 Hash as a key\n", - __func__); -- goto setup_ntlmv2_rsp_ret; -+ goto unlock; - } - - rc = crypto_shash_init(&ses->server->secmech.sdeschmacmd5->shash); - if (rc) { - cifs_dbg(VFS, "%s: Could not init hmacmd5\n", __func__); -- goto setup_ntlmv2_rsp_ret; -+ goto unlock; - } - - rc = crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash, -@@ -783,7 +785,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) - CIFS_HMAC_MD5_HASH_SIZE); - if (rc) { - cifs_dbg(VFS, "%s: Could not update with response\n", __func__); -- goto setup_ntlmv2_rsp_ret; -+ goto unlock; - } - - rc = crypto_shash_final(&ses->server->secmech.sdeschmacmd5->shash, -@@ -791,6 +793,8 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) - if (rc) - cifs_dbg(VFS, "%s: Could not generate md5 hash\n", __func__); - -+unlock: -+ mutex_unlock(&ses->server->srv_mutex); - setup_ntlmv2_rsp_ret: - kfree(tiblob); - -diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c -index 5d841f3..6bbec5e 100644 ---- a/fs/cifs/cifsfs.c -+++ b/fs/cifs/cifsfs.c -@@ -689,6 +689,14 @@ cifs_do_mount(struct file_system_type *fs_type, - goto out_cifs_sb; - } - -+ if (volume_info->prepath) { -+ cifs_sb->prepath = kstrdup(volume_info->prepath, GFP_KERNEL); -+ if (cifs_sb->prepath == NULL) { -+ root = ERR_PTR(-ENOMEM); -+ goto out_cifs_sb; -+ } -+ } -+ - cifs_setup_cifs_sb(volume_info, cifs_sb); - - rc = cifs_mount(cifs_sb, volume_info); -@@ -727,7 +735,11 @@ cifs_do_mount(struct file_system_type *fs_type, - sb->s_flags |= MS_ACTIVE; - } - -- root = cifs_get_root(volume_info, sb); -+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) -+ root = dget(sb->s_root); -+ else -+ root = cifs_get_root(volume_info, sb); -+ - if (IS_ERR(root)) - goto out_super; - -diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index 7d2b15c..7ae0328 100644 ---- a/fs/cifs/connect.c -+++ b/fs/cifs/connect.c -@@ -1228,6 +1228,8 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, - vol->ops = &smb1_operations; - vol->vals = &smb1_values; - -+ vol->echo_interval = SMB_ECHO_INTERVAL_DEFAULT; -+ - if (!mountdata) - goto cifs_parse_mount_err; - -@@ -2049,7 +2051,7 @@ static int match_server(struct TCP_Server_Info *server, struct smb_vol *vol) - if (!match_security(server, vol)) - return 0; - -- if (server->echo_interval != vol->echo_interval) -+ if (server->echo_interval != vol->echo_interval * HZ) - return 0; - - return 1; -@@ -3483,6 +3485,44 @@ cifs_get_volume_info(char *mount_data, const char *devname) - return volume_info; - } - -+static int -+cifs_are_all_path_components_accessible(struct TCP_Server_Info *server, -+ unsigned int xid, -+ struct cifs_tcon *tcon, -+ struct cifs_sb_info *cifs_sb, -+ char *full_path) -+{ -+ int rc; -+ char *s; -+ char sep, tmp; -+ -+ sep = CIFS_DIR_SEP(cifs_sb); -+ s = full_path; -+ -+ rc = server->ops->is_path_accessible(xid, tcon, cifs_sb, ""); -+ while (rc == 0) { -+ /* skip separators */ -+ while (*s == sep) -+ s++; -+ if (!*s) -+ break; -+ /* next separator */ -+ while (*s && *s != sep) -+ s++; -+ -+ /* -+ * temporarily null-terminate the path at the end of -+ * the current component -+ */ -+ tmp = *s; -+ *s = 0; -+ rc = server->ops->is_path_accessible(xid, tcon, cifs_sb, -+ full_path); -+ *s = tmp; -+ } -+ return rc; -+} -+ - int - cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info) - { -@@ -3620,6 +3660,16 @@ remote_path_check: - kfree(full_path); - goto mount_fail_check; - } -+ -+ rc = cifs_are_all_path_components_accessible(server, -+ xid, tcon, cifs_sb, -+ full_path); -+ if (rc != 0) { -+ cifs_dbg(VFS, "cannot query dirs between root and final path, " -+ "enabling CIFS_MOUNT_USE_PREFIX_PATH\n"); -+ cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH; -+ rc = 0; -+ } - kfree(full_path); - } - -@@ -3889,6 +3939,7 @@ cifs_umount(struct cifs_sb_info *cifs_sb) - - bdi_destroy(&cifs_sb->bdi); - kfree(cifs_sb->mountdata); -+ kfree(cifs_sb->prepath); - call_rcu(&cifs_sb->rcu, delayed_free); - } - -diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c -index fb0903f..6f7333d 100644 ---- a/fs/cifs/dir.c -+++ b/fs/cifs/dir.c -@@ -84,6 +84,7 @@ build_path_from_dentry(struct dentry *direntry) - struct dentry *temp; - int namelen; - int dfsplen; -+ int pplen = 0; - char *full_path; - char dirsep; - struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb); -@@ -95,8 +96,12 @@ build_path_from_dentry(struct dentry *direntry) - dfsplen = strnlen(tcon->treeName, MAX_TREE_SIZE + 1); - else - dfsplen = 0; -+ -+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) -+ pplen = cifs_sb->prepath ? strlen(cifs_sb->prepath) + 1 : 0; -+ - cifs_bp_rename_retry: -- namelen = dfsplen; -+ namelen = dfsplen + pplen; - seq = read_seqbegin(&rename_lock); - rcu_read_lock(); - for (temp = direntry; !IS_ROOT(temp);) { -@@ -137,7 +142,7 @@ cifs_bp_rename_retry: - } - } - rcu_read_unlock(); -- if (namelen != dfsplen || read_seqretry(&rename_lock, seq)) { -+ if (namelen != dfsplen + pplen || read_seqretry(&rename_lock, seq)) { - cifs_dbg(FYI, "did not end path lookup where expected. namelen=%ddfsplen=%d\n", - namelen, dfsplen); - /* presumably this is only possible if racing with a rename -@@ -153,6 +158,17 @@ cifs_bp_rename_retry: - those safely to '/' if any are found in the middle of the prepath */ - /* BB test paths to Windows with '/' in the midst of prepath */ - -+ if (pplen) { -+ int i; -+ -+ cifs_dbg(FYI, "using cifs_sb prepath <%s>\n", cifs_sb->prepath); -+ memcpy(full_path+dfsplen+1, cifs_sb->prepath, pplen-1); -+ full_path[dfsplen] = '\\'; -+ for (i = 0; i < pplen-1; i++) -+ if (full_path[dfsplen+1+i] == '/') -+ full_path[dfsplen+1+i] = CIFS_DIR_SEP(cifs_sb); -+ } -+ - if (dfsplen) { - strncpy(full_path, tcon->treeName, dfsplen); - if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) { -@@ -229,6 +245,13 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid, - goto cifs_create_get_file_info; - } - -+ if (S_ISDIR(newinode->i_mode)) { -+ CIFSSMBClose(xid, tcon, fid->netfid); -+ iput(newinode); -+ rc = -EISDIR; -+ goto out; -+ } -+ - if (!S_ISREG(newinode->i_mode)) { - /* - * The server may allow us to open things like -@@ -399,10 +422,14 @@ cifs_create_set_dentry: - if (rc != 0) { - cifs_dbg(FYI, "Create worked, get_inode_info failed rc = %d\n", - rc); -- if (server->ops->close) -- server->ops->close(xid, tcon, fid); -- goto out; -+ goto out_err; - } -+ -+ if (S_ISDIR(newinode->i_mode)) { -+ rc = -EISDIR; -+ goto out_err; -+ } -+ - d_drop(direntry); - d_add(direntry, newinode); - -@@ -410,6 +437,13 @@ out: - kfree(buf); - kfree(full_path); - return rc; -+ -+out_err: -+ if (server->ops->close) -+ server->ops->close(xid, tcon, fid); -+ if (newinode) -+ iput(newinode); -+ goto out; - } - - int -diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c -index 514dadb..b87efd0 100644 ---- a/fs/cifs/inode.c -+++ b/fs/cifs/inode.c -@@ -1002,10 +1002,26 @@ struct inode *cifs_root_iget(struct super_block *sb) - struct inode *inode = NULL; - long rc; - struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb); -+ char *path = NULL; -+ int len; -+ -+ if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) -+ && cifs_sb->prepath) { -+ len = strlen(cifs_sb->prepath); -+ path = kzalloc(len + 2 /* leading sep + null */, GFP_KERNEL); -+ if (path == NULL) -+ return ERR_PTR(-ENOMEM); -+ path[0] = '/'; -+ memcpy(path+1, cifs_sb->prepath, len); -+ } else { -+ path = kstrdup("", GFP_KERNEL); -+ if (path == NULL) -+ return ERR_PTR(-ENOMEM); -+ } - - xid = get_xid(); - if (tcon->unix_ext) { -- rc = cifs_get_inode_info_unix(&inode, "", sb, xid); -+ rc = cifs_get_inode_info_unix(&inode, path, sb, xid); - /* some servers mistakenly claim POSIX support */ - if (rc != -EOPNOTSUPP) - goto iget_no_retry; -@@ -1013,7 +1029,8 @@ struct inode *cifs_root_iget(struct super_block *sb) - tcon->unix_ext = false; - } - -- rc = cifs_get_inode_info(&inode, "", NULL, sb, xid, NULL); -+ convert_delimiter(path, CIFS_DIR_SEP(cifs_sb)); -+ rc = cifs_get_inode_info(&inode, path, NULL, sb, xid, NULL); - - iget_no_retry: - if (!inode) { -@@ -1042,6 +1059,7 @@ iget_no_retry: - } - - out: -+ kfree(path); - /* can not call macro free_xid here since in a void func - * TODO: This is no longer true - */ -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index 3525ed7..505e6d6 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -1044,6 +1044,9 @@ smb2_new_lease_key(struct cifs_fid *fid) - get_random_bytes(fid->lease_key, SMB2_LEASE_KEY_SIZE); - } - -+#define SMB2_SYMLINK_STRUCT_SIZE \ -+ (sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp)) -+ - static int - smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, - const char *full_path, char **target_path, -@@ -1056,7 +1059,10 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, - struct cifs_fid fid; - struct smb2_err_rsp *err_buf = NULL; - struct smb2_symlink_err_rsp *symlink; -- unsigned int sub_len, sub_offset; -+ unsigned int sub_len; -+ unsigned int sub_offset; -+ unsigned int print_len; -+ unsigned int print_offset; - - cifs_dbg(FYI, "%s: path: %s\n", __func__, full_path); - -@@ -1077,11 +1083,33 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, - kfree(utf16_path); - return -ENOENT; - } -+ -+ if (le32_to_cpu(err_buf->ByteCount) < sizeof(struct smb2_symlink_err_rsp) || -+ get_rfc1002_length(err_buf) + 4 < SMB2_SYMLINK_STRUCT_SIZE) { -+ kfree(utf16_path); -+ return -ENOENT; -+ } -+ - /* open must fail on symlink - reset rc */ - rc = 0; - symlink = (struct smb2_symlink_err_rsp *)err_buf->ErrorData; - sub_len = le16_to_cpu(symlink->SubstituteNameLength); - sub_offset = le16_to_cpu(symlink->SubstituteNameOffset); -+ print_len = le16_to_cpu(symlink->PrintNameLength); -+ print_offset = le16_to_cpu(symlink->PrintNameOffset); -+ -+ if (get_rfc1002_length(err_buf) + 4 < -+ SMB2_SYMLINK_STRUCT_SIZE + sub_offset + sub_len) { -+ kfree(utf16_path); -+ return -ENOENT; -+ } -+ -+ if (get_rfc1002_length(err_buf) + 4 < -+ SMB2_SYMLINK_STRUCT_SIZE + print_offset + print_len) { -+ kfree(utf16_path); -+ return -ENOENT; -+ } -+ - *target_path = cifs_strndup_from_utf16( - (char *)symlink->PathBuffer + sub_offset, - sub_len, true, cifs_sb->local_nls); -diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c -index 7007809..78313ad 100644 ---- a/fs/jbd2/commit.c -+++ b/fs/jbd2/commit.c -@@ -124,7 +124,7 @@ static int journal_submit_commit_record(journal_t *journal, - struct commit_header *tmp; - struct buffer_head *bh; - int ret; -- struct timespec now = current_kernel_time(); -+ struct timespec64 now = current_kernel_time64(); - - *cbh = NULL; - -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index ff416d0..7796bea 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -427,6 +427,7 @@ static int nfs4_do_handle_exception(struct nfs_server *server, - case -NFS4ERR_DELAY: - nfs_inc_server_stats(server, NFSIOS_DELAY); - case -NFS4ERR_GRACE: -+ case -NFS4ERR_LAYOUTTRYLATER: - case -NFS4ERR_RECALLCONFLICT: - exception->delay = 1; - return 0; -@@ -7869,11 +7870,13 @@ nfs4_layoutget_handle_exception(struct rpc_task *task, - struct inode *inode = lgp->args.inode; - struct nfs_server *server = NFS_SERVER(inode); - struct pnfs_layout_hdr *lo; -- int status = task->tk_status; -+ int nfs4err = task->tk_status; -+ int err, status = 0; -+ LIST_HEAD(head); - - dprintk("--> %s tk_status => %d\n", __func__, -task->tk_status); - -- switch (status) { -+ switch (nfs4err) { - case 0: - goto out; - -@@ -7905,45 +7908,43 @@ nfs4_layoutget_handle_exception(struct rpc_task *task, - status = -EOVERFLOW; - goto out; - } -- /* Fallthrough */ -+ status = -EBUSY; -+ break; - case -NFS4ERR_RECALLCONFLICT: -- nfs4_handle_exception(server, -NFS4ERR_RECALLCONFLICT, -- exception); - status = -ERECALLCONFLICT; -- goto out; -+ break; - case -NFS4ERR_EXPIRED: - case -NFS4ERR_BAD_STATEID: - exception->timeout = 0; - spin_lock(&inode->i_lock); -- if (nfs4_stateid_match(&lgp->args.stateid, -+ lo = NFS_I(inode)->layout; -+ /* If the open stateid was bad, then recover it. */ -+ if (!lo || test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) || -+ nfs4_stateid_match_other(&lgp->args.stateid, - &lgp->args.ctx->state->stateid)) { - spin_unlock(&inode->i_lock); -- /* If the open stateid was bad, then recover it. */ - exception->state = lgp->args.ctx->state; - break; - } -- lo = NFS_I(inode)->layout; -- if (lo && !test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) && -- nfs4_stateid_match_other(&lgp->args.stateid, &lo->plh_stateid)) { -- LIST_HEAD(head); -- -- /* -- * Mark the bad layout state as invalid, then retry -- * with the current stateid. -- */ -- set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags); -- pnfs_mark_matching_lsegs_invalid(lo, &head, NULL, 0); -- spin_unlock(&inode->i_lock); -- pnfs_free_lseg_list(&head); -- status = -EAGAIN; -- goto out; -- } else -- spin_unlock(&inode->i_lock); -- } - -- status = nfs4_handle_exception(server, status, exception); -- if (exception->retry) -+ /* -+ * Mark the bad layout state as invalid, then retry -+ */ -+ set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags); -+ pnfs_mark_matching_lsegs_invalid(lo, &head, NULL, 0); -+ spin_unlock(&inode->i_lock); -+ pnfs_free_lseg_list(&head); - status = -EAGAIN; -+ goto out; -+ } -+ -+ err = nfs4_handle_exception(server, nfs4err, exception); -+ if (!status) { -+ if (exception->retry) -+ status = -EAGAIN; -+ else -+ status = err; -+ } - out: - dprintk("<-- %s\n", __func__); - return status; -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index 0fbe734..7d99236 100644 ---- a/fs/nfs/pnfs.c -+++ b/fs/nfs/pnfs.c -@@ -1505,7 +1505,7 @@ pnfs_update_layout(struct inode *ino, - struct pnfs_layout_segment *lseg = NULL; - nfs4_stateid stateid; - long timeout = 0; -- unsigned long giveup = jiffies + rpc_get_timeout(server->client); -+ unsigned long giveup = jiffies + (clp->cl_lease_time << 1); - bool first; - - if (!pnfs_enabled_sb(NFS_SERVER(ino))) { -@@ -1645,33 +1645,44 @@ lookup_again: - lseg = send_layoutget(lo, ctx, &stateid, &arg, &timeout, gfp_flags); - trace_pnfs_update_layout(ino, pos, count, iomode, lo, lseg, - PNFS_UPDATE_LAYOUT_SEND_LAYOUTGET); -+ atomic_dec(&lo->plh_outstanding); - if (IS_ERR(lseg)) { - switch(PTR_ERR(lseg)) { -- case -ERECALLCONFLICT: -+ case -EBUSY: - if (time_after(jiffies, giveup)) - lseg = NULL; -- /* Fallthrough */ -- case -EAGAIN: -- pnfs_put_layout_hdr(lo); -- if (first) -- pnfs_clear_first_layoutget(lo); -- if (lseg) { -- trace_pnfs_update_layout(ino, pos, count, -- iomode, lo, lseg, PNFS_UPDATE_LAYOUT_RETRY); -- goto lookup_again; -+ break; -+ case -ERECALLCONFLICT: -+ /* Huh? We hold no layouts, how is there a recall? */ -+ if (first) { -+ lseg = NULL; -+ break; - } -+ /* Destroy the existing layout and start over */ -+ if (time_after(jiffies, giveup)) -+ pnfs_destroy_layout(NFS_I(ino)); - /* Fallthrough */ -+ case -EAGAIN: -+ break; - default: - if (!nfs_error_is_fatal(PTR_ERR(lseg))) { - pnfs_layout_clear_fail_bit(lo, pnfs_iomode_to_fail_bit(iomode)); - lseg = NULL; - } -+ goto out_put_layout_hdr; -+ } -+ if (lseg) { -+ if (first) -+ pnfs_clear_first_layoutget(lo); -+ trace_pnfs_update_layout(ino, pos, count, -+ iomode, lo, lseg, PNFS_UPDATE_LAYOUT_RETRY); -+ pnfs_put_layout_hdr(lo); -+ goto lookup_again; - } - } else { - pnfs_layout_clear_fail_bit(lo, pnfs_iomode_to_fail_bit(iomode)); - } - -- atomic_dec(&lo->plh_outstanding); - out_put_layout_hdr: - if (first) - pnfs_clear_first_layoutget(lo); -diff --git a/fs/nfs/write.c b/fs/nfs/write.c -index e1c74d3..649fa5e 100644 ---- a/fs/nfs/write.c -+++ b/fs/nfs/write.c -@@ -1289,6 +1289,9 @@ int nfs_updatepage(struct file *file, struct page *page, - dprintk("NFS: nfs_updatepage(%pD2 %d@%lld)\n", - file, count, (long long)(page_file_offset(page) + offset)); - -+ if (!count) -+ goto out; -+ - if (nfs_can_extend_write(file, page, inode)) { - count = max(count + offset, nfs_page_length(page)); - offset = 0; -@@ -1299,7 +1302,7 @@ int nfs_updatepage(struct file *file, struct page *page, - nfs_set_pageerror(page); - else - __set_page_dirty_nobuffers(page); -- -+out: - dprintk("NFS: nfs_updatepage returns %d (isize %lld)\n", - status, (long long)i_size_read(inode)); - return status; -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 70d0b9b..806eda1 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -4906,6 +4906,32 @@ nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - return nfs_ok; - } - -+static __be32 -+nfsd4_free_lock_stateid(stateid_t *stateid, struct nfs4_stid *s) -+{ -+ struct nfs4_ol_stateid *stp = openlockstateid(s); -+ __be32 ret; -+ -+ mutex_lock(&stp->st_mutex); -+ -+ ret = check_stateid_generation(stateid, &s->sc_stateid, 1); -+ if (ret) -+ goto out; -+ -+ ret = nfserr_locks_held; -+ if (check_for_locks(stp->st_stid.sc_file, -+ lockowner(stp->st_stateowner))) -+ goto out; -+ -+ release_lock_stateid(stp); -+ ret = nfs_ok; -+ -+out: -+ mutex_unlock(&stp->st_mutex); -+ nfs4_put_stid(s); -+ return ret; -+} -+ - __be32 - nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - struct nfsd4_free_stateid *free_stateid) -@@ -4913,7 +4939,6 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - stateid_t *stateid = &free_stateid->fr_stateid; - struct nfs4_stid *s; - struct nfs4_delegation *dp; -- struct nfs4_ol_stateid *stp; - struct nfs4_client *cl = cstate->session->se_client; - __be32 ret = nfserr_bad_stateid; - -@@ -4932,18 +4957,9 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - ret = nfserr_locks_held; - break; - case NFS4_LOCK_STID: -- ret = check_stateid_generation(stateid, &s->sc_stateid, 1); -- if (ret) -- break; -- stp = openlockstateid(s); -- ret = nfserr_locks_held; -- if (check_for_locks(stp->st_stid.sc_file, -- lockowner(stp->st_stateowner))) -- break; -- WARN_ON(!unhash_lock_stateid(stp)); -+ atomic_inc(&s->sc_count); - spin_unlock(&cl->cl_lock); -- nfs4_put_stid(s); -- ret = nfs_ok; -+ ret = nfsd4_free_lock_stateid(stateid, s); - goto out; - case NFS4_REVOKED_DELEG_STID: - dp = delegstateid(s); -@@ -5510,7 +5526,7 @@ static __be32 - lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, - struct nfs4_ol_stateid *ost, - struct nfsd4_lock *lock, -- struct nfs4_ol_stateid **lst, bool *new) -+ struct nfs4_ol_stateid **plst, bool *new) - { - __be32 status; - struct nfs4_file *fi = ost->st_stid.sc_file; -@@ -5518,7 +5534,9 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, - struct nfs4_client *cl = oo->oo_owner.so_client; - struct inode *inode = d_inode(cstate->current_fh.fh_dentry); - struct nfs4_lockowner *lo; -+ struct nfs4_ol_stateid *lst; - unsigned int strhashval; -+ bool hashed; - - lo = find_lockowner_str(cl, &lock->lk_new_owner); - if (!lo) { -@@ -5534,12 +5552,27 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, - goto out; - } - -- *lst = find_or_create_lock_stateid(lo, fi, inode, ost, new); -- if (*lst == NULL) { -+retry: -+ lst = find_or_create_lock_stateid(lo, fi, inode, ost, new); -+ if (lst == NULL) { - status = nfserr_jukebox; - goto out; - } -+ -+ mutex_lock(&lst->st_mutex); -+ -+ /* See if it's still hashed to avoid race with FREE_STATEID */ -+ spin_lock(&cl->cl_lock); -+ hashed = !list_empty(&lst->st_perfile); -+ spin_unlock(&cl->cl_lock); -+ -+ if (!hashed) { -+ mutex_unlock(&lst->st_mutex); -+ nfs4_put_stid(&lst->st_stid); -+ goto retry; -+ } - status = nfs_ok; -+ *plst = lst; - out: - nfs4_put_stateowner(&lo->lo_owner); - return status; -@@ -5606,8 +5639,6 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - goto out; - status = lookup_or_create_lock_state(cstate, open_stp, lock, - &lock_stp, &new); -- if (status == nfs_ok) -- mutex_lock(&lock_stp->st_mutex); - } else { - status = nfs4_preprocess_seqid_op(cstate, - lock->lk_old_lock_seqid, -diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index 9a7693d..6db75cb 100644 ---- a/fs/overlayfs/super.c -+++ b/fs/overlayfs/super.c -@@ -404,7 +404,8 @@ static struct ovl_entry *ovl_alloc_entry(unsigned int numlower) - static bool ovl_dentry_remote(struct dentry *dentry) - { - return dentry->d_flags & -- (DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE); -+ (DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE | -+ DCACHE_OP_REAL); - } - - static bool ovl_dentry_weird(struct dentry *dentry) -diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c -index 4c463b9..a36a5a4 100644 ---- a/fs/xfs/xfs_aops.c -+++ b/fs/xfs/xfs_aops.c -@@ -87,6 +87,12 @@ xfs_find_bdev_for_inode( - * We're now finished for good with this page. Update the page state via the - * associated buffer_heads, paying attention to the start and end offsets that - * we need to process on the page. -+ * -+ * Landmine Warning: bh->b_end_io() will call end_page_writeback() on the last -+ * buffer in the IO. Once it does this, it is unsafe to access the bufferhead or -+ * the page at all, as we may be racing with memory reclaim and it can free both -+ * the bufferhead chain and the page as it will see the page as clean and -+ * unused. - */ - static void - xfs_finish_page_writeback( -@@ -95,8 +101,9 @@ xfs_finish_page_writeback( - int error) - { - unsigned int end = bvec->bv_offset + bvec->bv_len - 1; -- struct buffer_head *head, *bh; -+ struct buffer_head *head, *bh, *next; - unsigned int off = 0; -+ unsigned int bsize; - - ASSERT(bvec->bv_offset < PAGE_SIZE); - ASSERT((bvec->bv_offset & ((1 << inode->i_blkbits) - 1)) == 0); -@@ -105,15 +112,17 @@ xfs_finish_page_writeback( - - bh = head = page_buffers(bvec->bv_page); - -+ bsize = bh->b_size; - do { -+ next = bh->b_this_page; - if (off < bvec->bv_offset) - goto next_bh; - if (off > end) - break; - bh->b_end_io(bh, !error); - next_bh: -- off += bh->b_size; -- } while ((bh = bh->b_this_page) != head); -+ off += bsize; -+ } while ((bh = next) != head); - } - - /* -diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h -index 3f10307..c357f27 100644 ---- a/include/linux/backing-dev-defs.h -+++ b/include/linux/backing-dev-defs.h -@@ -163,6 +163,7 @@ struct backing_dev_info { - wait_queue_head_t wb_waitq; - - struct device *dev; -+ struct device *owner; - - struct timer_list laptop_mode_wb_timer; - -diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h -index c82794f..89d3de3 100644 ---- a/include/linux/backing-dev.h -+++ b/include/linux/backing-dev.h -@@ -24,6 +24,7 @@ __printf(3, 4) - int bdi_register(struct backing_dev_info *bdi, struct device *parent, - const char *fmt, ...); - int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev); -+int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner); - void bdi_unregister(struct backing_dev_info *bdi); - - int __must_check bdi_setup_and_register(struct backing_dev_info *, char *); -diff --git a/include/linux/bio.h b/include/linux/bio.h -index 9faebf7..75fadd2 100644 ---- a/include/linux/bio.h -+++ b/include/linux/bio.h -@@ -527,11 +527,14 @@ extern unsigned int bvec_nr_vecs(unsigned short idx); - int bio_associate_blkcg(struct bio *bio, struct cgroup_subsys_state *blkcg_css); - int bio_associate_current(struct bio *bio); - void bio_disassociate_task(struct bio *bio); -+void bio_clone_blkcg_association(struct bio *dst, struct bio *src); - #else /* CONFIG_BLK_CGROUP */ - static inline int bio_associate_blkcg(struct bio *bio, - struct cgroup_subsys_state *blkcg_css) { return 0; } - static inline int bio_associate_current(struct bio *bio) { return -ENOENT; } - static inline void bio_disassociate_task(struct bio *bio) { } -+static inline void bio_clone_blkcg_association(struct bio *dst, -+ struct bio *src) { } - #endif /* CONFIG_BLK_CGROUP */ - - #ifdef CONFIG_HIGHMEM -diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h -index ab31081..7879bf4 100644 ---- a/include/linux/mlx5/qp.h -+++ b/include/linux/mlx5/qp.h -@@ -556,9 +556,9 @@ struct mlx5_destroy_qp_mbox_out { - struct mlx5_modify_qp_mbox_in { - struct mlx5_inbox_hdr hdr; - __be32 qpn; -- u8 rsvd1[4]; -- __be32 optparam; - u8 rsvd0[4]; -+ __be32 optparam; -+ u8 rsvd1[4]; - struct mlx5_qp_context ctx; - u8 rsvd2[16]; - }; -diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h -index 7e440d4..e694f02 100644 ---- a/include/rdma/ib_verbs.h -+++ b/include/rdma/ib_verbs.h -@@ -1428,6 +1428,10 @@ struct ib_srq { - } ext; - }; - -+/* -+ * @max_write_sge: Maximum SGE elements per RDMA WRITE request. -+ * @max_read_sge: Maximum SGE elements per RDMA READ request. -+ */ - struct ib_qp { - struct ib_device *device; - struct ib_pd *pd; -@@ -1449,6 +1453,8 @@ struct ib_qp { - void (*event_handler)(struct ib_event *, void *); - void *qp_context; - u32 qp_num; -+ u32 max_write_sge; -+ u32 max_read_sge; - enum ib_qp_type qp_type; - }; - -diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h -index d8ab510..f6f3bc5 100644 ---- a/include/target/target_core_backend.h -+++ b/include/target/target_core_backend.h -@@ -95,6 +95,6 @@ sense_reason_t passthrough_parse_cdb(struct se_cmd *cmd, - bool target_sense_desc_format(struct se_device *dev); - sector_t target_to_linux_sector(struct se_device *dev, sector_t lb); - bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib, -- struct request_queue *q, int block_size); -+ struct request_queue *q); - - #endif /* TARGET_CORE_BACKEND_H */ -diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index b316b44..fb8e3b6 100644 ---- a/include/target/target_core_base.h -+++ b/include/target/target_core_base.h -@@ -142,6 +142,7 @@ enum se_cmd_flags_table { - SCF_PASSTHROUGH_PROT_SG_TO_MEM_NOALLOC = 0x00200000, - SCF_ACK_KREF = 0x00400000, - SCF_USE_CPUID = 0x00800000, -+ SCF_TASK_ATTR_SET = 0x01000000, - }; - - /* -diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h -index de44462..5cd6faa 100644 ---- a/include/target/target_core_fabric.h -+++ b/include/target/target_core_fabric.h -@@ -163,7 +163,6 @@ int core_tmr_alloc_req(struct se_cmd *, void *, u8, gfp_t); - void core_tmr_release_req(struct se_tmr_req *); - int transport_generic_handle_tmr(struct se_cmd *); - void transport_generic_request_failure(struct se_cmd *, sense_reason_t); --void __target_execute_cmd(struct se_cmd *); - int transport_lookup_tmr_lun(struct se_cmd *, u64); - void core_allocate_nexus_loss_ua(struct se_node_acl *acl); - -diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h -index 003dca9..5664ca0 100644 ---- a/include/trace/events/sunrpc.h -+++ b/include/trace/events/sunrpc.h -@@ -529,20 +529,27 @@ TRACE_EVENT(svc_xprt_do_enqueue, - - TP_STRUCT__entry( - __field(struct svc_xprt *, xprt) -- __field_struct(struct sockaddr_storage, ss) - __field(int, pid) - __field(unsigned long, flags) -+ __dynamic_array(unsigned char, addr, xprt != NULL ? -+ xprt->xpt_remotelen : 0) - ), - - TP_fast_assign( - __entry->xprt = xprt; -- xprt ? memcpy(&__entry->ss, &xprt->xpt_remote, sizeof(__entry->ss)) : memset(&__entry->ss, 0, sizeof(__entry->ss)); - __entry->pid = rqst? rqst->rq_task->pid : 0; -- __entry->flags = xprt ? xprt->xpt_flags : 0; -+ if (xprt) { -+ memcpy(__get_dynamic_array(addr), -+ &xprt->xpt_remote, -+ xprt->xpt_remotelen); -+ __entry->flags = xprt->xpt_flags; -+ } else -+ __entry->flags = 0; - ), - - TP_printk("xprt=0x%p addr=%pIScp pid=%d flags=%s", __entry->xprt, -- (struct sockaddr *)&__entry->ss, -+ __get_dynamic_array_len(addr) != 0 ? -+ (struct sockaddr *)__get_dynamic_array(addr) : NULL, - __entry->pid, show_svc_xprt_flags(__entry->flags)) - ); - -@@ -553,18 +560,25 @@ TRACE_EVENT(svc_xprt_dequeue, - - TP_STRUCT__entry( - __field(struct svc_xprt *, xprt) -- __field_struct(struct sockaddr_storage, ss) - __field(unsigned long, flags) -+ __dynamic_array(unsigned char, addr, xprt != NULL ? -+ xprt->xpt_remotelen : 0) - ), - - TP_fast_assign( -- __entry->xprt = xprt, -- xprt ? memcpy(&__entry->ss, &xprt->xpt_remote, sizeof(__entry->ss)) : memset(&__entry->ss, 0, sizeof(__entry->ss)); -- __entry->flags = xprt ? xprt->xpt_flags : 0; -+ __entry->xprt = xprt; -+ if (xprt) { -+ memcpy(__get_dynamic_array(addr), -+ &xprt->xpt_remote, -+ xprt->xpt_remotelen); -+ __entry->flags = xprt->xpt_flags; -+ } else -+ __entry->flags = 0; - ), - - TP_printk("xprt=0x%p addr=%pIScp flags=%s", __entry->xprt, -- (struct sockaddr *)&__entry->ss, -+ __get_dynamic_array_len(addr) != 0 ? -+ (struct sockaddr *)__get_dynamic_array(addr) : NULL, - show_svc_xprt_flags(__entry->flags)) - ); - -@@ -592,19 +606,26 @@ TRACE_EVENT(svc_handle_xprt, - TP_STRUCT__entry( - __field(struct svc_xprt *, xprt) - __field(int, len) -- __field_struct(struct sockaddr_storage, ss) - __field(unsigned long, flags) -+ __dynamic_array(unsigned char, addr, xprt != NULL ? -+ xprt->xpt_remotelen : 0) - ), - - TP_fast_assign( - __entry->xprt = xprt; -- xprt ? memcpy(&__entry->ss, &xprt->xpt_remote, sizeof(__entry->ss)) : memset(&__entry->ss, 0, sizeof(__entry->ss)); - __entry->len = len; -- __entry->flags = xprt ? xprt->xpt_flags : 0; -+ if (xprt) { -+ memcpy(__get_dynamic_array(addr), -+ &xprt->xpt_remote, -+ xprt->xpt_remotelen); -+ __entry->flags = xprt->xpt_flags; -+ } else -+ __entry->flags = 0; - ), - - TP_printk("xprt=0x%p addr=%pIScp len=%d flags=%s", __entry->xprt, -- (struct sockaddr *)&__entry->ss, -+ __get_dynamic_array_len(addr) != 0 ? -+ (struct sockaddr *)__get_dynamic_array(addr) : NULL, - __entry->len, show_svc_xprt_flags(__entry->flags)) - ); - #endif /* _TRACE_SUNRPC_H */ -diff --git a/kernel/auditsc.c b/kernel/auditsc.c -index 2672d10..b334128 100644 ---- a/kernel/auditsc.c -+++ b/kernel/auditsc.c -@@ -72,6 +72,7 @@ - #include <linux/compat.h> - #include <linux/ctype.h> - #include <linux/string.h> -+#include <linux/uaccess.h> - #include <uapi/linux/limits.h> - - #include "audit.h" -@@ -81,7 +82,8 @@ - #define AUDITSC_SUCCESS 1 - #define AUDITSC_FAILURE 2 - --/* no execve audit message should be longer than this (userspace limits) */ -+/* no execve audit message should be longer than this (userspace limits), -+ * see the note near the top of audit_log_execve_info() about this value */ - #define MAX_EXECVE_AUDIT_LEN 7500 - - /* max length to print of cmdline/proctitle value during audit */ -@@ -987,184 +989,178 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid, - return rc; - } - --/* -- * to_send and len_sent accounting are very loose estimates. We aren't -- * really worried about a hard cap to MAX_EXECVE_AUDIT_LEN so much as being -- * within about 500 bytes (next page boundary) -- * -- * why snprintf? an int is up to 12 digits long. if we just assumed when -- * logging that a[%d]= was going to be 16 characters long we would be wasting -- * space in every audit message. In one 7500 byte message we can log up to -- * about 1000 min size arguments. That comes down to about 50% waste of space -- * if we didn't do the snprintf to find out how long arg_num_len was. -- */ --static int audit_log_single_execve_arg(struct audit_context *context, -- struct audit_buffer **ab, -- int arg_num, -- size_t *len_sent, -- const char __user *p, -- char *buf) -+static void audit_log_execve_info(struct audit_context *context, -+ struct audit_buffer **ab) - { -- char arg_num_len_buf[12]; -- const char __user *tmp_p = p; -- /* how many digits are in arg_num? 5 is the length of ' a=""' */ -- size_t arg_num_len = snprintf(arg_num_len_buf, 12, "%d", arg_num) + 5; -- size_t len, len_left, to_send; -- size_t max_execve_audit_len = MAX_EXECVE_AUDIT_LEN; -- unsigned int i, has_cntl = 0, too_long = 0; -- int ret; -- -- /* strnlen_user includes the null we don't want to send */ -- len_left = len = strnlen_user(p, MAX_ARG_STRLEN) - 1; -- -- /* -- * We just created this mm, if we can't find the strings -- * we just copied into it something is _very_ wrong. Similar -- * for strings that are too long, we should not have created -- * any. -- */ -- if (WARN_ON_ONCE(len < 0 || len > MAX_ARG_STRLEN - 1)) { -- send_sig(SIGKILL, current, 0); -- return -1; -+ long len_max; -+ long len_rem; -+ long len_full; -+ long len_buf; -+ long len_abuf; -+ long len_tmp; -+ bool require_data; -+ bool encode; -+ unsigned int iter; -+ unsigned int arg; -+ char *buf_head; -+ char *buf; -+ const char __user *p = (const char __user *)current->mm->arg_start; -+ -+ /* NOTE: this buffer needs to be large enough to hold all the non-arg -+ * data we put in the audit record for this argument (see the -+ * code below) ... at this point in time 96 is plenty */ -+ char abuf[96]; -+ -+ /* NOTE: we set MAX_EXECVE_AUDIT_LEN to a rather arbitrary limit, the -+ * current value of 7500 is not as important as the fact that it -+ * is less than 8k, a setting of 7500 gives us plenty of wiggle -+ * room if we go over a little bit in the logging below */ -+ WARN_ON_ONCE(MAX_EXECVE_AUDIT_LEN > 7500); -+ len_max = MAX_EXECVE_AUDIT_LEN; -+ -+ /* scratch buffer to hold the userspace args */ -+ buf_head = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL); -+ if (!buf_head) { -+ audit_panic("out of memory for argv string"); -+ return; - } -+ buf = buf_head; - -- /* walk the whole argument looking for non-ascii chars */ -+ audit_log_format(*ab, "argc=%d", context->execve.argc); -+ -+ len_rem = len_max; -+ len_buf = 0; -+ len_full = 0; -+ require_data = true; -+ encode = false; -+ iter = 0; -+ arg = 0; - do { -- if (len_left > MAX_EXECVE_AUDIT_LEN) -- to_send = MAX_EXECVE_AUDIT_LEN; -- else -- to_send = len_left; -- ret = copy_from_user(buf, tmp_p, to_send); -- /* -- * There is no reason for this copy to be short. We just -- * copied them here, and the mm hasn't been exposed to user- -- * space yet. -- */ -- if (ret) { -- WARN_ON(1); -- send_sig(SIGKILL, current, 0); -- return -1; -- } -- buf[to_send] = '\0'; -- has_cntl = audit_string_contains_control(buf, to_send); -- if (has_cntl) { -- /* -- * hex messages get logged as 2 bytes, so we can only -- * send half as much in each message -- */ -- max_execve_audit_len = MAX_EXECVE_AUDIT_LEN / 2; -- break; -- } -- len_left -= to_send; -- tmp_p += to_send; -- } while (len_left > 0); -- -- len_left = len; -- -- if (len > max_execve_audit_len) -- too_long = 1; -- -- /* rewalk the argument actually logging the message */ -- for (i = 0; len_left > 0; i++) { -- int room_left; -- -- if (len_left > max_execve_audit_len) -- to_send = max_execve_audit_len; -- else -- to_send = len_left; -- -- /* do we have space left to send this argument in this ab? */ -- room_left = MAX_EXECVE_AUDIT_LEN - arg_num_len - *len_sent; -- if (has_cntl) -- room_left -= (to_send * 2); -- else -- room_left -= to_send; -- if (room_left < 0) { -- *len_sent = 0; -- audit_log_end(*ab); -- *ab = audit_log_start(context, GFP_KERNEL, AUDIT_EXECVE); -- if (!*ab) -- return 0; -- } -+ /* NOTE: we don't ever want to trust this value for anything -+ * serious, but the audit record format insists we -+ * provide an argument length for really long arguments, -+ * e.g. > MAX_EXECVE_AUDIT_LEN, so we have no choice but -+ * to use strncpy_from_user() to obtain this value for -+ * recording in the log, although we don't use it -+ * anywhere here to avoid a double-fetch problem */ -+ if (len_full == 0) -+ len_full = strnlen_user(p, MAX_ARG_STRLEN) - 1; -+ -+ /* read more data from userspace */ -+ if (require_data) { -+ /* can we make more room in the buffer? */ -+ if (buf != buf_head) { -+ memmove(buf_head, buf, len_buf); -+ buf = buf_head; -+ } -+ -+ /* fetch as much as we can of the argument */ -+ len_tmp = strncpy_from_user(&buf_head[len_buf], p, -+ len_max - len_buf); -+ if (len_tmp == -EFAULT) { -+ /* unable to copy from userspace */ -+ send_sig(SIGKILL, current, 0); -+ goto out; -+ } else if (len_tmp == (len_max - len_buf)) { -+ /* buffer is not large enough */ -+ require_data = true; -+ /* NOTE: if we are going to span multiple -+ * buffers force the encoding so we stand -+ * a chance at a sane len_full value and -+ * consistent record encoding */ -+ encode = true; -+ len_full = len_full * 2; -+ p += len_tmp; -+ } else { -+ require_data = false; -+ if (!encode) -+ encode = audit_string_contains_control( -+ buf, len_tmp); -+ /* try to use a trusted value for len_full */ -+ if (len_full < len_max) -+ len_full = (encode ? -+ len_tmp * 2 : len_tmp); -+ p += len_tmp + 1; -+ } -+ len_buf += len_tmp; -+ buf_head[len_buf] = '\0'; - -- /* -- * first record needs to say how long the original string was -- * so we can be sure nothing was lost. -- */ -- if ((i == 0) && (too_long)) -- audit_log_format(*ab, " a%d_len=%zu", arg_num, -- has_cntl ? 2*len : len); -- -- /* -- * normally arguments are small enough to fit and we already -- * filled buf above when we checked for control characters -- * so don't bother with another copy_from_user -- */ -- if (len >= max_execve_audit_len) -- ret = copy_from_user(buf, p, to_send); -- else -- ret = 0; -- if (ret) { -- WARN_ON(1); -- send_sig(SIGKILL, current, 0); -- return -1; -+ /* length of the buffer in the audit record? */ -+ len_abuf = (encode ? len_buf * 2 : len_buf + 2); - } -- buf[to_send] = '\0'; -- -- /* actually log it */ -- audit_log_format(*ab, " a%d", arg_num); -- if (too_long) -- audit_log_format(*ab, "[%d]", i); -- audit_log_format(*ab, "="); -- if (has_cntl) -- audit_log_n_hex(*ab, buf, to_send); -- else -- audit_log_string(*ab, buf); -- -- p += to_send; -- len_left -= to_send; -- *len_sent += arg_num_len; -- if (has_cntl) -- *len_sent += to_send * 2; -- else -- *len_sent += to_send; -- } -- /* include the null we didn't log */ -- return len + 1; --} - --static void audit_log_execve_info(struct audit_context *context, -- struct audit_buffer **ab) --{ -- int i, len; -- size_t len_sent = 0; -- const char __user *p; -- char *buf; -+ /* write as much as we can to the audit log */ -+ if (len_buf > 0) { -+ /* NOTE: some magic numbers here - basically if we -+ * can't fit a reasonable amount of data into the -+ * existing audit buffer, flush it and start with -+ * a new buffer */ -+ if ((sizeof(abuf) + 8) > len_rem) { -+ len_rem = len_max; -+ audit_log_end(*ab); -+ *ab = audit_log_start(context, -+ GFP_KERNEL, AUDIT_EXECVE); -+ if (!*ab) -+ goto out; -+ } - -- p = (const char __user *)current->mm->arg_start; -+ /* create the non-arg portion of the arg record */ -+ len_tmp = 0; -+ if (require_data || (iter > 0) || -+ ((len_abuf + sizeof(abuf)) > len_rem)) { -+ if (iter == 0) { -+ len_tmp += snprintf(&abuf[len_tmp], -+ sizeof(abuf) - len_tmp, -+ " a%d_len=%lu", -+ arg, len_full); -+ } -+ len_tmp += snprintf(&abuf[len_tmp], -+ sizeof(abuf) - len_tmp, -+ " a%d[%d]=", arg, iter++); -+ } else -+ len_tmp += snprintf(&abuf[len_tmp], -+ sizeof(abuf) - len_tmp, -+ " a%d=", arg); -+ WARN_ON(len_tmp >= sizeof(abuf)); -+ abuf[sizeof(abuf) - 1] = '\0'; -+ -+ /* log the arg in the audit record */ -+ audit_log_format(*ab, "%s", abuf); -+ len_rem -= len_tmp; -+ len_tmp = len_buf; -+ if (encode) { -+ if (len_abuf > len_rem) -+ len_tmp = len_rem / 2; /* encoding */ -+ audit_log_n_hex(*ab, buf, len_tmp); -+ len_rem -= len_tmp * 2; -+ len_abuf -= len_tmp * 2; -+ } else { -+ if (len_abuf > len_rem) -+ len_tmp = len_rem - 2; /* quotes */ -+ audit_log_n_string(*ab, buf, len_tmp); -+ len_rem -= len_tmp + 2; -+ /* don't subtract the "2" because we still need -+ * to add quotes to the remaining string */ -+ len_abuf -= len_tmp; -+ } -+ len_buf -= len_tmp; -+ buf += len_tmp; -+ } - -- audit_log_format(*ab, "argc=%d", context->execve.argc); -+ /* ready to move to the next argument? */ -+ if ((len_buf == 0) && !require_data) { -+ arg++; -+ iter = 0; -+ len_full = 0; -+ require_data = true; -+ encode = false; -+ } -+ } while (arg < context->execve.argc); - -- /* -- * we need some kernel buffer to hold the userspace args. Just -- * allocate one big one rather than allocating one of the right size -- * for every single argument inside audit_log_single_execve_arg() -- * should be <8k allocation so should be pretty safe. -- */ -- buf = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL); -- if (!buf) { -- audit_panic("out of memory for argv string"); -- return; -- } -+ /* NOTE: the caller handles the final audit_log_end() call */ - -- for (i = 0; i < context->execve.argc; i++) { -- len = audit_log_single_execve_arg(context, ab, i, -- &len_sent, p, buf); -- if (len <= 0) -- break; -- p += len; -- } -- kfree(buf); -+out: -+ kfree(buf_head); - } - - static void show_special(struct audit_context *context, int *call_panic) -diff --git a/kernel/cgroup.c b/kernel/cgroup.c -index 75c0ff0..e0be49f 100644 ---- a/kernel/cgroup.c -+++ b/kernel/cgroup.c -@@ -2215,12 +2215,8 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type, - goto out_unlock; - } - -- /* -- * We know this subsystem has not yet been bound. Users in a non-init -- * user namespace may only mount hierarchies with no bound subsystems, -- * i.e. 'none,name=user1' -- */ -- if (!opts.none && !capable(CAP_SYS_ADMIN)) { -+ /* Hierarchies may only be created in the initial cgroup namespace. */ -+ if (ns != &init_cgroup_ns) { - ret = -EPERM; - goto out_unlock; - } -@@ -2962,6 +2958,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) - int retval = 0; - - mutex_lock(&cgroup_mutex); -+ percpu_down_write(&cgroup_threadgroup_rwsem); - for_each_root(root) { - struct cgroup *from_cgrp; - -@@ -2976,6 +2973,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) - if (retval) - break; - } -+ percpu_up_write(&cgroup_threadgroup_rwsem); - mutex_unlock(&cgroup_mutex); - - return retval; -@@ -4343,6 +4341,8 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from) - - mutex_lock(&cgroup_mutex); - -+ percpu_down_write(&cgroup_threadgroup_rwsem); -+ - /* all tasks in @from are being moved, all csets are source */ - spin_lock_irq(&css_set_lock); - list_for_each_entry(link, &from->cset_links, cset_link) -@@ -4371,6 +4371,7 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from) - } while (task && !ret); - out_err: - cgroup_migrate_finish(&preloaded_csets); -+ percpu_up_write(&cgroup_threadgroup_rwsem); - mutex_unlock(&cgroup_mutex); - return ret; - } -@@ -6309,14 +6310,11 @@ struct cgroup_namespace *copy_cgroup_ns(unsigned long flags, - if (!ns_capable(user_ns, CAP_SYS_ADMIN)) - return ERR_PTR(-EPERM); - -- mutex_lock(&cgroup_mutex); -+ /* It is not safe to take cgroup_mutex here */ - spin_lock_irq(&css_set_lock); -- - cset = task_css_set(current); - get_css_set(cset); -- - spin_unlock_irq(&css_set_lock); -- mutex_unlock(&cgroup_mutex); - - new_ns = alloc_cgroup_ns(); - if (IS_ERR(new_ns)) { -diff --git a/kernel/module.c b/kernel/module.c -index 5f71aa6..6458a2f 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -2687,13 +2687,18 @@ static inline void kmemleak_load_module(const struct module *mod, - #endif - - #ifdef CONFIG_MODULE_SIG --static int module_sig_check(struct load_info *info) -+static int module_sig_check(struct load_info *info, int flags) - { - int err = -ENOKEY; - const unsigned long markerlen = sizeof(MODULE_SIG_STRING) - 1; - const void *mod = info->hdr; - -- if (info->len > markerlen && -+ /* -+ * Require flags == 0, as a module with version information -+ * removed is no longer the module that was signed -+ */ -+ if (flags == 0 && -+ info->len > markerlen && - memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) { - /* We truncate the module to discard the signature */ - info->len -= markerlen; -@@ -2712,7 +2717,7 @@ static int module_sig_check(struct load_info *info) - return err; - } - #else /* !CONFIG_MODULE_SIG */ --static int module_sig_check(struct load_info *info) -+static int module_sig_check(struct load_info *info, int flags) - { - return 0; - } -@@ -3498,7 +3503,7 @@ static int load_module(struct load_info *info, const char __user *uargs, - long err; - char *after_dashes; - -- err = module_sig_check(info); -+ err = module_sig_check(info, flags); - if (err) - goto free_copy; - -diff --git a/mm/backing-dev.c b/mm/backing-dev.c -index ed173b8..9269911 100644 ---- a/mm/backing-dev.c -+++ b/mm/backing-dev.c -@@ -825,6 +825,20 @@ int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev) - } - EXPORT_SYMBOL(bdi_register_dev); - -+int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner) -+{ -+ int rc; -+ -+ rc = bdi_register(bdi, NULL, "%u:%u", MAJOR(owner->devt), -+ MINOR(owner->devt)); -+ if (rc) -+ return rc; -+ bdi->owner = owner; -+ get_device(owner); -+ return 0; -+} -+EXPORT_SYMBOL(bdi_register_owner); -+ - /* - * Remove bdi from bdi_list, and ensure that it is no longer visible - */ -@@ -849,6 +863,11 @@ void bdi_unregister(struct backing_dev_info *bdi) - device_unregister(bdi->dev); - bdi->dev = NULL; - } -+ -+ if (bdi->owner) { -+ put_device(bdi->owner); -+ bdi->owner = NULL; -+ } - } - - void bdi_exit(struct backing_dev_info *bdi) -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index addfe4ac..d9ec1a5 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -2214,6 +2214,10 @@ static unsigned long set_max_huge_pages(struct hstate *h, unsigned long count, - * and reducing the surplus. - */ - spin_unlock(&hugetlb_lock); -+ -+ /* yield cpu to avoid soft lockup */ -+ cond_resched(); -+ - if (hstate_is_gigantic(h)) - ret = alloc_fresh_gigantic_page(h, nodes_allowed); - else -diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c -index 388ee8b..1842141 100644 ---- a/net/bluetooth/l2cap_sock.c -+++ b/net/bluetooth/l2cap_sock.c -@@ -927,7 +927,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, - break; - } - -- if (get_user(opt, (u32 __user *) optval)) { -+ if (get_user(opt, (u16 __user *) optval)) { - err = -EFAULT; - break; - } -diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c -index 1325776..bd007a9 100644 ---- a/net/netlabel/netlabel_kapi.c -+++ b/net/netlabel/netlabel_kapi.c -@@ -824,7 +824,11 @@ socket_setattr_return: - */ - void netlbl_sock_delattr(struct sock *sk) - { -- cipso_v4_sock_delattr(sk); -+ switch (sk->sk_family) { -+ case AF_INET: -+ cipso_v4_sock_delattr(sk); -+ break; -+ } - } - - /** -@@ -987,7 +991,11 @@ req_setattr_return: - */ - void netlbl_req_delattr(struct request_sock *req) - { -- cipso_v4_req_delattr(req); -+ switch (req->rsk_ops->family) { -+ case AF_INET: -+ cipso_v4_req_delattr(req); -+ break; -+ } - } - - /** -diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c -index e1675927..42396a7 100644 ---- a/scripts/recordmcount.c -+++ b/scripts/recordmcount.c -@@ -33,10 +33,17 @@ - #include <string.h> - #include <unistd.h> - -+/* -+ * glibc synced up and added the metag number but didn't add the relocations. -+ * Work around this in a crude manner for now. -+ */ - #ifndef EM_METAG --/* Remove this when these make it to the standard system elf.h. */ - #define EM_METAG 174 -+#endif -+#ifndef R_METAG_ADDR32 - #define R_METAG_ADDR32 2 -+#endif -+#ifndef R_METAG_NONE - #define R_METAG_NONE 3 - #endif - -diff --git a/sound/hda/array.c b/sound/hda/array.c -index 516795b..5dfa610 100644 ---- a/sound/hda/array.c -+++ b/sound/hda/array.c -@@ -21,13 +21,15 @@ void *snd_array_new(struct snd_array *array) - return NULL; - if (array->used >= array->alloced) { - int num = array->alloced + array->alloc_align; -+ int oldsize = array->alloced * array->elem_size; - int size = (num + 1) * array->elem_size; - void *nlist; - if (snd_BUG_ON(num >= 4096)) - return NULL; -- nlist = krealloc(array->list, size, GFP_KERNEL | __GFP_ZERO); -+ nlist = krealloc(array->list, size, GFP_KERNEL); - if (!nlist) - return NULL; -+ memset(nlist + oldsize, 0, size - oldsize); - array->list = nlist; - array->alloced = num; - } -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 6f8ea13..89dacf9 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2265,6 +2265,8 @@ static const struct pci_device_id azx_ids[] = { - { PCI_DEVICE(0x1022, 0x780d), - .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, - /* ATI HDMI */ -+ { PCI_DEVICE(0x1002, 0x0002), -+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, - { PCI_DEVICE(0x1002, 0x1308), - .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, - { PCI_DEVICE(0x1002, 0x157a), -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index abcb5a6..f25479b 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -4674,6 +4674,22 @@ static void alc290_fixup_mono_speakers(struct hda_codec *codec, - } - } - -+static void alc298_fixup_speaker_volume(struct hda_codec *codec, -+ const struct hda_fixup *fix, int action) -+{ -+ if (action == HDA_FIXUP_ACT_PRE_PROBE) { -+ /* The speaker is routed to the Node 0x06 by a mistake, as a result -+ we can't adjust the speaker's volume since this node does not has -+ Amp-out capability. we change the speaker's route to: -+ Node 0x02 (Audio Output) -> Node 0x0c (Audio Mixer) -> Node 0x17 ( -+ Pin Complex), since Node 0x02 has Amp-out caps, we can adjust -+ speaker's volume now. */ -+ -+ hda_nid_t conn1[1] = { 0x0c }; -+ snd_hda_override_conn_list(codec, 0x17, 1, conn1); -+ } -+} -+ - /* Hook to update amp GPIO4 for automute */ - static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec, - struct hda_jack_callback *jack) -@@ -4823,6 +4839,7 @@ enum { - ALC280_FIXUP_HP_HEADSET_MIC, - ALC221_FIXUP_HP_FRONT_MIC, - ALC292_FIXUP_TPT460, -+ ALC298_FIXUP_SPK_VOLUME, - }; - - static const struct hda_fixup alc269_fixups[] = { -@@ -5478,6 +5495,12 @@ static const struct hda_fixup alc269_fixups[] = { - .chained = true, - .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE, - }, -+ [ALC298_FIXUP_SPK_VOLUME] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc298_fixup_speaker_volume, -+ .chained = true, -+ .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, -+ }, - }; - - static const struct snd_pci_quirk alc269_fixup_tbl[] = { -@@ -5524,6 +5547,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), - SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), - SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), -+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), - SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), -@@ -5799,6 +5823,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { - {0x1b, 0x01014020}, - {0x21, 0x0221103f}), - SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, -+ {0x14, 0x90170130}, -+ {0x1b, 0x02011020}, -+ {0x21, 0x0221103f}), -+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, - {0x14, 0x90170150}, - {0x1b, 0x02011020}, - {0x21, 0x0221105f}), -diff --git a/tools/objtool/.gitignore b/tools/objtool/.gitignore -index a0b3128..d3102c8 100644 ---- a/tools/objtool/.gitignore -+++ b/tools/objtool/.gitignore -@@ -1,2 +1,3 @@ - arch/x86/insn/inat-tables.c - objtool -+fixdep -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index 48bd520..dd25346 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -148,6 +148,7 @@ int vcpu_load(struct kvm_vcpu *vcpu) - put_cpu(); - return 0; - } -+EXPORT_SYMBOL_GPL(vcpu_load); - - void vcpu_put(struct kvm_vcpu *vcpu) - { -@@ -157,6 +158,7 @@ void vcpu_put(struct kvm_vcpu *vcpu) - preempt_enable(); - mutex_unlock(&vcpu->mutex); - } -+EXPORT_SYMBOL_GPL(vcpu_put); - - static void ack_flush(void *_completed) - { diff --git a/4.7.4/1002_linux-4.7.3.patch b/4.7.4/1002_linux-4.7.3.patch deleted file mode 100644 index caac684..0000000 --- a/4.7.4/1002_linux-4.7.3.patch +++ /dev/null @@ -1,4418 +0,0 @@ -diff --git a/Makefile b/Makefile -index bb98f1c..4afff18 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 7 --SUBLEVEL = 2 -+SUBLEVEL = 3 - EXTRAVERSION = - NAME = Psychotic Stoned Sheep - -diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h -index ad7860c..51597f3 100644 ---- a/arch/arc/include/asm/entry.h -+++ b/arch/arc/include/asm/entry.h -@@ -142,7 +142,7 @@ - - #ifdef CONFIG_ARC_CURR_IN_REG - ; Retrieve orig r25 and save it with rest of callee_regs -- ld.as r12, [r12, PT_user_r25] -+ ld r12, [r12, PT_user_r25] - PUSH r12 - #else - PUSH r25 -@@ -198,7 +198,7 @@ - - ; SP is back to start of pt_regs - #ifdef CONFIG_ARC_CURR_IN_REG -- st.as r12, [sp, PT_user_r25] -+ st r12, [sp, PT_user_r25] - #endif - .endm - -diff --git a/arch/arc/include/asm/irqflags-compact.h b/arch/arc/include/asm/irqflags-compact.h -index c1d3645..4c6eed8 100644 ---- a/arch/arc/include/asm/irqflags-compact.h -+++ b/arch/arc/include/asm/irqflags-compact.h -@@ -188,10 +188,10 @@ static inline int arch_irqs_disabled(void) - .endm - - .macro IRQ_ENABLE scratch -+ TRACE_ASM_IRQ_ENABLE - lr \scratch, [status32] - or \scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK) - flag \scratch -- TRACE_ASM_IRQ_ENABLE - .endm - - #endif /* __ASSEMBLY__ */ -diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h -index 0f92d97..89eeb37 100644 ---- a/arch/arc/include/asm/pgtable.h -+++ b/arch/arc/include/asm/pgtable.h -@@ -280,7 +280,7 @@ static inline void pmd_set(pmd_t *pmdp, pte_t *ptep) - - #define pte_page(pte) pfn_to_page(pte_pfn(pte)) - #define mk_pte(page, prot) pfn_pte(page_to_pfn(page), prot) --#define pfn_pte(pfn, prot) (__pte(((pte_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot))) -+#define pfn_pte(pfn, prot) __pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot)) - - /* Don't use virt_to_pfn for macros below: could cause truncations for PAE40*/ - #define pte_pfn(pte) (pte_val(pte) >> PAGE_SHIFT) -diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c -index 5a294b2..0b10efe 100644 ---- a/arch/arc/mm/cache.c -+++ b/arch/arc/mm/cache.c -@@ -921,6 +921,15 @@ void arc_cache_init(void) - - printk(arc_cache_mumbojumbo(0, str, sizeof(str))); - -+ /* -+ * Only master CPU needs to execute rest of function: -+ * - Assume SMP so all cores will have same cache config so -+ * any geomtry checks will be same for all -+ * - IOC setup / dma callbacks only need to be setup once -+ */ -+ if (cpu) -+ return; -+ - if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE)) { - struct cpuinfo_arc_cache *ic = &cpuinfo_arc700[cpu].icache; - -diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi -index 080203e..dc7f3bc 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi -@@ -270,6 +270,8 @@ - #io-channel-cells = <1>; - clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>; - clock-names = "saradc", "apb_pclk"; -+ resets = <&cru SRST_SARADC>; -+ reset-names = "saradc-apb"; - status = "disabled"; - }; - -diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h -index 579b6e6..a55384f 100644 ---- a/arch/arm64/include/asm/elf.h -+++ b/arch/arm64/include/asm/elf.h -@@ -140,6 +140,7 @@ typedef struct user_fpsimd_state elf_fpregset_t; - - #define SET_PERSONALITY(ex) clear_thread_flag(TIF_32BIT); - -+/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */ - #define ARCH_DLINFO \ - do { \ - NEW_AUX_ENT(AT_SYSINFO_EHDR, \ -diff --git a/arch/arm64/include/uapi/asm/auxvec.h b/arch/arm64/include/uapi/asm/auxvec.h -index 22d6d88..4cf0c17 100644 ---- a/arch/arm64/include/uapi/asm/auxvec.h -+++ b/arch/arm64/include/uapi/asm/auxvec.h -@@ -19,4 +19,6 @@ - /* vDSO location */ - #define AT_SYSINFO_EHDR 33 - -+#define AT_VECTOR_SIZE_ARCH 1 /* entries in ARCH_DLINFO */ -+ - #endif -diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S -index 2c6e598..aa68aad 100644 ---- a/arch/arm64/kernel/head.S -+++ b/arch/arm64/kernel/head.S -@@ -757,6 +757,9 @@ ENTRY(__enable_mmu) - isb - bl __create_page_tables // recreate kernel mapping - -+ tlbi vmalle1 // Remove any stale TLB entries -+ dsb nsh -+ - msr sctlr_el1, x19 // re-enable the MMU - isb - ic iallu // flush instructions fetched -diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S -index 9a3aec9..ccf79d8 100644 ---- a/arch/arm64/kernel/sleep.S -+++ b/arch/arm64/kernel/sleep.S -@@ -101,12 +101,20 @@ ENTRY(cpu_resume) - bl el2_setup // if in EL2 drop to EL1 cleanly - /* enable the MMU early - so we can access sleep_save_stash by va */ - adr_l lr, __enable_mmu /* __cpu_setup will return here */ -- ldr x27, =_cpu_resume /* __enable_mmu will branch here */ -+ adr_l x27, _resume_switched /* __enable_mmu will branch here */ - adrp x25, idmap_pg_dir - adrp x26, swapper_pg_dir - b __cpu_setup - ENDPROC(cpu_resume) - -+ .pushsection ".idmap.text", "ax" -+_resume_switched: -+ ldr x8, =_cpu_resume -+ br x8 -+ENDPROC(_resume_switched) -+ .ltorg -+ .popsection -+ - ENTRY(_cpu_resume) - mrs x1, mpidr_el1 - adrp x8, mpidr_hash -diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S -index 5bb61de..9d37e96 100644 ---- a/arch/arm64/mm/proc.S -+++ b/arch/arm64/mm/proc.S -@@ -100,7 +100,16 @@ ENTRY(cpu_do_resume) - - msr tcr_el1, x8 - msr vbar_el1, x9 -+ -+ /* -+ * __cpu_setup() cleared MDSCR_EL1.MDE and friends, before unmasking -+ * debug exceptions. By restoring MDSCR_EL1 here, we may take a debug -+ * exception. Mask them until local_dbg_restore() in cpu_suspend() -+ * resets them. -+ */ -+ disable_dbg - msr mdscr_el1, x10 -+ - msr sctlr_el1, x12 - /* - * Restore oslsr_el1 by writing oslar_el1 -diff --git a/arch/parisc/include/uapi/asm/errno.h b/arch/parisc/include/uapi/asm/errno.h -index c0ae625..274d5bc 100644 ---- a/arch/parisc/include/uapi/asm/errno.h -+++ b/arch/parisc/include/uapi/asm/errno.h -@@ -97,10 +97,10 @@ - #define ENOTCONN 235 /* Transport endpoint is not connected */ - #define ESHUTDOWN 236 /* Cannot send after transport endpoint shutdown */ - #define ETOOMANYREFS 237 /* Too many references: cannot splice */ --#define EREFUSED ECONNREFUSED /* for HP's NFS apparently */ - #define ETIMEDOUT 238 /* Connection timed out */ - #define ECONNREFUSED 239 /* Connection refused */ --#define EREMOTERELEASE 240 /* Remote peer released connection */ -+#define EREFUSED ECONNREFUSED /* for HP's NFS apparently */ -+#define EREMOTERELEASE 240 /* Remote peer released connection */ - #define EHOSTDOWN 241 /* Host is down */ - #define EHOSTUNREACH 242 /* No route to host */ - -diff --git a/arch/parisc/kernel/processor.c b/arch/parisc/kernel/processor.c -index 5adc339..0c2a94a 100644 ---- a/arch/parisc/kernel/processor.c -+++ b/arch/parisc/kernel/processor.c -@@ -51,8 +51,6 @@ EXPORT_SYMBOL(_parisc_requires_coherency); - - DEFINE_PER_CPU(struct cpuinfo_parisc, cpu_data); - --extern int update_cr16_clocksource(void); /* from time.c */ -- - /* - ** PARISC CPU driver - claim "device" and initialize CPU data structures. - ** -@@ -228,12 +226,6 @@ static int processor_probe(struct parisc_device *dev) - } - #endif - -- /* If we've registered more than one cpu, -- * we'll use the jiffies clocksource since cr16 -- * is not synchronized between CPUs. -- */ -- update_cr16_clocksource(); -- - return 0; - } - -diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c -index 31ec99a..5eea7dc 100644 ---- a/arch/parisc/kernel/time.c -+++ b/arch/parisc/kernel/time.c -@@ -220,18 +220,6 @@ static struct clocksource clocksource_cr16 = { - .flags = CLOCK_SOURCE_IS_CONTINUOUS, - }; - --int update_cr16_clocksource(void) --{ -- /* since the cr16 cycle counters are not synchronized across CPUs, -- we'll check if we should switch to a safe clocksource: */ -- if (clocksource_cr16.rating != 0 && num_online_cpus() > 1) { -- clocksource_change_rating(&clocksource_cr16, 0); -- return 1; -- } -- -- return 0; --} -- - void __init start_cpu_itimer(void) - { - unsigned int cpu = smp_processor_id(); -diff --git a/arch/um/include/asm/common.lds.S b/arch/um/include/asm/common.lds.S -index 1dd5bd8..1330553 100644 ---- a/arch/um/include/asm/common.lds.S -+++ b/arch/um/include/asm/common.lds.S -@@ -81,7 +81,7 @@ - .altinstr_replacement : { *(.altinstr_replacement) } - /* .exit.text is discard at runtime, not link time, to deal with references - from .altinstructions and .eh_frame */ -- .exit.text : { *(.exit.text) } -+ .exit.text : { EXIT_TEXT } - .exit.data : { *(.exit.data) } - - .preinit_array : { -diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h -index 4e5be94..6fa8594 100644 ---- a/arch/x86/include/asm/tlbflush.h -+++ b/arch/x86/include/asm/tlbflush.h -@@ -135,7 +135,14 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask) - - static inline void __native_flush_tlb(void) - { -+ /* -+ * If current->mm == NULL then we borrow a mm which may change during a -+ * task switch and therefore we must not be preempted while we write CR3 -+ * back: -+ */ -+ preempt_disable(); - native_write_cr3(native_read_cr3()); -+ preempt_enable(); - } - - static inline void __native_flush_tlb_global_irq_disabled(void) -diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c -index 6c1ff31..495c776 100644 ---- a/arch/x86/kernel/uprobes.c -+++ b/arch/x86/kernel/uprobes.c -@@ -357,20 +357,22 @@ static void riprel_analyze(struct arch_uprobe *auprobe, struct insn *insn) - *cursor &= 0xfe; - } - /* -- * Similar treatment for VEX3 prefix. -- * TODO: add XOP/EVEX treatment when insn decoder supports them -+ * Similar treatment for VEX3/EVEX prefix. -+ * TODO: add XOP treatment when insn decoder supports them - */ -- if (insn->vex_prefix.nbytes == 3) { -+ if (insn->vex_prefix.nbytes >= 3) { - /* - * vex2: c5 rvvvvLpp (has no b bit) - * vex3/xop: c4/8f rxbmmmmm wvvvvLpp - * evex: 62 rxbR00mm wvvvv1pp zllBVaaa -- * (evex will need setting of both b and x since -- * in non-sib encoding evex.x is 4th bit of MODRM.rm) -- * Setting VEX3.b (setting because it has inverted meaning): -+ * Setting VEX3.b (setting because it has inverted meaning). -+ * Setting EVEX.x since (in non-SIB encoding) EVEX.x -+ * is the 4th bit of MODRM.rm, and needs the same treatment. -+ * For VEX3-encoded insns, VEX3.x value has no effect in -+ * non-SIB encoding, the change is superfluous but harmless. - */ - cursor = auprobe->insn + insn_offset_vex_prefix(insn) + 1; -- *cursor |= 0x20; -+ *cursor |= 0x60; - } - - /* -@@ -415,12 +417,10 @@ static void riprel_analyze(struct arch_uprobe *auprobe, struct insn *insn) - - reg = MODRM_REG(insn); /* Fetch modrm.reg */ - reg2 = 0xff; /* Fetch vex.vvvv */ -- if (insn->vex_prefix.nbytes == 2) -- reg2 = insn->vex_prefix.bytes[1]; -- else if (insn->vex_prefix.nbytes == 3) -+ if (insn->vex_prefix.nbytes) - reg2 = insn->vex_prefix.bytes[2]; - /* -- * TODO: add XOP, EXEV vvvv reading. -+ * TODO: add XOP vvvv reading. - * - * vex.vvvv field is in bits 6-3, bits are inverted. - * But in 32-bit mode, high-order bit may be ignored. -diff --git a/arch/x86/platform/uv/bios_uv.c b/arch/x86/platform/uv/bios_uv.c -index 815fec6..17943a8 100644 ---- a/arch/x86/platform/uv/bios_uv.c -+++ b/arch/x86/platform/uv/bios_uv.c -@@ -188,7 +188,8 @@ EXPORT_SYMBOL_GPL(uv_bios_set_legacy_vga_target); - void uv_bios_init(void) - { - uv_systab = NULL; -- if ((efi.uv_systab == EFI_INVALID_TABLE_ADDR) || !efi.uv_systab) { -+ if ((efi.uv_systab == EFI_INVALID_TABLE_ADDR) || -+ !efi.uv_systab || efi_runtime_disabled()) { - pr_crit("UV: UVsystab: missing\n"); - return; - } -diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c -index 8adac69..2e98173 100644 ---- a/drivers/acpi/cppc_acpi.c -+++ b/drivers/acpi/cppc_acpi.c -@@ -299,8 +299,10 @@ int acpi_get_psd_map(struct cpudata **all_cpu_data) - continue; - - cpc_ptr = per_cpu(cpc_desc_ptr, i); -- if (!cpc_ptr) -- continue; -+ if (!cpc_ptr) { -+ retval = -EFAULT; -+ goto err_ret; -+ } - - pdomain = &(cpc_ptr->domain_info); - cpumask_set_cpu(i, pr->shared_cpu_map); -@@ -322,8 +324,10 @@ int acpi_get_psd_map(struct cpudata **all_cpu_data) - continue; - - match_cpc_ptr = per_cpu(cpc_desc_ptr, j); -- if (!match_cpc_ptr) -- continue; -+ if (!match_cpc_ptr) { -+ retval = -EFAULT; -+ goto err_ret; -+ } - - match_pdomain = &(match_cpc_ptr->domain_info); - if (match_pdomain->domain != pdomain->domain) -@@ -353,8 +357,10 @@ int acpi_get_psd_map(struct cpudata **all_cpu_data) - continue; - - match_cpc_ptr = per_cpu(cpc_desc_ptr, j); -- if (!match_cpc_ptr) -- continue; -+ if (!match_cpc_ptr) { -+ retval = -EFAULT; -+ goto err_ret; -+ } - - match_pdomain = &(match_cpc_ptr->domain_info); - if (match_pdomain->domain != pdomain->domain) -@@ -595,9 +601,6 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) - /* Store CPU Logical ID */ - cpc_ptr->cpu_id = pr->id; - -- /* Plug it into this CPUs CPC descriptor. */ -- per_cpu(cpc_desc_ptr, pr->id) = cpc_ptr; -- - /* Parse PSD data for this CPU */ - ret = acpi_get_psd(cpc_ptr, handle); - if (ret) -@@ -610,6 +613,9 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) - goto out_free; - } - -+ /* Plug PSD data into this CPUs CPC descriptor. */ -+ per_cpu(cpc_desc_ptr, pr->id) = cpc_ptr; -+ - /* Everything looks okay */ - pr_debug("Parsed CPC struct for CPU: %d\n", pr->id); - -diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c -index 1f0e060..375c10f 100644 ---- a/drivers/acpi/nfit.c -+++ b/drivers/acpi/nfit.c -@@ -1396,11 +1396,12 @@ static u32 read_blk_stat(struct nfit_blk *nfit_blk, unsigned int bw) - { - struct nfit_blk_mmio *mmio = &nfit_blk->mmio[DCR]; - u64 offset = nfit_blk->stat_offset + mmio->size * bw; -+ const u32 STATUS_MASK = 0x80000037; - - if (mmio->num_lines) - offset = to_interleave_offset(offset, mmio); - -- return readl(mmio->addr.base + offset); -+ return readl(mmio->addr.base + offset) & STATUS_MASK; - } - - static void write_blk_ctl(struct nfit_blk *nfit_blk, unsigned int bw, -diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c -index 5f28cf7..f3c0222 100644 ---- a/drivers/acpi/scan.c -+++ b/drivers/acpi/scan.c -@@ -1967,7 +1967,7 @@ int __init acpi_scan_init(void) - - static struct acpi_probe_entry *ape; - static int acpi_probe_count; --static DEFINE_SPINLOCK(acpi_probe_lock); -+static DEFINE_MUTEX(acpi_probe_mutex); - - static int __init acpi_match_madt(struct acpi_subtable_header *header, - const unsigned long end) -@@ -1986,7 +1986,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr) - if (acpi_disabled) - return 0; - -- spin_lock(&acpi_probe_lock); -+ mutex_lock(&acpi_probe_mutex); - for (ape = ap_head; nr; ape++, nr--) { - if (ACPI_COMPARE_NAME(ACPI_SIG_MADT, ape->id)) { - acpi_probe_count = 0; -@@ -1999,7 +1999,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr) - count++; - } - } -- spin_unlock(&acpi_probe_lock); -+ mutex_unlock(&acpi_probe_mutex); - - return count; - } -diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c -index a1dcf12..84708a5 100644 ---- a/drivers/block/floppy.c -+++ b/drivers/block/floppy.c -@@ -3663,6 +3663,11 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) - - opened_bdev[drive] = bdev; - -+ if (!(mode & (FMODE_READ|FMODE_WRITE))) { -+ res = -EINVAL; -+ goto out; -+ } -+ - res = -ENXIO; - - if (!floppy_track_buffer) { -@@ -3706,15 +3711,13 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) - if (UFDCS->rawcmd == 1) - UFDCS->rawcmd = 2; - -- if (mode & (FMODE_READ|FMODE_WRITE)) { -- UDRS->last_checked = 0; -- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); -- check_disk_change(bdev); -- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) -- goto out; -- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) -- goto out; -- } -+ UDRS->last_checked = 0; -+ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); -+ check_disk_change(bdev); -+ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) -+ goto out; -+ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) -+ goto out; - - res = -EROFS; - -diff --git a/drivers/clk/renesas/r8a7795-cpg-mssr.c b/drivers/clk/renesas/r8a7795-cpg-mssr.c -index ca5519c..e7b98c4 100644 ---- a/drivers/clk/renesas/r8a7795-cpg-mssr.c -+++ b/drivers/clk/renesas/r8a7795-cpg-mssr.c -@@ -91,6 +91,7 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = { - DEF_FIXED(".s1", CLK_S1, CLK_PLL1_DIV2, 3, 1), - DEF_FIXED(".s2", CLK_S2, CLK_PLL1_DIV2, 4, 1), - DEF_FIXED(".s3", CLK_S3, CLK_PLL1_DIV2, 6, 1), -+ DEF_FIXED(".sdsrc", CLK_SDSRC, CLK_PLL1_DIV2, 2, 1), - - /* Core Clock Outputs */ - DEF_FIXED("ztr", R8A7795_CLK_ZTR, CLK_PLL1_DIV2, 6, 1), -@@ -109,10 +110,10 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = { - DEF_FIXED("s3d2", R8A7795_CLK_S3D2, CLK_S3, 2, 1), - DEF_FIXED("s3d4", R8A7795_CLK_S3D4, CLK_S3, 4, 1), - -- DEF_GEN3_SD("sd0", R8A7795_CLK_SD0, CLK_PLL1_DIV2, 0x0074), -- DEF_GEN3_SD("sd1", R8A7795_CLK_SD1, CLK_PLL1_DIV2, 0x0078), -- DEF_GEN3_SD("sd2", R8A7795_CLK_SD2, CLK_PLL1_DIV2, 0x0268), -- DEF_GEN3_SD("sd3", R8A7795_CLK_SD3, CLK_PLL1_DIV2, 0x026c), -+ DEF_GEN3_SD("sd0", R8A7795_CLK_SD0, CLK_SDSRC, 0x0074), -+ DEF_GEN3_SD("sd1", R8A7795_CLK_SD1, CLK_SDSRC, 0x0078), -+ DEF_GEN3_SD("sd2", R8A7795_CLK_SD2, CLK_SDSRC, 0x0268), -+ DEF_GEN3_SD("sd3", R8A7795_CLK_SD3, CLK_SDSRC, 0x026c), - - DEF_FIXED("cl", R8A7795_CLK_CL, CLK_PLL1_DIV2, 48, 1), - DEF_FIXED("cp", R8A7795_CLK_CP, CLK_EXTAL, 2, 1), -diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c -index ea8189f..6dc5971 100644 ---- a/drivers/crypto/caam/caamalg.c -+++ b/drivers/crypto/caam/caamalg.c -@@ -441,6 +441,9 @@ static int aead_set_sh_desc(struct crypto_aead *aead) - OP_ALG_AAI_CTR_MOD128); - const bool is_rfc3686 = alg->caam.rfc3686; - -+ if (!ctx->authsize) -+ return 0; -+ - /* NULL encryption / decryption */ - if (!ctx->enckeylen) - return aead_null_set_sh_desc(aead); -@@ -614,7 +617,7 @@ skip_enc: - keys_fit_inline = true; - - /* aead_givencrypt shared descriptor */ -- desc = ctx->sh_desc_givenc; -+ desc = ctx->sh_desc_enc; - - /* Note: Context registers are saved. */ - init_sh_desc_key_aead(desc, ctx, keys_fit_inline, is_rfc3686); -@@ -645,13 +648,13 @@ copy_iv: - append_operation(desc, ctx->class2_alg_type | - OP_ALG_AS_INITFINAL | OP_ALG_ENCRYPT); - -- /* ivsize + cryptlen = seqoutlen - authsize */ -- append_math_sub_imm_u32(desc, REG3, SEQOUTLEN, IMM, ctx->authsize); -- - /* Read and write assoclen bytes */ - append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ); - append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ); - -+ /* ivsize + cryptlen = seqoutlen - authsize */ -+ append_math_sub_imm_u32(desc, REG3, SEQOUTLEN, IMM, ctx->authsize); -+ - /* Skip assoc data */ - append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF); - -@@ -697,7 +700,7 @@ copy_iv: - ctx->sh_desc_enc_dma = dma_map_single(jrdev, desc, - desc_bytes(desc), - DMA_TO_DEVICE); -- if (dma_mapping_error(jrdev, ctx->sh_desc_givenc_dma)) { -+ if (dma_mapping_error(jrdev, ctx->sh_desc_enc_dma)) { - dev_err(jrdev, "unable to map shared descriptor\n"); - return -ENOMEM; - } -diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c -index 5845d4a..e9703f9 100644 ---- a/drivers/crypto/caam/caamhash.c -+++ b/drivers/crypto/caam/caamhash.c -@@ -1897,6 +1897,7 @@ caam_hash_alloc(struct caam_hash_template *template, - template->name); - snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s", - template->driver_name); -+ t_alg->ahash_alg.setkey = NULL; - } - alg->cra_module = THIS_MODULE; - alg->cra_init = caam_hash_cra_init; -diff --git a/drivers/crypto/nx/nx.c b/drivers/crypto/nx/nx.c -index 0794f1c..42f0f22 100644 ---- a/drivers/crypto/nx/nx.c -+++ b/drivers/crypto/nx/nx.c -@@ -392,7 +392,7 @@ static void nx_of_update_msc(struct device *dev, - ((bytes_so_far + sizeof(struct msc_triplet)) <= lenp) && - i < msc->triplets; - i++) { -- if (msc->fc > NX_MAX_FC || msc->mode > NX_MAX_MODE) { -+ if (msc->fc >= NX_MAX_FC || msc->mode >= NX_MAX_MODE) { - dev_err(dev, "unknown function code/mode " - "combo: %d/%d (ignored)\n", msc->fc, - msc->mode); -diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c -index 1e8852a8..4c9deef 100644 ---- a/drivers/crypto/qat/qat_common/qat_algs.c -+++ b/drivers/crypto/qat/qat_common/qat_algs.c -@@ -1260,8 +1260,8 @@ static struct crypto_alg qat_algs[] = { { - .setkey = qat_alg_ablkcipher_xts_setkey, - .decrypt = qat_alg_ablkcipher_decrypt, - .encrypt = qat_alg_ablkcipher_encrypt, -- .min_keysize = AES_MIN_KEY_SIZE, -- .max_keysize = AES_MAX_KEY_SIZE, -+ .min_keysize = 2 * AES_MIN_KEY_SIZE, -+ .max_keysize = 2 * AES_MAX_KEY_SIZE, - .ivsize = AES_BLOCK_SIZE, - }, - }, -diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c -index 55d510e..82e6743 100644 ---- a/drivers/dax/pmem.c -+++ b/drivers/dax/pmem.c -@@ -118,6 +118,9 @@ static int dax_pmem_probe(struct device *dev) - return rc; - } - -+ /* adjust the dax_region resource to the start of data */ -+ res.start += le64_to_cpu(pfn_sb->dataoff); -+ - nd_region = to_nd_region(dev->parent); - dax_region = alloc_dax_region(dev, nd_region->id, &res, - le32_to_cpu(pfn_sb->align), addr, PFN_DEV|PFN_MAP); -diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c -index 749f1bd..06ecdc3 100644 ---- a/drivers/dma/sh/usb-dmac.c -+++ b/drivers/dma/sh/usb-dmac.c -@@ -600,27 +600,30 @@ static irqreturn_t usb_dmac_isr_channel(int irq, void *dev) - { - struct usb_dmac_chan *chan = dev; - irqreturn_t ret = IRQ_NONE; -- u32 mask = USB_DMACHCR_TE; -- u32 check_bits = USB_DMACHCR_TE | USB_DMACHCR_SP; -+ u32 mask = 0; - u32 chcr; -+ bool xfer_end = false; - - spin_lock(&chan->vc.lock); - - chcr = usb_dmac_chan_read(chan, USB_DMACHCR); -- if (chcr & check_bits) -- mask |= USB_DMACHCR_DE | check_bits; -+ if (chcr & (USB_DMACHCR_TE | USB_DMACHCR_SP)) { -+ mask |= USB_DMACHCR_DE | USB_DMACHCR_TE | USB_DMACHCR_SP; -+ if (chcr & USB_DMACHCR_DE) -+ xfer_end = true; -+ ret |= IRQ_HANDLED; -+ } - if (chcr & USB_DMACHCR_NULL) { - /* An interruption of TE will happen after we set FTE */ - mask |= USB_DMACHCR_NULL; - chcr |= USB_DMACHCR_FTE; - ret |= IRQ_HANDLED; - } -- usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask); -+ if (mask) -+ usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask); - -- if (chcr & check_bits) { -+ if (xfer_end) - usb_dmac_isr_transfer_end(chan); -- ret |= IRQ_HANDLED; -- } - - spin_unlock(&chan->vc.lock); - -diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c -index 4fb2eb7..ce0067b 100644 ---- a/drivers/edac/sb_edac.c -+++ b/drivers/edac/sb_edac.c -@@ -552,9 +552,9 @@ static const struct pci_id_table pci_dev_descr_haswell_table[] = { - /* Knight's Landing Support */ - /* - * KNL's memory channels are swizzled between memory controllers. -- * MC0 is mapped to CH3,5,6 and MC1 is mapped to CH0,1,2 -+ * MC0 is mapped to CH3,4,5 and MC1 is mapped to CH0,1,2 - */ --#define knl_channel_remap(channel) ((channel + 3) % 6) -+#define knl_channel_remap(mc, chan) ((mc) ? (chan) : (chan) + 3) - - /* Memory controller, TAD tables, error injection - 2-8-0, 2-9-0 (2 of these) */ - #define PCI_DEVICE_ID_INTEL_KNL_IMC_MC 0x7840 -@@ -1286,7 +1286,7 @@ static u32 knl_get_mc_route(int entry, u32 reg) - mc = GET_BITFIELD(reg, entry*3, (entry*3)+2); - chan = GET_BITFIELD(reg, (entry*2) + 18, (entry*2) + 18 + 1); - -- return knl_channel_remap(mc*3 + chan); -+ return knl_channel_remap(mc, chan); - } - - /* -@@ -2997,8 +2997,15 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci, - } else { - char A = *("A"); - -- channel = knl_channel_remap(channel); -+ /* -+ * Reported channel is in range 0-2, so we can't map it -+ * back to mc. To figure out mc we check machine check -+ * bank register that reported this error. -+ * bank15 means mc0 and bank16 means mc1. -+ */ -+ channel = knl_channel_remap(m->bank == 16, channel); - channel_mask = 1 << channel; -+ - snprintf(msg, sizeof(msg), - "%s%s err_code:%04x:%04x channel:%d (DIMM_%c)", - overflow ? " OVERFLOW" : "", -diff --git a/drivers/firmware/efi/capsule-loader.c b/drivers/firmware/efi/capsule-loader.c -index c99c24b..9ae6c11 100644 ---- a/drivers/firmware/efi/capsule-loader.c -+++ b/drivers/firmware/efi/capsule-loader.c -@@ -16,6 +16,7 @@ - #include <linux/slab.h> - #include <linux/mutex.h> - #include <linux/efi.h> -+#include <linux/vmalloc.h> - - #define NO_FURTHER_WRITE_ACTION -1 - -@@ -108,14 +109,15 @@ static ssize_t efi_capsule_submit_update(struct capsule_info *cap_info) - int ret; - void *cap_hdr_temp; - -- cap_hdr_temp = kmap(cap_info->pages[0]); -+ cap_hdr_temp = vmap(cap_info->pages, cap_info->index, -+ VM_MAP, PAGE_KERNEL); - if (!cap_hdr_temp) { -- pr_debug("%s: kmap() failed\n", __func__); -+ pr_debug("%s: vmap() failed\n", __func__); - return -EFAULT; - } - - ret = efi_capsule_update(cap_hdr_temp, cap_info->pages); -- kunmap(cap_info->pages[0]); -+ vunmap(cap_hdr_temp); - if (ret) { - pr_err("%s: efi_capsule_update() failed\n", __func__); - return ret; -diff --git a/drivers/firmware/efi/capsule.c b/drivers/firmware/efi/capsule.c -index 53b9fd2..6eedff4 100644 ---- a/drivers/firmware/efi/capsule.c -+++ b/drivers/firmware/efi/capsule.c -@@ -190,9 +190,9 @@ efi_capsule_update_locked(efi_capsule_header_t *capsule, - * map the capsule described by @capsule with its data in @pages and - * send it to the firmware via the UpdateCapsule() runtime service. - * -- * @capsule must be a virtual mapping of the first page in @pages -- * (@pages[0]) in the kernel address space. That is, a -- * capsule_header_t that describes the entire contents of the capsule -+ * @capsule must be a virtual mapping of the complete capsule update in the -+ * kernel address space, as the capsule can be consumed immediately. -+ * A capsule_header_t that describes the entire contents of the capsule - * must be at the start of the first data page. - * - * Even though this function will validate that the firmware supports -diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig -index d786061..5d457ff 100644 ---- a/drivers/gpio/Kconfig -+++ b/drivers/gpio/Kconfig -@@ -50,6 +50,7 @@ config GPIO_DEVRES - config OF_GPIO - def_bool y - depends on OF -+ depends on HAS_IOMEM - - config GPIO_ACPI - def_bool y -diff --git a/drivers/gpio/gpio-max730x.c b/drivers/gpio/gpio-max730x.c -index 0880736..946d091 100644 ---- a/drivers/gpio/gpio-max730x.c -+++ b/drivers/gpio/gpio-max730x.c -@@ -192,6 +192,10 @@ int __max730x_probe(struct max7301 *ts) - ts->chip.parent = dev; - ts->chip.owner = THIS_MODULE; - -+ ret = gpiochip_add_data(&ts->chip, ts); -+ if (ret) -+ goto exit_destroy; -+ - /* - * initialize pullups according to platform data and cache the - * register values for later use. -@@ -213,10 +217,6 @@ int __max730x_probe(struct max7301 *ts) - } - } - -- ret = gpiochip_add_data(&ts->chip, ts); -- if (ret) -- goto exit_destroy; -- - return ret; - - exit_destroy: -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -index e055d5be..56475b1 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -@@ -415,6 +415,8 @@ struct amdgpu_mman { - - /* custom LRU management */ - struct amdgpu_mman_lru log2_size[AMDGPU_TTM_LRU_SIZE]; -+ /* guard for log2_size array, don't add anything in between */ -+ struct amdgpu_mman_lru guard; - }; - - int amdgpu_copy_buffer(struct amdgpu_ring *ring, -@@ -637,9 +639,9 @@ int amdgpu_gart_table_vram_pin(struct amdgpu_device *adev); - void amdgpu_gart_table_vram_unpin(struct amdgpu_device *adev); - int amdgpu_gart_init(struct amdgpu_device *adev); - void amdgpu_gart_fini(struct amdgpu_device *adev); --void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset, -+void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset, - int pages); --int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset, -+int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset, - int pages, struct page **pagelist, - dma_addr_t *dma_addr, uint32_t flags); - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -index 9831753..fe872b8 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -@@ -321,6 +321,19 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device * - (le16_to_cpu(path->usConnObjectId) & - OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT; - -+ /* Skip TV/CV support */ -+ if ((le16_to_cpu(path->usDeviceTag) == -+ ATOM_DEVICE_TV1_SUPPORT) || -+ (le16_to_cpu(path->usDeviceTag) == -+ ATOM_DEVICE_CV_SUPPORT)) -+ continue; -+ -+ if (con_obj_id >= ARRAY_SIZE(object_connector_convert)) { -+ DRM_ERROR("invalid con_obj_id %d for device tag 0x%04x\n", -+ con_obj_id, le16_to_cpu(path->usDeviceTag)); -+ continue; -+ } -+ - connector_type = - object_connector_convert[con_obj_id]; - connector_object_id = con_obj_id; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c -index 921bce2..0feea34 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c -@@ -221,7 +221,7 @@ void amdgpu_gart_table_vram_free(struct amdgpu_device *adev) - * Unbinds the requested pages from the gart page table and - * replaces them with the dummy page (all asics). - */ --void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset, -+void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset, - int pages) - { - unsigned t; -@@ -268,7 +268,7 @@ void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset, - * (all asics). - * Returns 0 for success, -EINVAL for failure. - */ --int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset, -+int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset, - int pages, struct page **pagelist, dma_addr_t *dma_addr, - uint32_t flags) - { -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c -index 34e3542..194cfc1 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c -@@ -288,7 +288,7 @@ void amdgpu_ib_pool_fini(struct amdgpu_device *adev) - int amdgpu_ib_ring_tests(struct amdgpu_device *adev) - { - unsigned i; -- int r; -+ int r, ret = 0; - - for (i = 0; i < AMDGPU_MAX_RINGS; ++i) { - struct amdgpu_ring *ring = adev->rings[i]; -@@ -309,10 +309,11 @@ int amdgpu_ib_ring_tests(struct amdgpu_device *adev) - } else { - /* still not good, but we can live with it */ - DRM_ERROR("amdgpu: failed testing IB on ring %d (%d).\n", i, r); -+ ret = r; - } - } - } -- return 0; -+ return ret; - } - - /* -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -index 3b9053a..46c5297 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -@@ -251,8 +251,8 @@ static int amdgpu_move_blit(struct ttm_buffer_object *bo, - - adev = amdgpu_get_adev(bo->bdev); - ring = adev->mman.buffer_funcs_ring; -- old_start = old_mem->start << PAGE_SHIFT; -- new_start = new_mem->start << PAGE_SHIFT; -+ old_start = (u64)old_mem->start << PAGE_SHIFT; -+ new_start = (u64)new_mem->start << PAGE_SHIFT; - - switch (old_mem->mem_type) { - case TTM_PL_VRAM: -@@ -943,6 +943,8 @@ static struct list_head *amdgpu_ttm_lru_tail(struct ttm_buffer_object *tbo) - struct list_head *res = lru->lru[tbo->mem.mem_type]; - - lru->lru[tbo->mem.mem_type] = &tbo->lru; -+ while ((++lru)->lru[tbo->mem.mem_type] == res) -+ lru->lru[tbo->mem.mem_type] = &tbo->lru; - - return res; - } -@@ -953,6 +955,8 @@ static struct list_head *amdgpu_ttm_swap_lru_tail(struct ttm_buffer_object *tbo) - struct list_head *res = lru->swap_lru; - - lru->swap_lru = &tbo->swap; -+ while ((++lru)->swap_lru == res) -+ lru->swap_lru = &tbo->swap; - - return res; - } -@@ -1004,6 +1008,10 @@ int amdgpu_ttm_init(struct amdgpu_device *adev) - lru->swap_lru = &adev->mman.bdev.glob->swap_lru; - } - -+ for (j = 0; j < TTM_NUM_MEM_TYPES; ++j) -+ adev->mman.guard.lru[j] = NULL; -+ adev->mman.guard.swap_lru = NULL; -+ - adev->mman.initialized = true; - r = ttm_bo_init_mm(&adev->mman.bdev, TTM_PL_VRAM, - adev->mc.real_vram_size >> PAGE_SHIFT); -diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c -index 9dc4e24..3a1bbe2 100644 ---- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c -+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c -@@ -52,6 +52,7 @@ static void cik_sdma_set_ring_funcs(struct amdgpu_device *adev); - static void cik_sdma_set_irq_funcs(struct amdgpu_device *adev); - static void cik_sdma_set_buffer_funcs(struct amdgpu_device *adev); - static void cik_sdma_set_vm_pte_funcs(struct amdgpu_device *adev); -+static int cik_sdma_soft_reset(void *handle); - - MODULE_FIRMWARE("radeon/bonaire_sdma.bin"); - MODULE_FIRMWARE("radeon/bonaire_sdma1.bin"); -@@ -1051,6 +1052,8 @@ static int cik_sdma_resume(void *handle) - { - struct amdgpu_device *adev = (struct amdgpu_device *)handle; - -+ cik_sdma_soft_reset(handle); -+ - return cik_sdma_hw_init(adev); - } - -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c -index fc8ff4d..6b40809 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c -@@ -2777,8 +2777,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev) - u64 wb_gpu_addr; - u32 *buf; - struct bonaire_mqd *mqd; -- -- gfx_v7_0_cp_compute_enable(adev, true); -+ struct amdgpu_ring *ring; - - /* fix up chicken bits */ - tmp = RREG32(mmCP_CPF_DEBUG); -@@ -2813,7 +2812,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev) - - /* init the queues. Just two for now. */ - for (i = 0; i < adev->gfx.num_compute_rings; i++) { -- struct amdgpu_ring *ring = &adev->gfx.compute_ring[i]; -+ ring = &adev->gfx.compute_ring[i]; - - if (ring->mqd_obj == NULL) { - r = amdgpu_bo_create(adev, -@@ -2992,6 +2991,13 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev) - amdgpu_bo_unreserve(ring->mqd_obj); - - ring->ready = true; -+ } -+ -+ gfx_v7_0_cp_compute_enable(adev, true); -+ -+ for (i = 0; i < adev->gfx.num_compute_rings; i++) { -+ ring = &adev->gfx.compute_ring[i]; -+ - r = amdgpu_ring_test_ring(ring); - if (r) - ring->ready = false; -diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c -index 85c4deb..fd3553b 100644 ---- a/drivers/gpu/drm/i915/i915_drv.c -+++ b/drivers/gpu/drm/i915/i915_drv.c -@@ -1578,6 +1578,9 @@ static int intel_runtime_suspend(struct device *device) - - assert_forcewakes_inactive(dev_priv); - -+ if (!IS_VALLEYVIEW(dev_priv) || !IS_CHERRYVIEW(dev_priv)) -+ intel_hpd_poll_init(dev_priv); -+ - DRM_DEBUG_KMS("Device suspended\n"); - return 0; - } -diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h -index 227a63e..0ed5fd3 100644 ---- a/drivers/gpu/drm/i915/i915_drv.h -+++ b/drivers/gpu/drm/i915/i915_drv.h -@@ -281,6 +281,9 @@ struct i915_hotplug { - u32 short_port_mask; - struct work_struct dig_port_work; - -+ struct work_struct poll_init_work; -+ bool poll_enabled; -+ - /* - * if we get a HPD irq from DP and a HPD irq from non-DP - * the non-DP HPD could block the workqueue on a mode config -@@ -2791,6 +2794,8 @@ void intel_hpd_init(struct drm_i915_private *dev_priv); - void intel_hpd_init_work(struct drm_i915_private *dev_priv); - void intel_hpd_cancel_work(struct drm_i915_private *dev_priv); - bool intel_hpd_pin_to_port(enum hpd_pin pin, enum port *port); -+bool intel_hpd_disable(struct drm_i915_private *dev_priv, enum hpd_pin pin); -+void intel_hpd_enable(struct drm_i915_private *dev_priv, enum hpd_pin pin); - - /* i915_irq.c */ - void i915_queue_hangcheck(struct drm_device *dev); -diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c -index 92acdff..e856f79 100644 ---- a/drivers/gpu/drm/i915/i915_gem_gtt.c -+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c -@@ -2826,6 +2826,7 @@ void i915_ggtt_cleanup_hw(struct drm_device *dev) - struct i915_hw_ppgtt *ppgtt = dev_priv->mm.aliasing_ppgtt; - - ppgtt->base.cleanup(&ppgtt->base); -+ kfree(ppgtt); - } - - i915_gem_cleanup_stolen(dev); -diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h -index bc3b6dd..5369a6d 100644 ---- a/drivers/gpu/drm/i915/i915_reg.h -+++ b/drivers/gpu/drm/i915/i915_reg.h -@@ -1522,6 +1522,7 @@ enum skl_disp_power_wells { - #define BALANCE_LEG_MASK(port) (7<<(8+3*(port))) - /* Balance leg disable bits */ - #define BALANCE_LEG_DISABLE_SHIFT 23 -+#define BALANCE_LEG_DISABLE(port) (1 << (23 + (port))) - - /* - * Fence registers -diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c -index 02a7527..74eca43 100644 ---- a/drivers/gpu/drm/i915/intel_audio.c -+++ b/drivers/gpu/drm/i915/intel_audio.c -@@ -600,6 +600,8 @@ static void i915_audio_component_codec_wake_override(struct device *dev, - if (!IS_SKYLAKE(dev_priv) && !IS_KABYLAKE(dev_priv)) - return; - -+ i915_audio_component_get_power(dev); -+ - /* - * Enable/disable generating the codec wake signal, overriding the - * internal logic to generate the codec wake to controller. -@@ -615,6 +617,8 @@ static void i915_audio_component_codec_wake_override(struct device *dev, - I915_WRITE(HSW_AUD_CHICKENBIT, tmp); - usleep_range(1000, 1500); - } -+ -+ i915_audio_component_put_power(dev); - } - - /* Get CDCLK in kHz */ -@@ -654,6 +658,7 @@ static int i915_audio_component_sync_audio_rate(struct device *dev, - !IS_HASWELL(dev_priv)) - return 0; - -+ i915_audio_component_get_power(dev); - mutex_lock(&dev_priv->av_mutex); - /* 1. get the pipe */ - intel_encoder = dev_priv->dig_port_map[port]; -@@ -704,6 +709,7 @@ static int i915_audio_component_sync_audio_rate(struct device *dev, - - unlock: - mutex_unlock(&dev_priv->av_mutex); -+ i915_audio_component_put_power(dev); - return err; - } - -diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c -index 3fbb6fc..a3f87d6 100644 ---- a/drivers/gpu/drm/i915/intel_crt.c -+++ b/drivers/gpu/drm/i915/intel_crt.c -@@ -327,10 +327,25 @@ static bool valleyview_crt_detect_hotplug(struct drm_connector *connector) - struct drm_device *dev = connector->dev; - struct intel_crt *crt = intel_attached_crt(connector); - struct drm_i915_private *dev_priv = dev->dev_private; -+ bool reenable_hpd; - u32 adpa; - bool ret; - u32 save_adpa; - -+ /* -+ * Doing a force trigger causes a hpd interrupt to get sent, which can -+ * get us stuck in a loop if we're polling: -+ * - We enable power wells and reset the ADPA -+ * - output_poll_exec does force probe on VGA, triggering a hpd -+ * - HPD handler waits for poll to unlock dev->mode_config.mutex -+ * - output_poll_exec shuts off the ADPA, unlocks -+ * dev->mode_config.mutex -+ * - HPD handler runs, resets ADPA and brings us back to the start -+ * -+ * Just disable HPD interrupts here to prevent this -+ */ -+ reenable_hpd = intel_hpd_disable(dev_priv, crt->base.hpd_pin); -+ - save_adpa = adpa = I915_READ(crt->adpa_reg); - DRM_DEBUG_KMS("trigger hotplug detect cycle: adpa=0x%x\n", adpa); - -@@ -353,6 +368,9 @@ static bool valleyview_crt_detect_hotplug(struct drm_connector *connector) - - DRM_DEBUG_KMS("valleyview hotplug adpa=0x%x, result %d\n", adpa, ret); - -+ if (reenable_hpd) -+ intel_hpd_enable(dev_priv, crt->base.hpd_pin); -+ - return ret; - } - -@@ -713,11 +731,11 @@ static int intel_crt_set_property(struct drm_connector *connector, - return 0; - } - --static void intel_crt_reset(struct drm_connector *connector) -+void intel_crt_reset(struct drm_encoder *encoder) - { -- struct drm_device *dev = connector->dev; -+ struct drm_device *dev = encoder->dev; - struct drm_i915_private *dev_priv = dev->dev_private; -- struct intel_crt *crt = intel_attached_crt(connector); -+ struct intel_crt *crt = intel_encoder_to_crt(to_intel_encoder(encoder)); - - if (INTEL_INFO(dev)->gen >= 5) { - u32 adpa; -@@ -739,7 +757,6 @@ static void intel_crt_reset(struct drm_connector *connector) - */ - - static const struct drm_connector_funcs intel_crt_connector_funcs = { -- .reset = intel_crt_reset, - .dpms = drm_atomic_helper_connector_dpms, - .detect = intel_crt_detect, - .fill_modes = drm_helper_probe_single_connector_modes, -@@ -757,6 +774,7 @@ static const struct drm_connector_helper_funcs intel_crt_connector_helper_funcs - }; - - static const struct drm_encoder_funcs intel_crt_enc_funcs = { -+ .reset = intel_crt_reset, - .destroy = intel_encoder_destroy, - }; - -@@ -902,5 +920,5 @@ void intel_crt_init(struct drm_device *dev) - dev_priv->fdi_rx_config = I915_READ(FDI_RX_CTL(PIPE_A)) & fdi_config; - } - -- intel_crt_reset(connector); -+ intel_crt_reset(&crt->base.base); - } -diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c -index 01e523d..12c4f43 100644 ---- a/drivers/gpu/drm/i915/intel_ddi.c -+++ b/drivers/gpu/drm/i915/intel_ddi.c -@@ -145,7 +145,7 @@ static const struct ddi_buf_trans skl_ddi_translations_dp[] = { - static const struct ddi_buf_trans skl_u_ddi_translations_dp[] = { - { 0x0000201B, 0x000000A2, 0x0 }, - { 0x00005012, 0x00000088, 0x0 }, -- { 0x80007011, 0x000000CD, 0x0 }, -+ { 0x80007011, 0x000000CD, 0x1 }, - { 0x80009010, 0x000000C0, 0x1 }, - { 0x0000201B, 0x0000009D, 0x0 }, - { 0x80005012, 0x000000C0, 0x1 }, -@@ -158,7 +158,7 @@ static const struct ddi_buf_trans skl_u_ddi_translations_dp[] = { - static const struct ddi_buf_trans skl_y_ddi_translations_dp[] = { - { 0x00000018, 0x000000A2, 0x0 }, - { 0x00005012, 0x00000088, 0x0 }, -- { 0x80007011, 0x000000CD, 0x0 }, -+ { 0x80007011, 0x000000CD, 0x3 }, - { 0x80009010, 0x000000C0, 0x3 }, - { 0x00000018, 0x0000009D, 0x0 }, - { 0x80005012, 0x000000C0, 0x3 }, -@@ -388,6 +388,40 @@ skl_get_buf_trans_hdmi(struct drm_i915_private *dev_priv, int *n_entries) - } - } - -+static int intel_ddi_hdmi_level(struct drm_i915_private *dev_priv, enum port port) -+{ -+ int n_hdmi_entries; -+ int hdmi_level; -+ int hdmi_default_entry; -+ -+ hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift; -+ -+ if (IS_BROXTON(dev_priv)) -+ return hdmi_level; -+ -+ if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) { -+ skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries); -+ hdmi_default_entry = 8; -+ } else if (IS_BROADWELL(dev_priv)) { -+ n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi); -+ hdmi_default_entry = 7; -+ } else if (IS_HASWELL(dev_priv)) { -+ n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi); -+ hdmi_default_entry = 6; -+ } else { -+ WARN(1, "ddi translation table missing\n"); -+ n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi); -+ hdmi_default_entry = 7; -+ } -+ -+ /* Choose a good default if VBT is badly populated */ -+ if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN || -+ hdmi_level >= n_hdmi_entries) -+ hdmi_level = hdmi_default_entry; -+ -+ return hdmi_level; -+} -+ - /* - * Starting with Haswell, DDI port buffers must be programmed with correct - * values in advance. The buffer values are different for FDI and DP modes, -@@ -399,7 +433,7 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder) - { - struct drm_i915_private *dev_priv = to_i915(encoder->base.dev); - u32 iboost_bit = 0; -- int i, n_hdmi_entries, n_dp_entries, n_edp_entries, hdmi_default_entry, -+ int i, n_hdmi_entries, n_dp_entries, n_edp_entries, - size; - int hdmi_level; - enum port port; -@@ -410,7 +444,7 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder) - const struct ddi_buf_trans *ddi_translations; - - port = intel_ddi_get_encoder_port(encoder); -- hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift; -+ hdmi_level = intel_ddi_hdmi_level(dev_priv, port); - - if (IS_BROXTON(dev_priv)) { - if (encoder->type != INTEL_OUTPUT_HDMI) -@@ -430,7 +464,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder) - skl_get_buf_trans_edp(dev_priv, &n_edp_entries); - ddi_translations_hdmi = - skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries); -- hdmi_default_entry = 8; - /* If we're boosting the current, set bit 31 of trans1 */ - if (dev_priv->vbt.ddi_port_info[port].hdmi_boost_level || - dev_priv->vbt.ddi_port_info[port].dp_boost_level) -@@ -456,7 +489,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder) - - n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp); - n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi); -- hdmi_default_entry = 7; - } else if (IS_HASWELL(dev_priv)) { - ddi_translations_fdi = hsw_ddi_translations_fdi; - ddi_translations_dp = hsw_ddi_translations_dp; -@@ -464,7 +496,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder) - ddi_translations_hdmi = hsw_ddi_translations_hdmi; - n_dp_entries = n_edp_entries = ARRAY_SIZE(hsw_ddi_translations_dp); - n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi); -- hdmi_default_entry = 6; - } else { - WARN(1, "ddi translation table missing\n"); - ddi_translations_edp = bdw_ddi_translations_dp; -@@ -474,7 +505,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder) - n_edp_entries = ARRAY_SIZE(bdw_ddi_translations_edp); - n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp); - n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi); -- hdmi_default_entry = 7; - } - - switch (encoder->type) { -@@ -505,11 +535,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder) - if (encoder->type != INTEL_OUTPUT_HDMI) - return; - -- /* Choose a good default if VBT is badly populated */ -- if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN || -- hdmi_level >= n_hdmi_entries) -- hdmi_level = hdmi_default_entry; -- - /* Entry 9 is for HDMI: */ - I915_WRITE(DDI_BUF_TRANS_LO(port, i), - ddi_translations_hdmi[hdmi_level].trans1 | iboost_bit); -@@ -1371,14 +1396,30 @@ void intel_ddi_disable_pipe_clock(struct intel_crtc *intel_crtc) - TRANS_CLK_SEL_DISABLED); - } - --static void skl_ddi_set_iboost(struct drm_i915_private *dev_priv, -- u32 level, enum port port, int type) -+static void _skl_ddi_set_iboost(struct drm_i915_private *dev_priv, -+ enum port port, uint8_t iboost) - { -+ u32 tmp; -+ -+ tmp = I915_READ(DISPIO_CR_TX_BMU_CR0); -+ tmp &= ~(BALANCE_LEG_MASK(port) | BALANCE_LEG_DISABLE(port)); -+ if (iboost) -+ tmp |= iboost << BALANCE_LEG_SHIFT(port); -+ else -+ tmp |= BALANCE_LEG_DISABLE(port); -+ I915_WRITE(DISPIO_CR_TX_BMU_CR0, tmp); -+} -+ -+static void skl_ddi_set_iboost(struct intel_encoder *encoder, u32 level) -+{ -+ struct intel_digital_port *intel_dig_port = enc_to_dig_port(&encoder->base); -+ struct drm_i915_private *dev_priv = to_i915(intel_dig_port->base.base.dev); -+ enum port port = intel_dig_port->port; -+ int type = encoder->type; - const struct ddi_buf_trans *ddi_translations; - uint8_t iboost; - uint8_t dp_iboost, hdmi_iboost; - int n_entries; -- u32 reg; - - /* VBT may override standard boost values */ - dp_iboost = dev_priv->vbt.ddi_port_info[port].dp_boost_level; -@@ -1420,16 +1461,10 @@ static void skl_ddi_set_iboost(struct drm_i915_private *dev_priv, - return; - } - -- reg = I915_READ(DISPIO_CR_TX_BMU_CR0); -- reg &= ~BALANCE_LEG_MASK(port); -- reg &= ~(1 << (BALANCE_LEG_DISABLE_SHIFT + port)); -- -- if (iboost) -- reg |= iboost << BALANCE_LEG_SHIFT(port); -- else -- reg |= 1 << (BALANCE_LEG_DISABLE_SHIFT + port); -+ _skl_ddi_set_iboost(dev_priv, port, iboost); - -- I915_WRITE(DISPIO_CR_TX_BMU_CR0, reg); -+ if (port == PORT_A && intel_dig_port->max_lanes == 4) -+ _skl_ddi_set_iboost(dev_priv, PORT_E, iboost); - } - - static void bxt_ddi_vswing_sequence(struct drm_i915_private *dev_priv, -@@ -1560,7 +1595,7 @@ uint32_t ddi_signal_levels(struct intel_dp *intel_dp) - level = translate_signal_level(signal_levels); - - if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) -- skl_ddi_set_iboost(dev_priv, level, port, encoder->type); -+ skl_ddi_set_iboost(encoder, level); - else if (IS_BROXTON(dev_priv)) - bxt_ddi_vswing_sequence(dev_priv, level, port, encoder->type); - -@@ -1629,6 +1664,10 @@ static void intel_ddi_pre_enable(struct intel_encoder *intel_encoder) - intel_dp_stop_link_train(intel_dp); - } else if (type == INTEL_OUTPUT_HDMI) { - struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder); -+ int level = intel_ddi_hdmi_level(dev_priv, port); -+ -+ if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) -+ skl_ddi_set_iboost(intel_encoder, level); - - intel_hdmi->set_infoframes(encoder, - crtc->config->has_hdmi_sink, -diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h -index f7f0f01..94144a7 100644 ---- a/drivers/gpu/drm/i915/intel_drv.h -+++ b/drivers/gpu/drm/i915/intel_drv.h -@@ -1052,7 +1052,7 @@ void gen8_irq_power_well_pre_disable(struct drm_i915_private *dev_priv, - - /* intel_crt.c */ - void intel_crt_init(struct drm_device *dev); -- -+void intel_crt_reset(struct drm_encoder *encoder); - - /* intel_ddi.c */ - void intel_ddi_clk_select(struct intel_encoder *encoder, -@@ -1346,6 +1346,8 @@ void intel_dsi_init(struct drm_device *dev); - - /* intel_dvo.c */ - void intel_dvo_init(struct drm_device *dev); -+/* intel_hotplug.c */ -+void intel_hpd_poll_init(struct drm_i915_private *dev_priv); - - - /* legacy fbdev emulation in intel_fbdev.c */ -diff --git a/drivers/gpu/drm/i915/intel_hotplug.c b/drivers/gpu/drm/i915/intel_hotplug.c -index bee6730..2c49458 100644 ---- a/drivers/gpu/drm/i915/intel_hotplug.c -+++ b/drivers/gpu/drm/i915/intel_hotplug.c -@@ -453,20 +453,47 @@ void intel_hpd_irq_handler(struct drm_device *dev, - * - * This is a separate step from interrupt enabling to simplify the locking rules - * in the driver load and resume code. -+ * -+ * Also see: intel_hpd_poll_init(), which enables connector polling - */ - void intel_hpd_init(struct drm_i915_private *dev_priv) - { -- struct drm_device *dev = dev_priv->dev; -- struct drm_mode_config *mode_config = &dev->mode_config; -- struct drm_connector *connector; - int i; - - for_each_hpd_pin(i) { - dev_priv->hotplug.stats[i].count = 0; - dev_priv->hotplug.stats[i].state = HPD_ENABLED; - } -+ -+ WRITE_ONCE(dev_priv->hotplug.poll_enabled, false); -+ schedule_work(&dev_priv->hotplug.poll_init_work); -+ -+ /* -+ * Interrupt setup is already guaranteed to be single-threaded, this is -+ * just to make the assert_spin_locked checks happy. -+ */ -+ spin_lock_irq(&dev_priv->irq_lock); -+ if (dev_priv->display.hpd_irq_setup) -+ dev_priv->display.hpd_irq_setup(dev_priv->dev); -+ spin_unlock_irq(&dev_priv->irq_lock); -+} -+ -+void i915_hpd_poll_init_work(struct work_struct *work) { -+ struct drm_i915_private *dev_priv = -+ container_of(work, struct drm_i915_private, -+ hotplug.poll_init_work); -+ struct drm_device *dev = dev_priv->dev; -+ struct drm_mode_config *mode_config = &dev->mode_config; -+ struct drm_connector *connector; -+ bool enabled; -+ -+ mutex_lock(&dev->mode_config.mutex); -+ -+ enabled = READ_ONCE(dev_priv->hotplug.poll_enabled); -+ - list_for_each_entry(connector, &mode_config->connector_list, head) { -- struct intel_connector *intel_connector = to_intel_connector(connector); -+ struct intel_connector *intel_connector = -+ to_intel_connector(connector); - connector->polled = intel_connector->polled; - - /* MST has a dynamic intel_connector->encoder and it's reprobing -@@ -475,24 +502,62 @@ void intel_hpd_init(struct drm_i915_private *dev_priv) - continue; - - if (!connector->polled && I915_HAS_HOTPLUG(dev) && -- intel_connector->encoder->hpd_pin > HPD_NONE) -- connector->polled = DRM_CONNECTOR_POLL_HPD; -+ intel_connector->encoder->hpd_pin > HPD_NONE) { -+ connector->polled = enabled ? -+ DRM_CONNECTOR_POLL_CONNECT | -+ DRM_CONNECTOR_POLL_DISCONNECT : -+ DRM_CONNECTOR_POLL_HPD; -+ } - } - -+ if (enabled) -+ drm_kms_helper_poll_enable_locked(dev); -+ -+ mutex_unlock(&dev->mode_config.mutex); -+ - /* -- * Interrupt setup is already guaranteed to be single-threaded, this is -- * just to make the assert_spin_locked checks happy. -+ * We might have missed any hotplugs that happened while we were -+ * in the middle of disabling polling - */ -- spin_lock_irq(&dev_priv->irq_lock); -- if (dev_priv->display.hpd_irq_setup) -- dev_priv->display.hpd_irq_setup(dev); -- spin_unlock_irq(&dev_priv->irq_lock); -+ if (!enabled) -+ drm_helper_hpd_irq_event(dev); -+} -+ -+/** -+ * intel_hpd_poll_init - enables/disables polling for connectors with hpd -+ * @dev_priv: i915 device instance -+ * @enabled: Whether to enable or disable polling -+ * -+ * This function enables polling for all connectors, regardless of whether or -+ * not they support hotplug detection. Under certain conditions HPD may not be -+ * functional. On most Intel GPUs, this happens when we enter runtime suspend. -+ * On Valleyview and Cherryview systems, this also happens when we shut off all -+ * of the powerwells. -+ * -+ * Since this function can get called in contexts where we're already holding -+ * dev->mode_config.mutex, we do the actual hotplug enabling in a seperate -+ * worker. -+ * -+ * Also see: intel_hpd_init(), which restores hpd handling. -+ */ -+void intel_hpd_poll_init(struct drm_i915_private *dev_priv) -+{ -+ WRITE_ONCE(dev_priv->hotplug.poll_enabled, true); -+ -+ /* -+ * We might already be holding dev->mode_config.mutex, so do this in a -+ * seperate worker -+ * As well, there's no issue if we race here since we always reschedule -+ * this worker anyway -+ */ -+ schedule_work(&dev_priv->hotplug.poll_init_work); - } - - void intel_hpd_init_work(struct drm_i915_private *dev_priv) - { - INIT_WORK(&dev_priv->hotplug.hotplug_work, i915_hotplug_work_func); - INIT_WORK(&dev_priv->hotplug.dig_port_work, i915_digport_work_func); -+ INIT_WORK(&dev_priv->hotplug.poll_init_work, i915_hpd_poll_init_work); - INIT_DELAYED_WORK(&dev_priv->hotplug.reenable_work, - intel_hpd_irq_storm_reenable_work); - } -@@ -509,5 +574,33 @@ void intel_hpd_cancel_work(struct drm_i915_private *dev_priv) - - cancel_work_sync(&dev_priv->hotplug.dig_port_work); - cancel_work_sync(&dev_priv->hotplug.hotplug_work); -+ cancel_work_sync(&dev_priv->hotplug.poll_init_work); - cancel_delayed_work_sync(&dev_priv->hotplug.reenable_work); - } -+ -+bool intel_hpd_disable(struct drm_i915_private *dev_priv, enum hpd_pin pin) -+{ -+ bool ret = false; -+ -+ if (pin == HPD_NONE) -+ return false; -+ -+ spin_lock_irq(&dev_priv->irq_lock); -+ if (dev_priv->hotplug.stats[pin].state == HPD_ENABLED) { -+ dev_priv->hotplug.stats[pin].state = HPD_DISABLED; -+ ret = true; -+ } -+ spin_unlock_irq(&dev_priv->irq_lock); -+ -+ return ret; -+} -+ -+void intel_hpd_enable(struct drm_i915_private *dev_priv, enum hpd_pin pin) -+{ -+ if (pin == HPD_NONE) -+ return; -+ -+ spin_lock_irq(&dev_priv->irq_lock); -+ dev_priv->hotplug.stats[pin].state = HPD_ENABLED; -+ spin_unlock_irq(&dev_priv->irq_lock); -+} -diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c -index 7fb1da4..2592b39 100644 ---- a/drivers/gpu/drm/i915/intel_runtime_pm.c -+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c -@@ -952,6 +952,7 @@ static void vlv_init_display_clock_gating(struct drm_i915_private *dev_priv) - - static void vlv_display_power_well_init(struct drm_i915_private *dev_priv) - { -+ struct intel_encoder *encoder; - enum pipe pipe; - - /* -@@ -987,6 +988,12 @@ static void vlv_display_power_well_init(struct drm_i915_private *dev_priv) - - intel_hpd_init(dev_priv); - -+ /* Re-enable the ADPA, if we have one */ -+ for_each_intel_encoder(dev_priv->dev, encoder) { -+ if (encoder->type == INTEL_OUTPUT_ANALOG) -+ intel_crt_reset(&encoder->base); -+ } -+ - i915_redisable_vga_power_on(dev_priv->dev); - } - -@@ -1000,6 +1007,8 @@ static void vlv_display_power_well_deinit(struct drm_i915_private *dev_priv) - synchronize_irq(dev_priv->dev->irq); - - vlv_power_sequencer_reset(dev_priv); -+ -+ intel_hpd_poll_init(dev_priv); - } - - static void vlv_display_power_well_enable(struct drm_i915_private *dev_priv, -diff --git a/drivers/hwmon/iio_hwmon.c b/drivers/hwmon/iio_hwmon.c -index b550ba5..8944987 100644 ---- a/drivers/hwmon/iio_hwmon.c -+++ b/drivers/hwmon/iio_hwmon.c -@@ -110,24 +110,24 @@ static int iio_hwmon_probe(struct platform_device *pdev) - - switch (type) { - case IIO_VOLTAGE: -- a->dev_attr.attr.name = kasprintf(GFP_KERNEL, -- "in%d_input", -- in_i++); -+ a->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, -+ "in%d_input", -+ in_i++); - break; - case IIO_TEMP: -- a->dev_attr.attr.name = kasprintf(GFP_KERNEL, -- "temp%d_input", -- temp_i++); -+ a->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, -+ "temp%d_input", -+ temp_i++); - break; - case IIO_CURRENT: -- a->dev_attr.attr.name = kasprintf(GFP_KERNEL, -- "curr%d_input", -- curr_i++); -+ a->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, -+ "curr%d_input", -+ curr_i++); - break; - case IIO_HUMIDITYRELATIVE: -- a->dev_attr.attr.name = kasprintf(GFP_KERNEL, -- "humidity%d_input", -- humidity_i++); -+ a->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, -+ "humidity%d_input", -+ humidity_i++); - break; - default: - ret = -EINVAL; -diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c -index 730d840..55bf479 100644 ---- a/drivers/hwmon/it87.c -+++ b/drivers/hwmon/it87.c -@@ -2015,6 +2015,7 @@ static struct attribute *it87_attributes_in[] = { - &sensor_dev_attr_in10_input.dev_attr.attr, /* 41 */ - &sensor_dev_attr_in11_input.dev_attr.attr, /* 41 */ - &sensor_dev_attr_in12_input.dev_attr.attr, /* 41 */ -+ NULL - }; - - static const struct attribute_group it87_group_in = { -diff --git a/drivers/i2c/busses/i2c-cros-ec-tunnel.c b/drivers/i2c/busses/i2c-cros-ec-tunnel.c -index a0d95ff..2d5ff863 100644 ---- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c -+++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c -@@ -215,7 +215,7 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[], - msg->outsize = request_len; - msg->insize = response_len; - -- result = cros_ec_cmd_xfer(bus->ec, msg); -+ result = cros_ec_cmd_xfer_status(bus->ec, msg); - if (result < 0) { - dev_err(dev, "Error transferring EC i2c message %d\n", result); - goto exit; -diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c -index 8de073a..215ac87 100644 ---- a/drivers/i2c/muxes/i2c-demux-pinctrl.c -+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c -@@ -68,7 +68,7 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne - adap = of_find_i2c_adapter_by_node(priv->chan[new_chan].parent_np); - if (!adap) { - ret = -ENODEV; -- goto err; -+ goto err_with_revert; - } - - p = devm_pinctrl_get_select(adap->dev.parent, priv->bus_name); -@@ -103,6 +103,8 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne - - err_with_put: - i2c_put_adapter(adap); -+ err_with_revert: -+ of_changeset_revert(&priv->chan[new_chan].chgset); - err: - dev_err(priv->dev, "failed to setup demux-adapter %d (%d)\n", new_chan, ret); - return ret; -diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c -index 90462fc..49bf9c5 100644 ---- a/drivers/iio/industrialio-buffer.c -+++ b/drivers/iio/industrialio-buffer.c -@@ -107,6 +107,7 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf, - { - struct iio_dev *indio_dev = filp->private_data; - struct iio_buffer *rb = indio_dev->buffer; -+ DEFINE_WAIT_FUNC(wait, woken_wake_function); - size_t datum_size; - size_t to_wait; - int ret; -@@ -131,19 +132,29 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf, - else - to_wait = min_t(size_t, n / datum_size, rb->watermark); - -+ add_wait_queue(&rb->pollq, &wait); - do { -- ret = wait_event_interruptible(rb->pollq, -- iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size)); -- if (ret) -- return ret; -+ if (!indio_dev->info) { -+ ret = -ENODEV; -+ break; -+ } - -- if (!indio_dev->info) -- return -ENODEV; -+ if (!iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size)) { -+ if (signal_pending(current)) { -+ ret = -ERESTARTSYS; -+ break; -+ } -+ -+ wait_woken(&wait, TASK_INTERRUPTIBLE, -+ MAX_SCHEDULE_TIMEOUT); -+ continue; -+ } - - ret = rb->access->read_first_n(rb, n, buf); - if (ret == 0 && (filp->f_flags & O_NONBLOCK)) - ret = -EAGAIN; - } while (ret == 0); -+ remove_wait_queue(&rb->pollq, &wait); - - return ret; - } -diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c -index acc5394..29485bc 100644 ---- a/drivers/input/keyboard/tegra-kbc.c -+++ b/drivers/input/keyboard/tegra-kbc.c -@@ -376,7 +376,7 @@ static int tegra_kbc_start(struct tegra_kbc *kbc) - /* Reset the KBC controller to clear all previous status.*/ - reset_control_assert(kbc->rst); - udelay(100); -- reset_control_assert(kbc->rst); -+ reset_control_deassert(kbc->rst); - udelay(100); - - tegra_kbc_config_pins(kbc); -diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c -index faa295e..c83bce8 100644 ---- a/drivers/input/rmi4/rmi_driver.c -+++ b/drivers/input/rmi4/rmi_driver.c -@@ -553,7 +553,6 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr, - goto free_struct_buff; - - reg = find_first_bit(rdesc->presense_map, RMI_REG_DESC_PRESENSE_BITS); -- map_offset = 0; - for (i = 0; i < rdesc->num_registers; i++) { - struct rmi_register_desc_item *item = &rdesc->registers[i]; - int reg_size = struct_buf[offset]; -@@ -576,6 +575,8 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr, - item->reg = reg; - item->reg_size = reg_size; - -+ map_offset = 0; -+ - do { - for (b = 0; b < 7; b++) { - if (struct_buf[offset] & (0x1 << b)) -diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c -index 4541957..405252a 100644 ---- a/drivers/input/serio/i8042.c -+++ b/drivers/input/serio/i8042.c -@@ -1277,6 +1277,7 @@ static int __init i8042_create_kbd_port(void) - serio->start = i8042_start; - serio->stop = i8042_stop; - serio->close = i8042_port_close; -+ serio->ps2_cmd_mutex = &i8042_mutex; - serio->port_data = port; - serio->dev.parent = &i8042_platform_device->dev; - strlcpy(serio->name, "i8042 KBD port", sizeof(serio->name)); -@@ -1304,6 +1305,7 @@ static int __init i8042_create_aux_port(int idx) - serio->write = i8042_aux_write; - serio->start = i8042_start; - serio->stop = i8042_stop; -+ serio->ps2_cmd_mutex = &i8042_mutex; - serio->port_data = port; - serio->dev.parent = &i8042_platform_device->dev; - if (idx < 0) { -@@ -1373,21 +1375,6 @@ static void i8042_unregister_ports(void) - } - } - --/* -- * Checks whether port belongs to i8042 controller. -- */ --bool i8042_check_port_owner(const struct serio *port) --{ -- int i; -- -- for (i = 0; i < I8042_NUM_PORTS; i++) -- if (i8042_ports[i].serio == port) -- return true; -- -- return false; --} --EXPORT_SYMBOL(i8042_check_port_owner); -- - static void i8042_free_irqs(void) - { - if (i8042_aux_irq_registered) -diff --git a/drivers/input/serio/libps2.c b/drivers/input/serio/libps2.c -index 316f2c8..83e9c66 100644 ---- a/drivers/input/serio/libps2.c -+++ b/drivers/input/serio/libps2.c -@@ -56,19 +56,17 @@ EXPORT_SYMBOL(ps2_sendbyte); - - void ps2_begin_command(struct ps2dev *ps2dev) - { -- mutex_lock(&ps2dev->cmd_mutex); -+ struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex; - -- if (i8042_check_port_owner(ps2dev->serio)) -- i8042_lock_chip(); -+ mutex_lock(m); - } - EXPORT_SYMBOL(ps2_begin_command); - - void ps2_end_command(struct ps2dev *ps2dev) - { -- if (i8042_check_port_owner(ps2dev->serio)) -- i8042_unlock_chip(); -+ struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex; - -- mutex_unlock(&ps2dev->cmd_mutex); -+ mutex_unlock(m); - } - EXPORT_SYMBOL(ps2_end_command); - -diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c -index 5f6b3bc..46ba2b6 100644 ---- a/drivers/iommu/arm-smmu-v3.c -+++ b/drivers/iommu/arm-smmu-v3.c -@@ -879,7 +879,7 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu) - * We may have concurrent producers, so we need to be careful - * not to touch any of the shadow cmdq state. - */ -- queue_read(cmd, Q_ENT(q, idx), q->ent_dwords); -+ queue_read(cmd, Q_ENT(q, cons), q->ent_dwords); - dev_err(smmu->dev, "skipping command in error state:\n"); - for (i = 0; i < ARRAY_SIZE(cmd); ++i) - dev_err(smmu->dev, "\t0x%016llx\n", (unsigned long long)cmd[i]); -@@ -890,7 +890,7 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu) - return; - } - -- queue_write(cmd, Q_ENT(q, idx), q->ent_dwords); -+ queue_write(Q_ENT(q, cons), cmd, q->ent_dwords); - } - - static void arm_smmu_cmdq_issue_cmd(struct arm_smmu_device *smmu, -@@ -1034,6 +1034,9 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid, - case STRTAB_STE_0_CFG_S2_TRANS: - ste_live = true; - break; -+ case STRTAB_STE_0_CFG_ABORT: -+ if (disable_bypass) -+ break; - default: - BUG(); /* STE corruption */ - } -diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c -index 9345a3f..31422d4 100644 ---- a/drivers/iommu/arm-smmu.c -+++ b/drivers/iommu/arm-smmu.c -@@ -686,8 +686,7 @@ static struct iommu_gather_ops arm_smmu_gather_ops = { - - static irqreturn_t arm_smmu_context_fault(int irq, void *dev) - { -- int flags, ret; -- u32 fsr, fsynr, resume; -+ u32 fsr, fsynr; - unsigned long iova; - struct iommu_domain *domain = dev; - struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain); -@@ -701,34 +700,15 @@ static irqreturn_t arm_smmu_context_fault(int irq, void *dev) - if (!(fsr & FSR_FAULT)) - return IRQ_NONE; - -- if (fsr & FSR_IGN) -- dev_err_ratelimited(smmu->dev, -- "Unexpected context fault (fsr 0x%x)\n", -- fsr); -- - fsynr = readl_relaxed(cb_base + ARM_SMMU_CB_FSYNR0); -- flags = fsynr & FSYNR0_WNR ? IOMMU_FAULT_WRITE : IOMMU_FAULT_READ; -- - iova = readq_relaxed(cb_base + ARM_SMMU_CB_FAR); -- if (!report_iommu_fault(domain, smmu->dev, iova, flags)) { -- ret = IRQ_HANDLED; -- resume = RESUME_RETRY; -- } else { -- dev_err_ratelimited(smmu->dev, -- "Unhandled context fault: iova=0x%08lx, fsynr=0x%x, cb=%d\n", -- iova, fsynr, cfg->cbndx); -- ret = IRQ_NONE; -- resume = RESUME_TERMINATE; -- } -- -- /* Clear the faulting FSR */ -- writel(fsr, cb_base + ARM_SMMU_CB_FSR); - -- /* Retry or terminate any stalled transactions */ -- if (fsr & FSR_SS) -- writel_relaxed(resume, cb_base + ARM_SMMU_CB_RESUME); -+ dev_err_ratelimited(smmu->dev, -+ "Unhandled context fault: fsr=0x%x, iova=0x%08lx, fsynr=0x%x, cb=%d\n", -+ fsr, iova, fsynr, cfg->cbndx); - -- return ret; -+ writel(fsr, cb_base + ARM_SMMU_CB_FSR); -+ return IRQ_HANDLED; - } - - static irqreturn_t arm_smmu_global_fault(int irq, void *dev) -@@ -837,7 +817,7 @@ static void arm_smmu_init_context_bank(struct arm_smmu_domain *smmu_domain, - } - - /* SCTLR */ -- reg = SCTLR_CFCFG | SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP; -+ reg = SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP; - if (stage1) - reg |= SCTLR_S1_ASIDPNE; - #ifdef __BIG_ENDIAN -diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c -index ea5a9eb..97a2308 100644 ---- a/drivers/iommu/dma-iommu.c -+++ b/drivers/iommu/dma-iommu.c -@@ -68,7 +68,8 @@ void iommu_put_dma_cookie(struct iommu_domain *domain) - if (!iovad) - return; - -- put_iova_domain(iovad); -+ if (iovad->granule) -+ put_iova_domain(iovad); - kfree(iovad); - domain->iova_cookie = NULL; - } -diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c -index 8c61399..def8ca1 100644 ---- a/drivers/iommu/io-pgtable-arm-v7s.c -+++ b/drivers/iommu/io-pgtable-arm-v7s.c -@@ -286,12 +286,14 @@ static int arm_v7s_pte_to_prot(arm_v7s_iopte pte, int lvl) - int prot = IOMMU_READ; - arm_v7s_iopte attr = pte >> ARM_V7S_ATTR_SHIFT(lvl); - -- if (attr & ARM_V7S_PTE_AP_RDONLY) -+ if (!(attr & ARM_V7S_PTE_AP_RDONLY)) - prot |= IOMMU_WRITE; - if ((attr & (ARM_V7S_TEX_MASK << ARM_V7S_TEX_SHIFT)) == 0) - prot |= IOMMU_MMIO; - else if (pte & ARM_V7S_ATTR_C) - prot |= IOMMU_CACHE; -+ if (pte & ARM_V7S_ATTR_XN(lvl)) -+ prot |= IOMMU_NOEXEC; - - return prot; - } -diff --git a/drivers/md/dm-round-robin.c b/drivers/md/dm-round-robin.c -index 4ace1da..6c25213 100644 ---- a/drivers/md/dm-round-robin.c -+++ b/drivers/md/dm-round-robin.c -@@ -210,14 +210,17 @@ static struct dm_path *rr_select_path(struct path_selector *ps, size_t nr_bytes) - struct path_info *pi = NULL; - struct dm_path *current_path = NULL; - -+ local_irq_save(flags); - current_path = *this_cpu_ptr(s->current_path); - if (current_path) { - percpu_counter_dec(&s->repeat_count); -- if (percpu_counter_read_positive(&s->repeat_count) > 0) -+ if (percpu_counter_read_positive(&s->repeat_count) > 0) { -+ local_irq_restore(flags); - return current_path; -+ } - } - -- spin_lock_irqsave(&s->lock, flags); -+ spin_lock(&s->lock); - if (!list_empty(&s->valid_paths)) { - pi = list_entry(s->valid_paths.next, struct path_info, list); - list_move_tail(&pi->list, &s->valid_paths); -diff --git a/drivers/of/base.c b/drivers/of/base.c -index 8bb3d1a..c6a8f47 100644 ---- a/drivers/of/base.c -+++ b/drivers/of/base.c -@@ -2318,20 +2318,13 @@ struct device_node *of_graph_get_endpoint_by_regs( - const struct device_node *parent, int port_reg, int reg) - { - struct of_endpoint endpoint; -- struct device_node *node, *prev_node = NULL; -- -- while (1) { -- node = of_graph_get_next_endpoint(parent, prev_node); -- of_node_put(prev_node); -- if (!node) -- break; -+ struct device_node *node = NULL; - -+ for_each_endpoint_of_node(parent, node) { - of_graph_parse_endpoint(node, &endpoint); - if (((port_reg == -1) || (endpoint.port == port_reg)) && - ((reg == -1) || (endpoint.id == reg))) - return node; -- -- prev_node = node; - } - - return NULL; -diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c -index a080f44..565e2a4 100644 ---- a/drivers/pci/msi.c -+++ b/drivers/pci/msi.c -@@ -1277,6 +1277,8 @@ struct irq_domain *pci_msi_create_irq_domain(struct fwnode_handle *fwnode, - if (info->flags & MSI_FLAG_USE_DEF_CHIP_OPS) - pci_msi_domain_update_chip_ops(info); - -+ info->flags |= MSI_FLAG_ACTIVATE_EARLY; -+ - domain = msi_create_irq_domain(fwnode, info, parent); - if (!domain) - return NULL; -diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c -index 11623c6..44e69c9 100644 ---- a/drivers/pinctrl/meson/pinctrl-meson.c -+++ b/drivers/pinctrl/meson/pinctrl-meson.c -@@ -727,13 +727,7 @@ static int meson_pinctrl_probe(struct platform_device *pdev) - return PTR_ERR(pc->pcdev); - } - -- ret = meson_gpiolib_register(pc); -- if (ret) { -- pinctrl_unregister(pc->pcdev); -- return ret; -- } -- -- return 0; -+ return meson_gpiolib_register(pc); - } - - static struct platform_driver meson_pinctrl_driver = { -diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c -index 634b4d3..b3e7723 100644 ---- a/drivers/pinctrl/pinctrl-amd.c -+++ b/drivers/pinctrl/pinctrl-amd.c -@@ -43,17 +43,6 @@ static int amd_gpio_direction_input(struct gpio_chip *gc, unsigned offset) - - spin_lock_irqsave(&gpio_dev->lock, flags); - pin_reg = readl(gpio_dev->base + offset * 4); -- /* -- * Suppose BIOS or Bootloader sets specific debounce for the -- * GPIO. if not, set debounce to be 2.75ms and remove glitch. -- */ -- if ((pin_reg & DB_TMR_OUT_MASK) == 0) { -- pin_reg |= 0xf; -- pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF); -- pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF; -- pin_reg &= ~BIT(DB_TMR_LARGE_OFF); -- } -- - pin_reg &= ~BIT(OUTPUT_ENABLE_OFF); - writel(pin_reg, gpio_dev->base + offset * 4); - spin_unlock_irqrestore(&gpio_dev->lock, flags); -@@ -326,15 +315,6 @@ static void amd_gpio_irq_enable(struct irq_data *d) - - spin_lock_irqsave(&gpio_dev->lock, flags); - pin_reg = readl(gpio_dev->base + (d->hwirq)*4); -- /* -- Suppose BIOS or Bootloader sets specific debounce for the -- GPIO. if not, set debounce to be 2.75ms. -- */ -- if ((pin_reg & DB_TMR_OUT_MASK) == 0) { -- pin_reg |= 0xf; -- pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF); -- pin_reg &= ~BIT(DB_TMR_LARGE_OFF); -- } - pin_reg |= BIT(INTERRUPT_ENABLE_OFF); - pin_reg |= BIT(INTERRUPT_MASK_OFF); - writel(pin_reg, gpio_dev->base + (d->hwirq)*4); -diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c -index b6e161f..6c084b2 100644 ---- a/drivers/platform/chrome/cros_ec_proto.c -+++ b/drivers/platform/chrome/cros_ec_proto.c -@@ -380,3 +380,20 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev, - return ret; - } - EXPORT_SYMBOL(cros_ec_cmd_xfer); -+ -+int cros_ec_cmd_xfer_status(struct cros_ec_device *ec_dev, -+ struct cros_ec_command *msg) -+{ -+ int ret; -+ -+ ret = cros_ec_cmd_xfer(ec_dev, msg); -+ if (ret < 0) { -+ dev_err(ec_dev->dev, "Command xfer error (err:%d)\n", ret); -+ } else if (msg->result != EC_RES_SUCCESS) { -+ dev_dbg(ec_dev->dev, "Command result (err: %d)\n", msg->result); -+ return -EPROTO; -+ } -+ -+ return ret; -+} -+EXPORT_SYMBOL(cros_ec_cmd_xfer_status); -diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c -index 8973d34..fb1b56a 100644 ---- a/drivers/s390/block/dasd.c -+++ b/drivers/s390/block/dasd.c -@@ -1643,9 +1643,18 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, - u8 *sense = NULL; - int expires; - -+ cqr = (struct dasd_ccw_req *) intparm; - if (IS_ERR(irb)) { - switch (PTR_ERR(irb)) { - case -EIO: -+ if (cqr && cqr->status == DASD_CQR_CLEAR_PENDING) { -+ device = (struct dasd_device *) cqr->startdev; -+ cqr->status = DASD_CQR_CLEARED; -+ dasd_device_clear_timer(device); -+ wake_up(&dasd_flush_wq); -+ dasd_schedule_device_bh(device); -+ return; -+ } - break; - case -ETIMEDOUT: - DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: " -@@ -1661,7 +1670,6 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, - } - - now = get_tod_clock(); -- cqr = (struct dasd_ccw_req *) intparm; - /* check for conditions that should be handled immediately */ - if (!cqr || - !(scsw_dstat(&irb->scsw) == (DEV_STAT_CHN_END | DEV_STAT_DEV_END) && -diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c -index 4b3bb52..c424e8b 100644 ---- a/drivers/scsi/aacraid/commctrl.c -+++ b/drivers/scsi/aacraid/commctrl.c -@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) - struct fib *fibptr; - struct hw_fib * hw_fib = (struct hw_fib *)0; - dma_addr_t hw_fib_pa = (dma_addr_t)0LL; -- unsigned size; -+ unsigned int size, osize; - int retval; - - if (dev->in_reset) { -@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) - * will not overrun the buffer when we copy the memory. Return - * an error if we would. - */ -- size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr); -+ osize = size = le16_to_cpu(kfib->header.Size) + -+ sizeof(struct aac_fibhdr); - if (size < le16_to_cpu(kfib->header.SenderSize)) - size = le16_to_cpu(kfib->header.SenderSize); - if (size > dev->max_fib_size) { -@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) - goto cleanup; - } - -+ /* Sanity check the second copy */ -+ if ((osize != le16_to_cpu(kfib->header.Size) + -+ sizeof(struct aac_fibhdr)) -+ || (size < le16_to_cpu(kfib->header.SenderSize))) { -+ retval = -EINVAL; -+ goto cleanup; -+ } -+ - if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) { - aac_adapter_interrupt(dev); - /* -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index 2dab3dc..c1ed25a 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -5037,7 +5037,7 @@ static int megasas_init_fw(struct megasas_instance *instance) - /* Find first memory bar */ - bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM); - instance->bar = find_first_bit(&bar_list, sizeof(unsigned long)); -- if (pci_request_selected_regions(instance->pdev, instance->bar, -+ if (pci_request_selected_regions(instance->pdev, 1<<instance->bar, - "megasas: LSI")) { - dev_printk(KERN_DEBUG, &instance->pdev->dev, "IO memory region busy!\n"); - return -EBUSY; -@@ -5339,7 +5339,7 @@ fail_ready_state: - iounmap(instance->reg_set); - - fail_ioremap: -- pci_release_selected_regions(instance->pdev, instance->bar); -+ pci_release_selected_regions(instance->pdev, 1<<instance->bar); - - return -EINVAL; - } -@@ -5360,7 +5360,7 @@ static void megasas_release_mfi(struct megasas_instance *instance) - - iounmap(instance->reg_set); - -- pci_release_selected_regions(instance->pdev, instance->bar); -+ pci_release_selected_regions(instance->pdev, 1<<instance->bar); - } - - /** -diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c -index ec83754..52d8bbf 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_fusion.c -+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c -@@ -2603,7 +2603,7 @@ megasas_release_fusion(struct megasas_instance *instance) - - iounmap(instance->reg_set); - -- pci_release_selected_regions(instance->pdev, instance->bar); -+ pci_release_selected_regions(instance->pdev, 1<<instance->bar); - } - - /** -diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c -index 751f13e..750f82c 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_base.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c -@@ -2188,6 +2188,17 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc) - } else - ioc->msix96_vector = 0; - -+ if (ioc->is_warpdrive) { -+ ioc->reply_post_host_index[0] = (resource_size_t __iomem *) -+ &ioc->chip->ReplyPostHostIndex; -+ -+ for (i = 1; i < ioc->cpu_msix_table_sz; i++) -+ ioc->reply_post_host_index[i] = -+ (resource_size_t __iomem *) -+ ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1) -+ * 4))); -+ } -+ - list_for_each_entry(reply_q, &ioc->reply_queue_list, list) - pr_info(MPT3SAS_FMT "%s: IRQ %d\n", - reply_q->name, ((ioc->msix_enable) ? "PCI-MSI-X enabled" : -@@ -5280,17 +5291,6 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) - if (r) - goto out_free_resources; - -- if (ioc->is_warpdrive) { -- ioc->reply_post_host_index[0] = (resource_size_t __iomem *) -- &ioc->chip->ReplyPostHostIndex; -- -- for (i = 1; i < ioc->cpu_msix_table_sz; i++) -- ioc->reply_post_host_index[i] = -- (resource_size_t __iomem *) -- ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1) -- * 4))); -- } -- - pci_set_drvdata(ioc->pdev, ioc->shost); - r = _base_get_ioc_facts(ioc, CAN_SLEEP); - if (r) -diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c -index 4ab1866..ec5b9a2 100644 ---- a/drivers/staging/comedi/drivers/comedi_test.c -+++ b/drivers/staging/comedi/drivers/comedi_test.c -@@ -56,11 +56,6 @@ - - #define N_CHANS 8 - --enum waveform_state_bits { -- WAVEFORM_AI_RUNNING, -- WAVEFORM_AO_RUNNING --}; -- - /* Data unique to this driver */ - struct waveform_private { - struct timer_list ai_timer; /* timer for AI commands */ -@@ -68,7 +63,6 @@ struct waveform_private { - unsigned int wf_amplitude; /* waveform amplitude in microvolts */ - unsigned int wf_period; /* waveform period in microseconds */ - unsigned int wf_current; /* current time in waveform period */ -- unsigned long state_bits; - unsigned int ai_scan_period; /* AI scan period in usec */ - unsigned int ai_convert_period; /* AI conversion period in usec */ - struct timer_list ao_timer; /* timer for AO commands */ -@@ -191,10 +185,6 @@ static void waveform_ai_timer(unsigned long arg) - unsigned int nsamples; - unsigned int time_increment; - -- /* check command is still active */ -- if (!test_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits)) -- return; -- - now = ktime_to_us(ktime_get()); - nsamples = comedi_nsamples_left(s, UINT_MAX); - -@@ -386,11 +376,6 @@ static int waveform_ai_cmd(struct comedi_device *dev, - */ - devpriv->ai_timer.expires = - jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1; -- -- /* mark command as active */ -- smp_mb__before_atomic(); -- set_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits); -- smp_mb__after_atomic(); - add_timer(&devpriv->ai_timer); - return 0; - } -@@ -400,11 +385,12 @@ static int waveform_ai_cancel(struct comedi_device *dev, - { - struct waveform_private *devpriv = dev->private; - -- /* mark command as no longer active */ -- clear_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits); -- smp_mb__after_atomic(); -- /* cannot call del_timer_sync() as may be called from timer routine */ -- del_timer(&devpriv->ai_timer); -+ if (in_softirq()) { -+ /* Assume we were called from the timer routine itself. */ -+ del_timer(&devpriv->ai_timer); -+ } else { -+ del_timer_sync(&devpriv->ai_timer); -+ } - return 0; - } - -@@ -436,10 +422,6 @@ static void waveform_ao_timer(unsigned long arg) - u64 scans_since; - unsigned int scans_avail = 0; - -- /* check command is still active */ -- if (!test_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits)) -- return; -- - /* determine number of scan periods since last time */ - now = ktime_to_us(ktime_get()); - scans_since = now - devpriv->ao_last_scan_time; -@@ -518,11 +500,6 @@ static int waveform_ao_inttrig_start(struct comedi_device *dev, - devpriv->ao_last_scan_time = ktime_to_us(ktime_get()); - devpriv->ao_timer.expires = - jiffies + usecs_to_jiffies(devpriv->ao_scan_period); -- -- /* mark command as active */ -- smp_mb__before_atomic(); -- set_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits); -- smp_mb__after_atomic(); - add_timer(&devpriv->ao_timer); - - return 1; -@@ -608,11 +585,12 @@ static int waveform_ao_cancel(struct comedi_device *dev, - struct waveform_private *devpriv = dev->private; - - s->async->inttrig = NULL; -- /* mark command as no longer active */ -- clear_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits); -- smp_mb__after_atomic(); -- /* cannot call del_timer_sync() as may be called from timer routine */ -- del_timer(&devpriv->ao_timer); -+ if (in_softirq()) { -+ /* Assume we were called from the timer routine itself. */ -+ del_timer(&devpriv->ao_timer); -+ } else { -+ del_timer_sync(&devpriv->ao_timer); -+ } - return 0; - } - -diff --git a/drivers/staging/comedi/drivers/daqboard2000.c b/drivers/staging/comedi/drivers/daqboard2000.c -index a536a15..a91ea02 100644 ---- a/drivers/staging/comedi/drivers/daqboard2000.c -+++ b/drivers/staging/comedi/drivers/daqboard2000.c -@@ -636,7 +636,7 @@ static const void *daqboard2000_find_boardinfo(struct comedi_device *dev, - const struct daq200_boardtype *board; - int i; - -- if (pcidev->subsystem_device != PCI_VENDOR_ID_IOTECH) -+ if (pcidev->subsystem_vendor != PCI_VENDOR_ID_IOTECH) - return NULL; - - for (i = 0; i < ARRAY_SIZE(boardtypes); i++) { -diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c -index 8dabb19..0f97d7b 100644 ---- a/drivers/staging/comedi/drivers/ni_mio_common.c -+++ b/drivers/staging/comedi/drivers/ni_mio_common.c -@@ -2772,7 +2772,15 @@ static int ni_ao_inttrig(struct comedi_device *dev, - int i; - static const int timeout = 1000; - -- if (trig_num != cmd->start_arg) -+ /* -+ * Require trig_num == cmd->start_arg when cmd->start_src == TRIG_INT. -+ * For backwards compatibility, also allow trig_num == 0 when -+ * cmd->start_src != TRIG_INT (i.e. when cmd->start_src == TRIG_EXT); -+ * in that case, the internal trigger is being used as a pre-trigger -+ * before the external trigger. -+ */ -+ if (!(trig_num == cmd->start_arg || -+ (trig_num == 0 && cmd->start_src != TRIG_INT))) - return -EINVAL; - - /* -@@ -5480,7 +5488,7 @@ static int ni_E_init(struct comedi_device *dev, - s->maxdata = (devpriv->is_m_series) ? 0xffffffff - : 0x00ffffff; - s->insn_read = ni_tio_insn_read; -- s->insn_write = ni_tio_insn_read; -+ s->insn_write = ni_tio_insn_write; - s->insn_config = ni_tio_insn_config; - #ifdef PCIDMA - if (dev->irq && devpriv->mite) { -diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c -index 5eba0eb..86e40ce 100644 ---- a/drivers/staging/lustre/lustre/llite/namei.c -+++ b/drivers/staging/lustre/lustre/llite/namei.c -@@ -391,6 +391,7 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request, - struct inode *inode = NULL; - __u64 bits = 0; - int rc = 0; -+ struct dentry *alias; - - /* NB 1 request reference will be taken away by ll_intent_lock() - * when I return -@@ -415,26 +416,12 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request, - */ - } - -- /* Only hash *de if it is unhashed (new dentry). -- * Atoimc_open may passing hashed dentries for open. -- */ -- if (d_unhashed(*de)) { -- struct dentry *alias; -- -- alias = ll_splice_alias(inode, *de); -- if (IS_ERR(alias)) { -- rc = PTR_ERR(alias); -- goto out; -- } -- *de = alias; -- } else if (!it_disposition(it, DISP_LOOKUP_NEG) && -- !it_disposition(it, DISP_OPEN_CREATE)) { -- /* With DISP_OPEN_CREATE dentry will be -- * instantiated in ll_create_it. -- */ -- LASSERT(!d_inode(*de)); -- d_instantiate(*de, inode); -+ alias = ll_splice_alias(inode, *de); -+ if (IS_ERR(alias)) { -+ rc = PTR_ERR(alias); -+ goto out; - } -+ *de = alias; - - if (!it_disposition(it, DISP_LOOKUP_NEG)) { - /* we have lookup look - unhide dentry */ -@@ -590,6 +577,24 @@ static int ll_atomic_open(struct inode *dir, struct dentry *dentry, - dentry, PFID(ll_inode2fid(dir)), dir, file, open_flags, mode, - *opened); - -+ /* Only negative dentries enter here */ -+ LASSERT(!d_inode(dentry)); -+ -+ if (!d_in_lookup(dentry)) { -+ /* A valid negative dentry that just passed revalidation, -+ * there's little point to try and open it server-side, -+ * even though there's a minuscle chance it might succeed. -+ * Either way it's a valid race to just return -ENOENT here. -+ */ -+ if (!(open_flags & O_CREAT)) -+ return -ENOENT; -+ -+ /* Otherwise we just unhash it to be rehashed afresh via -+ * lookup if necessary -+ */ -+ d_drop(dentry); -+ } -+ - it = kzalloc(sizeof(*it), GFP_NOFS); - if (!it) - return -ENOMEM; -diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c -index 065f5d9..dfec5a1 100644 ---- a/drivers/usb/chipidea/udc.c -+++ b/drivers/usb/chipidea/udc.c -@@ -1596,8 +1596,11 @@ static int ci_udc_pullup(struct usb_gadget *_gadget, int is_on) - { - struct ci_hdrc *ci = container_of(_gadget, struct ci_hdrc, gadget); - -- /* Data+ pullup controlled by OTG state machine in OTG fsm mode */ -- if (ci_otg_is_fsm_mode(ci)) -+ /* -+ * Data+ pullup controlled by OTG state machine in OTG fsm mode; -+ * and don't touch Data+ in host mode for dual role config. -+ */ -+ if (ci_otg_is_fsm_mode(ci) || ci->role == CI_ROLE_HOST) - return 0; - - pm_runtime_get_sync(&ci->gadget.dev); -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 94a14f5..0a4d54a 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1405,7 +1405,6 @@ made_compressed_probe: - spin_lock_init(&acm->write_lock); - spin_lock_init(&acm->read_lock); - mutex_init(&acm->mutex); -- acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress); - acm->is_int_ep = usb_endpoint_xfer_int(epread); - if (acm->is_int_ep) - acm->bInterval = epread->bInterval; -@@ -1445,14 +1444,14 @@ made_compressed_probe: - urb->transfer_dma = rb->dma; - if (acm->is_int_ep) { - usb_fill_int_urb(urb, acm->dev, -- acm->rx_endpoint, -+ usb_rcvintpipe(usb_dev, epread->bEndpointAddress), - rb->base, - acm->readsize, - acm_read_bulk_callback, rb, - acm->bInterval); - } else { - usb_fill_bulk_urb(urb, acm->dev, -- acm->rx_endpoint, -+ usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress), - rb->base, - acm->readsize, - acm_read_bulk_callback, rb); -diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h -index 05ce308..1f1eabf 100644 ---- a/drivers/usb/class/cdc-acm.h -+++ b/drivers/usb/class/cdc-acm.h -@@ -96,7 +96,6 @@ struct acm { - struct acm_rb read_buffers[ACM_NR]; - struct acm_wb *putbuffer; /* for acm_tty_put_char() */ - int rx_buflimit; -- int rx_endpoint; - spinlock_t read_lock; - int write_used; /* number of non-empty write buffers */ - int transmitting; -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index 31ccdcc..15ce4ab 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -171,6 +171,31 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno, - ep, buffer, size); - } - -+static const unsigned short low_speed_maxpacket_maxes[4] = { -+ [USB_ENDPOINT_XFER_CONTROL] = 8, -+ [USB_ENDPOINT_XFER_ISOC] = 0, -+ [USB_ENDPOINT_XFER_BULK] = 0, -+ [USB_ENDPOINT_XFER_INT] = 8, -+}; -+static const unsigned short full_speed_maxpacket_maxes[4] = { -+ [USB_ENDPOINT_XFER_CONTROL] = 64, -+ [USB_ENDPOINT_XFER_ISOC] = 1023, -+ [USB_ENDPOINT_XFER_BULK] = 64, -+ [USB_ENDPOINT_XFER_INT] = 64, -+}; -+static const unsigned short high_speed_maxpacket_maxes[4] = { -+ [USB_ENDPOINT_XFER_CONTROL] = 64, -+ [USB_ENDPOINT_XFER_ISOC] = 1024, -+ [USB_ENDPOINT_XFER_BULK] = 512, -+ [USB_ENDPOINT_XFER_INT] = 1024, -+}; -+static const unsigned short super_speed_maxpacket_maxes[4] = { -+ [USB_ENDPOINT_XFER_CONTROL] = 512, -+ [USB_ENDPOINT_XFER_ISOC] = 1024, -+ [USB_ENDPOINT_XFER_BULK] = 1024, -+ [USB_ENDPOINT_XFER_INT] = 1024, -+}; -+ - static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, - int asnum, struct usb_host_interface *ifp, int num_ep, - unsigned char *buffer, int size) -@@ -179,6 +204,8 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, - struct usb_endpoint_descriptor *d; - struct usb_host_endpoint *endpoint; - int n, i, j, retval; -+ unsigned int maxp; -+ const unsigned short *maxpacket_maxes; - - d = (struct usb_endpoint_descriptor *) buffer; - buffer += d->bLength; -@@ -286,6 +313,42 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, - endpoint->desc.wMaxPacketSize = cpu_to_le16(8); - } - -+ /* Validate the wMaxPacketSize field */ -+ maxp = usb_endpoint_maxp(&endpoint->desc); -+ -+ /* Find the highest legal maxpacket size for this endpoint */ -+ i = 0; /* additional transactions per microframe */ -+ switch (to_usb_device(ddev)->speed) { -+ case USB_SPEED_LOW: -+ maxpacket_maxes = low_speed_maxpacket_maxes; -+ break; -+ case USB_SPEED_FULL: -+ maxpacket_maxes = full_speed_maxpacket_maxes; -+ break; -+ case USB_SPEED_HIGH: -+ /* Bits 12..11 are allowed only for HS periodic endpoints */ -+ if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) { -+ i = maxp & (BIT(12) | BIT(11)); -+ maxp &= ~i; -+ } -+ /* fallthrough */ -+ default: -+ maxpacket_maxes = high_speed_maxpacket_maxes; -+ break; -+ case USB_SPEED_SUPER: -+ case USB_SPEED_SUPER_PLUS: -+ maxpacket_maxes = super_speed_maxpacket_maxes; -+ break; -+ } -+ j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)]; -+ -+ if (maxp > j) { -+ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n", -+ cfgno, inum, asnum, d->bEndpointAddress, maxp, j); -+ maxp = j; -+ endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp); -+ } -+ - /* - * Some buggy high speed devices have bulk endpoints using - * maxpacket sizes other than 512. High speed HCDs may not -@@ -293,9 +356,6 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, - */ - if (to_usb_device(ddev)->speed == USB_SPEED_HIGH - && usb_endpoint_xfer_bulk(d)) { -- unsigned maxp; -- -- maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff; - if (maxp != 512) - dev_warn(ddev, "config %d interface %d altsetting %d " - "bulk endpoint 0x%X has invalid maxpacket %d\n", -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index e9f5043..50b6baa 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -241,7 +241,8 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma) - goto error_decrease_mem; - } - -- mem = usb_alloc_coherent(ps->dev, size, GFP_USER, &dma_handle); -+ mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN, -+ &dma_handle); - if (!mem) { - ret = -ENOMEM; - goto error_free_usbm; -@@ -1708,11 +1709,17 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb - as->urb->start_frame = uurb->start_frame; - as->urb->number_of_packets = number_of_packets; - as->urb->stream_id = stream_id; -- if (uurb->type == USBDEVFS_URB_TYPE_ISO || -- ps->dev->speed == USB_SPEED_HIGH) -- as->urb->interval = 1 << min(15, ep->desc.bInterval - 1); -- else -- as->urb->interval = ep->desc.bInterval; -+ -+ if (ep->desc.bInterval) { -+ if (uurb->type == USBDEVFS_URB_TYPE_ISO || -+ ps->dev->speed == USB_SPEED_HIGH || -+ ps->dev->speed >= USB_SPEED_SUPER) -+ as->urb->interval = 1 << -+ min(15, ep->desc.bInterval - 1); -+ else -+ as->urb->interval = ep->desc.bInterval; -+ } -+ - as->urb->context = as; - as->urb->complete = async_completed; - for (totlen = u = 0; u < number_of_packets; u++) { -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index bee1351..1d5fc32 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -1052,14 +1052,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) - - /* Continue a partial initialization */ - if (type == HUB_INIT2 || type == HUB_INIT3) { -- device_lock(hub->intfdev); -+ device_lock(&hdev->dev); - - /* Was the hub disconnected while we were waiting? */ -- if (hub->disconnected) { -- device_unlock(hub->intfdev); -- kref_put(&hub->kref, hub_release); -- return; -- } -+ if (hub->disconnected) -+ goto disconnected; - if (type == HUB_INIT2) - goto init2; - goto init3; -@@ -1262,7 +1259,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) - queue_delayed_work(system_power_efficient_wq, - &hub->init_work, - msecs_to_jiffies(delay)); -- device_unlock(hub->intfdev); -+ device_unlock(&hdev->dev); - return; /* Continues at init3: below */ - } else { - msleep(delay); -@@ -1281,12 +1278,12 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) - /* Scan all ports that need attention */ - kick_hub_wq(hub); - -- /* Allow autosuspend if it was suppressed */ -- if (type <= HUB_INIT3) -+ if (type == HUB_INIT2 || type == HUB_INIT3) { -+ /* Allow autosuspend if it was suppressed */ -+ disconnected: - usb_autopm_put_interface_async(to_usb_interface(hub->intfdev)); -- -- if (type == HUB_INIT2 || type == HUB_INIT3) -- device_unlock(hub->intfdev); -+ device_unlock(&hdev->dev); -+ } - - kref_put(&hub->kref, hub_release); - } -@@ -1315,8 +1312,6 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type) - struct usb_device *hdev = hub->hdev; - int i; - -- cancel_delayed_work_sync(&hub->init_work); -- - /* hub_wq and related activity won't re-trigger */ - hub->quiescing = 1; - -diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c -index 14196cd..2fd5057 100644 ---- a/drivers/usb/dwc3/dwc3-pci.c -+++ b/drivers/usb/dwc3/dwc3-pci.c -@@ -37,6 +37,7 @@ - #define PCI_DEVICE_ID_INTEL_BXT 0x0aaa - #define PCI_DEVICE_ID_INTEL_BXT_M 0x1aaa - #define PCI_DEVICE_ID_INTEL_APL 0x5aaa -+#define PCI_DEVICE_ID_INTEL_KBP 0xa2b0 - - static const struct acpi_gpio_params reset_gpios = { 0, 0, false }; - static const struct acpi_gpio_params cs_gpios = { 1, 0, false }; -@@ -214,6 +215,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = { - { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT), }, - { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT_M), }, - { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), }, -+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), }, - { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), }, - { } /* Terminating Entry */ - }; -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 716f4f0..05a5300 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -1897,7 +1897,8 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc) - - static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, - struct dwc3_request *req, struct dwc3_trb *trb, -- const struct dwc3_event_depevt *event, int status) -+ const struct dwc3_event_depevt *event, int status, -+ int chain) - { - unsigned int count; - unsigned int s_pkt = 0; -@@ -1905,6 +1906,19 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, - - trace_dwc3_complete_trb(dep, trb); - -+ /* -+ * If we're in the middle of series of chained TRBs and we -+ * receive a short transfer along the way, DWC3 will skip -+ * through all TRBs including the last TRB in the chain (the -+ * where CHN bit is zero. DWC3 will also avoid clearing HWO -+ * bit and SW has to do it manually. -+ * -+ * We're going to do that here to avoid problems of HW trying -+ * to use bogus TRBs for transfers. -+ */ -+ if (chain && (trb->ctrl & DWC3_TRB_CTRL_HWO)) -+ trb->ctrl &= ~DWC3_TRB_CTRL_HWO; -+ - if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN) - /* - * We continue despite the error. There is not much we -@@ -1916,6 +1930,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, - */ - dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n", - dep->name, trb); -+ - count = trb->size & DWC3_TRB_SIZE_MASK; - - if (dep->direction) { -@@ -1954,15 +1969,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, - s_pkt = 1; - } - -- /* -- * We assume here we will always receive the entire data block -- * which we should receive. Meaning, if we program RX to -- * receive 4K but we receive only 2K, we assume that's all we -- * should receive and we simply bounce the request back to the -- * gadget driver for further processing. -- */ -- req->request.actual += req->request.length - count; -- if (s_pkt) -+ if (s_pkt && !chain) - return 1; - if ((event->status & DEPEVT_STATUS_LST) && - (trb->ctrl & (DWC3_TRB_CTRL_LST | -@@ -1981,13 +1988,17 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep, - struct dwc3_trb *trb; - unsigned int slot; - unsigned int i; -+ int count = 0; - int ret; - - do { -+ int chain; -+ - req = next_request(&dep->started_list); - if (WARN_ON_ONCE(!req)) - return 1; - -+ chain = req->request.num_mapped_sgs > 0; - i = 0; - do { - slot = req->first_trb_index + i; -@@ -1995,13 +2006,22 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep, - slot++; - slot %= DWC3_TRB_NUM; - trb = &dep->trb_pool[slot]; -+ count += trb->size & DWC3_TRB_SIZE_MASK; - - ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb, -- event, status); -+ event, status, chain); - if (ret) - break; - } while (++i < req->request.num_mapped_sgs); - -+ /* -+ * We assume here we will always receive the entire data block -+ * which we should receive. Meaning, if we program RX to -+ * receive 4K but we receive only 2K, we assume that's all we -+ * should receive and we simply bounce the request back to the -+ * gadget driver for further processing. -+ */ -+ req->request.actual += req->request.length - count; - dwc3_gadget_giveback(dep, req, status); - - if (ret) -diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c -index aa3707b..be64798 100644 ---- a/drivers/usb/gadget/legacy/inode.c -+++ b/drivers/usb/gadget/legacy/inode.c -@@ -542,7 +542,7 @@ static ssize_t ep_aio(struct kiocb *iocb, - */ - spin_lock_irq(&epdata->dev->lock); - value = -ENODEV; -- if (unlikely(epdata->ep)) -+ if (unlikely(epdata->ep == NULL)) - goto fail; - - req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC); -diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c -index 93d28cb..cf8819a 100644 ---- a/drivers/usb/gadget/udc/fsl_qe_udc.c -+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c -@@ -2053,7 +2053,7 @@ static void setup_received_handle(struct qe_udc *udc, - struct qe_ep *ep; - - if (wValue != 0 || wLength != 0 -- || pipe > USB_MAX_ENDPOINTS) -+ || pipe >= USB_MAX_ENDPOINTS) - break; - ep = &udc->eps[pipe]; - -diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c -index e1b2dce..bd46950 100644 ---- a/drivers/usb/gadget/udc/udc-core.c -+++ b/drivers/usb/gadget/udc/udc-core.c -@@ -106,7 +106,7 @@ void usb_gadget_unmap_request_by_dev(struct device *dev, - return; - - if (req->num_mapped_sgs) { -- dma_unmap_sg(dev, req->sg, req->num_mapped_sgs, -+ dma_unmap_sg(dev, req->sg, req->num_sgs, - is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE); - - req->num_mapped_sgs = 0; -diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c -index a962b89..1e5f529 100644 ---- a/drivers/usb/host/ehci-hcd.c -+++ b/drivers/usb/host/ehci-hcd.c -@@ -332,11 +332,11 @@ static void ehci_turn_off_all_ports(struct ehci_hcd *ehci) - int port = HCS_N_PORTS(ehci->hcs_params); - - while (port--) { -- ehci_writel(ehci, PORT_RWC_BITS, -- &ehci->regs->port_status[port]); - spin_unlock_irq(&ehci->lock); - ehci_port_power(ehci, port, false); - spin_lock_irq(&ehci->lock); -+ ehci_writel(ehci, PORT_RWC_BITS, -+ &ehci->regs->port_status[port]); - } - } - -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index d61fcc4..730b9fd 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -386,6 +386,9 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend) - - ret = 0; - virt_dev = xhci->devs[slot_id]; -+ if (!virt_dev) -+ return -ENODEV; -+ - cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO); - if (!cmd) { - xhci_dbg(xhci, "Couldn't allocate command structure.\n"); -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index c10972f..69f7fab 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -314,11 +314,12 @@ static void xhci_pci_remove(struct pci_dev *dev) - usb_remove_hcd(xhci->shared_hcd); - usb_put_hcd(xhci->shared_hcd); - } -- usb_hcd_pci_remove(dev); - - /* Workaround for spurious wakeups at shutdown with HSW */ - if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) - pci_set_power_state(dev, PCI_D3hot); -+ -+ usb_hcd_pci_remove(dev); - } - - #ifdef CONFIG_PM -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index d7d5025..bc17bcf 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -1325,12 +1325,6 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, - - cmd = list_entry(xhci->cmd_list.next, struct xhci_command, cmd_list); - -- if (cmd->command_trb != xhci->cmd_ring->dequeue) { -- xhci_err(xhci, -- "Command completion event does not match command\n"); -- return; -- } -- - del_timer(&xhci->cmd_timer); - - trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event); -@@ -1342,6 +1336,13 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, - xhci_handle_stopped_cmd_ring(xhci, cmd); - return; - } -+ -+ if (cmd->command_trb != xhci->cmd_ring->dequeue) { -+ xhci_err(xhci, -+ "Command completion event does not match command\n"); -+ return; -+ } -+ - /* - * Host aborted the command ring, check if the current command was - * supposed to be aborted, otherwise continue normally. -diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c -index 6b978f0..5c8210d 100644 ---- a/drivers/usb/misc/usbtest.c -+++ b/drivers/usb/misc/usbtest.c -@@ -585,7 +585,6 @@ static void sg_timeout(unsigned long _req) - { - struct usb_sg_request *req = (struct usb_sg_request *) _req; - -- req->status = -ETIMEDOUT; - usb_sg_cancel(req); - } - -@@ -616,8 +615,10 @@ static int perform_sglist( - mod_timer(&sg_timer, jiffies + - msecs_to_jiffies(SIMPLE_IO_TIMEOUT)); - usb_sg_wait(req); -- del_timer_sync(&sg_timer); -- retval = req->status; -+ if (!del_timer_sync(&sg_timer)) -+ retval = -ETIMEDOUT; -+ else -+ retval = req->status; - - /* FIXME check resulting data pattern */ - -@@ -2602,7 +2603,7 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf) - ktime_get_ts64(&start); - - retval = usbtest_do_ioctl(intf, param_32); -- if (retval) -+ if (retval < 0) - goto free_mutex; - - ktime_get_ts64(&end); -diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c -index baeb7d2..8c81aac 100644 ---- a/drivers/usb/renesas_usbhs/common.c -+++ b/drivers/usb/renesas_usbhs/common.c -@@ -514,7 +514,8 @@ static struct renesas_usbhs_platform_info *usbhs_parse_dt(struct device *dev) - if (gpio > 0) - dparam->enable_gpio = gpio; - -- if (dparam->type == USBHS_TYPE_RCAR_GEN2) -+ if (dparam->type == USBHS_TYPE_RCAR_GEN2 || -+ dparam->type == USBHS_TYPE_RCAR_GEN3) - dparam->has_usb_dmac = 1; - - return info; -diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c -index 280ed5f..857e783 100644 ---- a/drivers/usb/renesas_usbhs/fifo.c -+++ b/drivers/usb/renesas_usbhs/fifo.c -@@ -871,7 +871,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done) - - /* use PIO if packet is less than pio_dma_border or pipe is DCP */ - if ((len < usbhs_get_dparam(priv, pio_dma_border)) || -- usbhs_pipe_is_dcp(pipe)) -+ usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC)) - goto usbhsf_pio_prepare_push; - - /* check data length if this driver don't use USB-DMAC */ -@@ -976,7 +976,7 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt, - - /* use PIO if packet is less than pio_dma_border or pipe is DCP */ - if ((pkt->length < usbhs_get_dparam(priv, pio_dma_border)) || -- usbhs_pipe_is_dcp(pipe)) -+ usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC)) - goto usbhsf_pio_prepare_pop; - - fifo = usbhsf_get_dma_fifo(priv, pkt); -diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c -index 50f3363..c4c6474 100644 ---- a/drivers/usb/renesas_usbhs/mod_gadget.c -+++ b/drivers/usb/renesas_usbhs/mod_gadget.c -@@ -617,10 +617,13 @@ static int usbhsg_ep_enable(struct usb_ep *ep, - * use dmaengine if possible. - * It will use pio handler if impossible. - */ -- if (usb_endpoint_dir_in(desc)) -+ if (usb_endpoint_dir_in(desc)) { - pipe->handler = &usbhs_fifo_dma_push_handler; -- else -+ } else { - pipe->handler = &usbhs_fifo_dma_pop_handler; -+ usbhs_xxxsts_clear(priv, BRDYSTS, -+ usbhs_pipe_number(pipe)); -+ } - - ret = 0; - } -@@ -1073,7 +1076,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv) - - gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED); - dev_info(dev, "%stransceiver found\n", -- gpriv->transceiver ? "" : "no "); -+ !IS_ERR(gpriv->transceiver) ? "" : "no "); - - /* - * CAUTION -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 0082080..b2d767e 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -648,6 +648,8 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) }, -+ { USB_DEVICE(FTDI_VID, FTDI_PALMSENS_PID) }, -+ { USB_DEVICE(FTDI_VID, FTDI_IVIUM_XSTAT_PID) }, - { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) }, - { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) }, - { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) }, -@@ -1008,6 +1010,7 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) }, - { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, - { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, -+ { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index c5d6c1e..f87a938 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -406,6 +406,12 @@ - #define FTDI_4N_GALAXY_DE_3_PID 0xF3C2 - - /* -+ * Ivium Technologies product IDs -+ */ -+#define FTDI_PALMSENS_PID 0xf440 -+#define FTDI_IVIUM_XSTAT_PID 0xf441 -+ -+/* - * Linx Technologies product ids - */ - #define LINX_SDMUSBQSS_PID 0xF448 /* Linx SDM-USB-QS-S */ -@@ -673,6 +679,12 @@ - #define INTREPID_NEOVI_PID 0x0701 - - /* -+ * WICED USB UART -+ */ -+#define WICED_VID 0x0A5C -+#define WICED_USB20706V2_PID 0x6422 -+ -+/* - * Definitions for ID TECH (www.idt-net.com) devices - */ - #define IDTECH_VID 0x0ACD /* ID TECH Vendor ID */ -diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c -index 5608af4..de9992b 100644 ---- a/drivers/usb/serial/mos7720.c -+++ b/drivers/usb/serial/mos7720.c -@@ -1252,7 +1252,7 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port, - - if (urb->transfer_buffer == NULL) { - urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, -- GFP_KERNEL); -+ GFP_ATOMIC); - if (!urb->transfer_buffer) - goto exit; - } -diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c -index ed378fb..57426d7 100644 ---- a/drivers/usb/serial/mos7840.c -+++ b/drivers/usb/serial/mos7840.c -@@ -1340,8 +1340,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port, - } - - if (urb->transfer_buffer == NULL) { -- urb->transfer_buffer = -- kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL); -+ urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, -+ GFP_ATOMIC); - if (!urb->transfer_buffer) - goto exit; - } -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 8e07536..9894e34 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -274,6 +274,12 @@ static void option_instat_callback(struct urb *urb); - #define TELIT_PRODUCT_LE920 0x1200 - #define TELIT_PRODUCT_LE910 0x1201 - #define TELIT_PRODUCT_LE910_USBCFG4 0x1206 -+#define TELIT_PRODUCT_LE920A4_1207 0x1207 -+#define TELIT_PRODUCT_LE920A4_1208 0x1208 -+#define TELIT_PRODUCT_LE920A4_1211 0x1211 -+#define TELIT_PRODUCT_LE920A4_1212 0x1212 -+#define TELIT_PRODUCT_LE920A4_1213 0x1213 -+#define TELIT_PRODUCT_LE920A4_1214 0x1214 - - /* ZTE PRODUCTS */ - #define ZTE_VENDOR_ID 0x19d2 -@@ -519,6 +525,12 @@ static void option_instat_callback(struct urb *urb); - #define VIATELECOM_VENDOR_ID 0x15eb - #define VIATELECOM_PRODUCT_CDS7 0x0001 - -+/* WeTelecom products */ -+#define WETELECOM_VENDOR_ID 0x22de -+#define WETELECOM_PRODUCT_WMD200 0x6801 -+#define WETELECOM_PRODUCT_6802 0x6802 -+#define WETELECOM_PRODUCT_WMD300 0x6803 -+ - struct option_blacklist_info { - /* bitmask of interface numbers blacklisted for send_setup */ - const unsigned long sendsetup; -@@ -628,6 +640,11 @@ static const struct option_blacklist_info telit_le920_blacklist = { - .reserved = BIT(1) | BIT(5), - }; - -+static const struct option_blacklist_info telit_le920a4_blacklist_1 = { -+ .sendsetup = BIT(0), -+ .reserved = BIT(1), -+}; -+ - static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = { - .sendsetup = BIT(2), - .reserved = BIT(0) | BIT(1) | BIT(3), -@@ -1203,6 +1220,16 @@ static const struct usb_device_id option_ids[] = { - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), - .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, -+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) }, -+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208), -+ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, -+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211), -+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, -+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212), -+ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, -+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), -+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, -@@ -1966,9 +1993,13 @@ static const struct usb_device_id option_ids[] = { - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ - { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ - { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, - { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) }, - { } /* Terminating entry */ - }; - MODULE_DEVICE_TABLE(usb, option_ids); -diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c -index b1b9bac..d213cf4 100644 ---- a/drivers/usb/serial/usb-serial.c -+++ b/drivers/usb/serial/usb-serial.c -@@ -1433,7 +1433,7 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[] - - rc = usb_register(udriver); - if (rc) -- return rc; -+ goto failed_usb_register; - - for (sd = serial_drivers; *sd; ++sd) { - (*sd)->usb_driver = udriver; -@@ -1451,6 +1451,8 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[] - while (sd-- > serial_drivers) - usb_serial_deregister(*sd); - usb_deregister(udriver); -+failed_usb_register: -+ kfree(udriver); - return rc; - } - EXPORT_SYMBOL_GPL(usb_serial_register_drivers); -diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c -index 15ecfc9..152b438 100644 ---- a/drivers/vfio/pci/vfio_pci_intrs.c -+++ b/drivers/vfio/pci/vfio_pci_intrs.c -@@ -564,67 +564,80 @@ static int vfio_pci_set_msi_trigger(struct vfio_pci_device *vdev, - } - - static int vfio_pci_set_ctx_trigger_single(struct eventfd_ctx **ctx, -- uint32_t flags, void *data) -+ unsigned int count, uint32_t flags, -+ void *data) - { -- int32_t fd = *(int32_t *)data; -- -- if (!(flags & VFIO_IRQ_SET_DATA_TYPE_MASK)) -- return -EINVAL; -- - /* DATA_NONE/DATA_BOOL enables loopback testing */ - if (flags & VFIO_IRQ_SET_DATA_NONE) { -- if (*ctx) -- eventfd_signal(*ctx, 1); -- return 0; -+ if (*ctx) { -+ if (count) { -+ eventfd_signal(*ctx, 1); -+ } else { -+ eventfd_ctx_put(*ctx); -+ *ctx = NULL; -+ } -+ return 0; -+ } - } else if (flags & VFIO_IRQ_SET_DATA_BOOL) { -- uint8_t trigger = *(uint8_t *)data; -+ uint8_t trigger; -+ -+ if (!count) -+ return -EINVAL; -+ -+ trigger = *(uint8_t *)data; - if (trigger && *ctx) - eventfd_signal(*ctx, 1); -- return 0; -- } - -- /* Handle SET_DATA_EVENTFD */ -- if (fd == -1) { -- if (*ctx) -- eventfd_ctx_put(*ctx); -- *ctx = NULL; - return 0; -- } else if (fd >= 0) { -- struct eventfd_ctx *efdctx; -- efdctx = eventfd_ctx_fdget(fd); -- if (IS_ERR(efdctx)) -- return PTR_ERR(efdctx); -- if (*ctx) -- eventfd_ctx_put(*ctx); -- *ctx = efdctx; -+ } else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) { -+ int32_t fd; -+ -+ if (!count) -+ return -EINVAL; -+ -+ fd = *(int32_t *)data; -+ if (fd == -1) { -+ if (*ctx) -+ eventfd_ctx_put(*ctx); -+ *ctx = NULL; -+ } else if (fd >= 0) { -+ struct eventfd_ctx *efdctx; -+ -+ efdctx = eventfd_ctx_fdget(fd); -+ if (IS_ERR(efdctx)) -+ return PTR_ERR(efdctx); -+ -+ if (*ctx) -+ eventfd_ctx_put(*ctx); -+ -+ *ctx = efdctx; -+ } - return 0; -- } else -- return -EINVAL; -+ } -+ -+ return -EINVAL; - } - - static int vfio_pci_set_err_trigger(struct vfio_pci_device *vdev, - unsigned index, unsigned start, - unsigned count, uint32_t flags, void *data) - { -- if (index != VFIO_PCI_ERR_IRQ_INDEX) -+ if (index != VFIO_PCI_ERR_IRQ_INDEX || start != 0 || count > 1) - return -EINVAL; - -- /* -- * We should sanitize start & count, but that wasn't caught -- * originally, so this IRQ index must forever ignore them :-( -- */ -- -- return vfio_pci_set_ctx_trigger_single(&vdev->err_trigger, flags, data); -+ return vfio_pci_set_ctx_trigger_single(&vdev->err_trigger, -+ count, flags, data); - } - - static int vfio_pci_set_req_trigger(struct vfio_pci_device *vdev, - unsigned index, unsigned start, - unsigned count, uint32_t flags, void *data) - { -- if (index != VFIO_PCI_REQ_IRQ_INDEX || start != 0 || count != 1) -+ if (index != VFIO_PCI_REQ_IRQ_INDEX || start != 0 || count > 1) - return -EINVAL; - -- return vfio_pci_set_ctx_trigger_single(&vdev->req_trigger, flags, data); -+ return vfio_pci_set_ctx_trigger_single(&vdev->req_trigger, -+ count, flags, data); - } - - int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags, -diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c -index ca6bfdd..2ebf30e 100644 ---- a/drivers/virtio/virtio_ring.c -+++ b/drivers/virtio/virtio_ring.c -@@ -316,6 +316,8 @@ static inline int virtqueue_add(struct virtqueue *_vq, - * host should service the ring ASAP. */ - if (out_sgs) - vq->notify(&vq->vq); -+ if (indirect) -+ kfree(desc); - END_USE(vq); - return -ENOSPC; - } -diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h -index 4274a7b..72f5048 100644 ---- a/fs/btrfs/ctree.h -+++ b/fs/btrfs/ctree.h -@@ -1040,6 +1040,7 @@ struct btrfs_fs_info { - struct btrfs_workqueue *qgroup_rescan_workers; - struct completion qgroup_rescan_completion; - struct btrfs_work qgroup_rescan_work; -+ bool qgroup_rescan_running; /* protected by qgroup_rescan_lock */ - - /* filesystem state */ - unsigned long fs_state; -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 60ce119..864cf3b 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -1626,8 +1626,8 @@ fail: - return ret; - } - --static struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info, -- u64 root_id) -+struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info, -+ u64 root_id) - { - struct btrfs_root *root; - -@@ -2306,6 +2306,7 @@ static void btrfs_init_qgroup(struct btrfs_fs_info *fs_info) - fs_info->quota_enabled = 0; - fs_info->pending_quota_state = 0; - fs_info->qgroup_ulist = NULL; -+ fs_info->qgroup_rescan_running = false; - mutex_init(&fs_info->qgroup_rescan_lock); - } - -@@ -3849,7 +3850,7 @@ void close_ctree(struct btrfs_root *root) - smp_mb(); - - /* wait for the qgroup rescan worker to stop */ -- btrfs_qgroup_wait_for_completion(fs_info); -+ btrfs_qgroup_wait_for_completion(fs_info, false); - - /* wait for the uuid_scan task to finish */ - down(&fs_info->uuid_tree_rescan_sem); -diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h -index acba821..355e31f 100644 ---- a/fs/btrfs/disk-io.h -+++ b/fs/btrfs/disk-io.h -@@ -68,6 +68,8 @@ struct extent_buffer *btrfs_find_tree_block(struct btrfs_fs_info *fs_info, - struct btrfs_root *btrfs_read_fs_root(struct btrfs_root *tree_root, - struct btrfs_key *location); - int btrfs_init_fs_root(struct btrfs_root *root); -+struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info, -+ u64 root_id); - int btrfs_insert_fs_root(struct btrfs_fs_info *fs_info, - struct btrfs_root *root); - void btrfs_free_fs_roots(struct btrfs_fs_info *fs_info); -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 0517356..3722a1f 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -5088,7 +5088,7 @@ static long btrfs_ioctl_quota_rescan_wait(struct file *file, void __user *arg) - if (!capable(CAP_SYS_ADMIN)) - return -EPERM; - -- return btrfs_qgroup_wait_for_completion(root->fs_info); -+ return btrfs_qgroup_wait_for_completion(root->fs_info, true); - } - - static long _btrfs_ioctl_set_received_subvol(struct file *file, -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index 9d4c05b..4904ebe 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -995,7 +995,7 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans, - goto out; - fs_info->quota_enabled = 0; - fs_info->pending_quota_state = 0; -- btrfs_qgroup_wait_for_completion(fs_info); -+ btrfs_qgroup_wait_for_completion(fs_info, false); - spin_lock(&fs_info->qgroup_lock); - quota_root = fs_info->quota_root; - fs_info->quota_root = NULL; -@@ -2302,6 +2302,10 @@ static void btrfs_qgroup_rescan_worker(struct btrfs_work *work) - int err = -ENOMEM; - int ret = 0; - -+ mutex_lock(&fs_info->qgroup_rescan_lock); -+ fs_info->qgroup_rescan_running = true; -+ mutex_unlock(&fs_info->qgroup_rescan_lock); -+ - path = btrfs_alloc_path(); - if (!path) - goto out; -@@ -2368,6 +2372,9 @@ out: - } - - done: -+ mutex_lock(&fs_info->qgroup_rescan_lock); -+ fs_info->qgroup_rescan_running = false; -+ mutex_unlock(&fs_info->qgroup_rescan_lock); - complete_all(&fs_info->qgroup_rescan_completion); - } - -@@ -2486,20 +2493,26 @@ btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info) - return 0; - } - --int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info) -+int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info, -+ bool interruptible) - { - int running; - int ret = 0; - - mutex_lock(&fs_info->qgroup_rescan_lock); - spin_lock(&fs_info->qgroup_lock); -- running = fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN; -+ running = fs_info->qgroup_rescan_running; - spin_unlock(&fs_info->qgroup_lock); - mutex_unlock(&fs_info->qgroup_rescan_lock); - -- if (running) -+ if (!running) -+ return 0; -+ -+ if (interruptible) - ret = wait_for_completion_interruptible( - &fs_info->qgroup_rescan_completion); -+ else -+ wait_for_completion(&fs_info->qgroup_rescan_completion); - - return ret; - } -diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h -index ecb2c14..3d73e4c 100644 ---- a/fs/btrfs/qgroup.h -+++ b/fs/btrfs/qgroup.h -@@ -46,7 +46,8 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans, - struct btrfs_fs_info *fs_info); - int btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info); - void btrfs_qgroup_rescan_resume(struct btrfs_fs_info *fs_info); --int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info); -+int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info, -+ bool interruptible); - int btrfs_add_qgroup_relation(struct btrfs_trans_handle *trans, - struct btrfs_fs_info *fs_info, u64 src, u64 dst); - int btrfs_del_qgroup_relation(struct btrfs_trans_handle *trans, -diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c -index f1c3086..3454aa4 100644 ---- a/fs/btrfs/root-tree.c -+++ b/fs/btrfs/root-tree.c -@@ -272,6 +272,23 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root) - root_key.objectid = key.offset; - key.offset++; - -+ /* -+ * The root might have been inserted already, as before we look -+ * for orphan roots, log replay might have happened, which -+ * triggers a transaction commit and qgroup accounting, which -+ * in turn reads and inserts fs roots while doing backref -+ * walking. -+ */ -+ root = btrfs_lookup_fs_root(tree_root->fs_info, -+ root_key.objectid); -+ if (root) { -+ WARN_ON(!test_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, -+ &root->state)); -+ if (btrfs_root_refs(&root->root_item) == 0) -+ btrfs_add_dead_root(root); -+ continue; -+ } -+ - root = btrfs_read_fs_root(tree_root, &root_key); - err = PTR_ERR_OR_ZERO(root); - if (err && err != -ENOENT) { -@@ -310,16 +327,8 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root) - set_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, &root->state); - - err = btrfs_insert_fs_root(root->fs_info, root); -- /* -- * The root might have been inserted already, as before we look -- * for orphan roots, log replay might have happened, which -- * triggers a transaction commit and qgroup accounting, which -- * in turn reads and inserts fs roots while doing backref -- * walking. -- */ -- if (err == -EEXIST) -- err = 0; - if (err) { -+ BUG_ON(err == -EEXIST); - btrfs_free_fs_root(root); - break; - } -diff --git a/fs/seq_file.c b/fs/seq_file.c -index 19f532e..6dc4296 100644 ---- a/fs/seq_file.c -+++ b/fs/seq_file.c -@@ -223,8 +223,10 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos) - size -= n; - buf += n; - copied += n; -- if (!m->count) -+ if (!m->count) { -+ m->from = 0; - m->index++; -+ } - if (!size) - goto Done; - } -diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c -index f35523d..b803213 100644 ---- a/fs/sysfs/file.c -+++ b/fs/sysfs/file.c -@@ -114,9 +114,15 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf, - * If buf != of->prealloc_buf, we don't know how - * large it is, so cannot safely pass it to ->show - */ -- if (pos || WARN_ON_ONCE(buf != of->prealloc_buf)) -+ if (WARN_ON_ONCE(buf != of->prealloc_buf)) - return 0; - len = ops->show(kobj, of->kn->priv, buf); -+ if (pos) { -+ if (len <= pos) -+ return 0; -+ len -= pos; -+ memmove(buf, buf + pos, len); -+ } - return min(count, len); - } - -diff --git a/include/linux/acpi.h b/include/linux/acpi.h -index 288fac5..47f95085 100644 ---- a/include/linux/acpi.h -+++ b/include/linux/acpi.h -@@ -985,7 +985,7 @@ static inline struct fwnode_handle *acpi_get_next_subnode(struct device *dev, - return NULL; - } - --#define ACPI_DECLARE_PROBE_ENTRY(table, name, table_id, subtable, validate, data, fn) \ -+#define ACPI_DECLARE_PROBE_ENTRY(table, name, table_id, subtable, valid, data, fn) \ - static const void * __acpi_table_##name[] \ - __attribute__((unused)) \ - = { (void *) table_id, \ -diff --git a/include/linux/i8042.h b/include/linux/i8042.h -index 0f9bafa..d98780c 100644 ---- a/include/linux/i8042.h -+++ b/include/linux/i8042.h -@@ -62,7 +62,6 @@ struct serio; - void i8042_lock_chip(void); - void i8042_unlock_chip(void); - int i8042_command(unsigned char *param, int command); --bool i8042_check_port_owner(const struct serio *); - int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str, - struct serio *serio)); - int i8042_remove_filter(bool (*filter)(unsigned char data, unsigned char str, -@@ -83,11 +82,6 @@ static inline int i8042_command(unsigned char *param, int command) - return -ENODEV; - } - --static inline bool i8042_check_port_owner(const struct serio *serio) --{ -- return false; --} -- - static inline int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str, - struct serio *serio)) - { -diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h -index 64184d2..d641a18 100644 ---- a/include/linux/mfd/cros_ec.h -+++ b/include/linux/mfd/cros_ec.h -@@ -226,6 +226,21 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev, - struct cros_ec_command *msg); - - /** -+ * cros_ec_cmd_xfer_status - Send a command to the ChromeOS EC -+ * -+ * This function is identical to cros_ec_cmd_xfer, except it returns success -+ * status only if both the command was transmitted successfully and the EC -+ * replied with success status. It's not necessary to check msg->result when -+ * using this function. -+ * -+ * @ec_dev: EC device -+ * @msg: Message to write -+ * @return: Num. of bytes transferred on success, <0 on failure -+ */ -+int cros_ec_cmd_xfer_status(struct cros_ec_device *ec_dev, -+ struct cros_ec_command *msg); -+ -+/** - * cros_ec_remove - Remove a ChromeOS EC - * - * Call this to deregister a ChromeOS EC, then clean up any private data. -diff --git a/include/linux/msi.h b/include/linux/msi.h -index 8b425c6..ec39a08 100644 ---- a/include/linux/msi.h -+++ b/include/linux/msi.h -@@ -264,12 +264,12 @@ enum { - * callbacks. - */ - MSI_FLAG_USE_DEF_CHIP_OPS = (1 << 1), -- /* Build identity map between hwirq and irq */ -- MSI_FLAG_IDENTITY_MAP = (1 << 2), - /* Support multiple PCI MSI interrupts */ -- MSI_FLAG_MULTI_PCI_MSI = (1 << 3), -+ MSI_FLAG_MULTI_PCI_MSI = (1 << 2), - /* Support PCI MSIX interrupts */ -- MSI_FLAG_PCI_MSIX = (1 << 4), -+ MSI_FLAG_PCI_MSIX = (1 << 3), -+ /* Needs early activate, required for PCI */ -+ MSI_FLAG_ACTIVATE_EARLY = (1 << 4), - }; - - int msi_domain_set_affinity(struct irq_data *data, const struct cpumask *mask, -diff --git a/include/linux/serio.h b/include/linux/serio.h -index df4ab5d..c733cff 100644 ---- a/include/linux/serio.h -+++ b/include/linux/serio.h -@@ -31,7 +31,8 @@ struct serio { - - struct serio_device_id id; - -- spinlock_t lock; /* protects critical sections from port's interrupt handler */ -+ /* Protects critical sections from port's interrupt handler */ -+ spinlock_t lock; - - int (*write)(struct serio *, unsigned char); - int (*open)(struct serio *); -@@ -40,16 +41,29 @@ struct serio { - void (*stop)(struct serio *); - - struct serio *parent; -- struct list_head child_node; /* Entry in parent->children list */ -+ /* Entry in parent->children list */ -+ struct list_head child_node; - struct list_head children; -- unsigned int depth; /* level of nesting in serio hierarchy */ -+ /* Level of nesting in serio hierarchy */ -+ unsigned int depth; - -- struct serio_driver *drv; /* accessed from interrupt, must be protected by serio->lock and serio->sem */ -- struct mutex drv_mutex; /* protects serio->drv so attributes can pin driver */ -+ /* -+ * serio->drv is accessed from interrupt handlers; when modifying -+ * caller should acquire serio->drv_mutex and serio->lock. -+ */ -+ struct serio_driver *drv; -+ /* Protects serio->drv so attributes can pin current driver */ -+ struct mutex drv_mutex; - - struct device dev; - - struct list_head node; -+ -+ /* -+ * For use by PS/2 layer when several ports share hardware and -+ * may get indigestion when exposed to concurrent access (i8042). -+ */ -+ struct mutex *ps2_cmd_mutex; - }; - #define to_serio_port(d) container_of(d, struct serio, dev) - -diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h -index 5144013..28c5da6 100644 ---- a/include/trace/events/timer.h -+++ b/include/trace/events/timer.h -@@ -330,24 +330,32 @@ TRACE_EVENT(itimer_expire, - #ifdef CONFIG_NO_HZ_COMMON - - #define TICK_DEP_NAMES \ -- tick_dep_name(NONE) \ -+ tick_dep_mask_name(NONE) \ - tick_dep_name(POSIX_TIMER) \ - tick_dep_name(PERF_EVENTS) \ - tick_dep_name(SCHED) \ - tick_dep_name_end(CLOCK_UNSTABLE) - - #undef tick_dep_name -+#undef tick_dep_mask_name - #undef tick_dep_name_end - --#define tick_dep_name(sdep) TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep); --#define tick_dep_name_end(sdep) TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep); -+/* The MASK will convert to their bits and they need to be processed too */ -+#define tick_dep_name(sdep) TRACE_DEFINE_ENUM(TICK_DEP_BIT_##sdep); \ -+ TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep); -+#define tick_dep_name_end(sdep) TRACE_DEFINE_ENUM(TICK_DEP_BIT_##sdep); \ -+ TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep); -+/* NONE only has a mask defined for it */ -+#define tick_dep_mask_name(sdep) TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep); - - TICK_DEP_NAMES - - #undef tick_dep_name -+#undef tick_dep_mask_name - #undef tick_dep_name_end - - #define tick_dep_name(sdep) { TICK_DEP_MASK_##sdep, #sdep }, -+#define tick_dep_mask_name(sdep) { TICK_DEP_MASK_##sdep, #sdep }, - #define tick_dep_name_end(sdep) { TICK_DEP_MASK_##sdep, #sdep } - - #define show_tick_dep_name(val) \ -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 43d43a2d..e68c0a7 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -242,18 +242,6 @@ unlock: - return ret; - } - --static void event_function_local(struct perf_event *event, event_f func, void *data) --{ -- struct event_function_struct efs = { -- .event = event, -- .func = func, -- .data = data, -- }; -- -- int ret = event_function(&efs); -- WARN_ON_ONCE(ret); --} -- - static void event_function_call(struct perf_event *event, event_f func, void *data) - { - struct perf_event_context *ctx = event->ctx; -@@ -303,6 +291,54 @@ again: - raw_spin_unlock_irq(&ctx->lock); - } - -+/* -+ * Similar to event_function_call() + event_function(), but hard assumes IRQs -+ * are already disabled and we're on the right CPU. -+ */ -+static void event_function_local(struct perf_event *event, event_f func, void *data) -+{ -+ struct perf_event_context *ctx = event->ctx; -+ struct perf_cpu_context *cpuctx = __get_cpu_context(ctx); -+ struct task_struct *task = READ_ONCE(ctx->task); -+ struct perf_event_context *task_ctx = NULL; -+ -+ WARN_ON_ONCE(!irqs_disabled()); -+ -+ if (task) { -+ if (task == TASK_TOMBSTONE) -+ return; -+ -+ task_ctx = ctx; -+ } -+ -+ perf_ctx_lock(cpuctx, task_ctx); -+ -+ task = ctx->task; -+ if (task == TASK_TOMBSTONE) -+ goto unlock; -+ -+ if (task) { -+ /* -+ * We must be either inactive or active and the right task, -+ * otherwise we're screwed, since we cannot IPI to somewhere -+ * else. -+ */ -+ if (ctx->is_active) { -+ if (WARN_ON_ONCE(task != current)) -+ goto unlock; -+ -+ if (WARN_ON_ONCE(cpuctx->task_ctx != ctx)) -+ goto unlock; -+ } -+ } else { -+ WARN_ON_ONCE(&cpuctx->ctx != ctx); -+ } -+ -+ func(event, cpuctx, ctx, data); -+unlock: -+ perf_ctx_unlock(cpuctx, task_ctx); -+} -+ - #define PERF_FLAG_ALL (PERF_FLAG_FD_NO_GROUP |\ - PERF_FLAG_FD_OUTPUT |\ - PERF_FLAG_PID_CGROUP |\ -diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c -index b7a525a..8c50276 100644 ---- a/kernel/events/uprobes.c -+++ b/kernel/events/uprobes.c -@@ -172,8 +172,10 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr, - mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end); - err = -EAGAIN; - ptep = page_check_address(page, mm, addr, &ptl, 0); -- if (!ptep) -+ if (!ptep) { -+ mem_cgroup_cancel_charge(kpage, memcg, false); - goto unlock; -+ } - - get_page(kpage); - page_add_new_anon_rmap(kpage, vma, addr, false); -@@ -200,7 +202,6 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr, - - err = 0; - unlock: -- mem_cgroup_cancel_charge(kpage, memcg, false); - mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end); - unlock_page(page); - return err; -diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c -index 38e89ce..0afe671 100644 ---- a/kernel/irq/msi.c -+++ b/kernel/irq/msi.c -@@ -324,7 +324,7 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev, - struct msi_domain_ops *ops = info->ops; - msi_alloc_info_t arg; - struct msi_desc *desc; -- int i, ret, virq = -1; -+ int i, ret, virq; - - ret = msi_domain_prepare_irqs(domain, dev, nvec, &arg); - if (ret) -@@ -332,12 +332,8 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev, - - for_each_msi_entry(desc, dev) { - ops->set_desc(&arg, desc); -- if (info->flags & MSI_FLAG_IDENTITY_MAP) -- virq = (int)ops->get_hwirq(info, &arg); -- else -- virq = -1; - -- virq = __irq_domain_alloc_irqs(domain, virq, desc->nvec_used, -+ virq = __irq_domain_alloc_irqs(domain, -1, desc->nvec_used, - dev_to_node(dev), &arg, false); - if (virq < 0) { - ret = -ENOSPC; -@@ -361,6 +357,17 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev, - else - dev_dbg(dev, "irq [%d-%d] for MSI\n", - virq, virq + desc->nvec_used - 1); -+ /* -+ * This flag is set by the PCI layer as we need to activate -+ * the MSI entries before the PCI layer enables MSI in the -+ * card. Otherwise the card latches a random msi message. -+ */ -+ if (info->flags & MSI_FLAG_ACTIVATE_EARLY) { -+ struct irq_data *irq_data; -+ -+ irq_data = irq_domain_get_irq_data(domain, desc->irq); -+ irq_domain_activate_irq(irq_data); -+ } - } - - return 0; -diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c -index 75f98c5..a24cfb4 100644 ---- a/kernel/sched/cputime.c -+++ b/kernel/sched/cputime.c -@@ -603,19 +603,25 @@ static void cputime_adjust(struct task_cputime *curr, - stime = curr->stime; - utime = curr->utime; - -- if (utime == 0) { -- stime = rtime; -+ /* -+ * If either stime or both stime and utime are 0, assume all runtime is -+ * userspace. Once a task gets some ticks, the monotonicy code at -+ * 'update' will ensure things converge to the observed ratio. -+ */ -+ if (stime == 0) { -+ utime = rtime; - goto update; - } - -- if (stime == 0) { -- utime = rtime; -+ if (utime == 0) { -+ stime = rtime; - goto update; - } - - stime = scale_stime((__force u64)stime, (__force u64)rtime, - (__force u64)(stime + utime)); - -+update: - /* - * Make sure stime doesn't go backwards; this preserves monotonicity - * for utime because rtime is monotonic. -@@ -638,7 +644,6 @@ static void cputime_adjust(struct task_cputime *curr, - stime = rtime - utime; - } - --update: - prev->stime = stime; - prev->utime = utime; - out: -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 343a2b7..07f2825 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -2872,7 +2872,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, - struct page *page; - pgtable_t pgtable; - pmd_t _pmd; -- bool young, write, dirty; -+ bool young, write, dirty, soft_dirty; - unsigned long addr; - int i; - -@@ -2898,6 +2898,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, - write = pmd_write(*pmd); - young = pmd_young(*pmd); - dirty = pmd_dirty(*pmd); -+ soft_dirty = pmd_soft_dirty(*pmd); - - pmdp_huge_split_prepare(vma, haddr, pmd); - pgtable = pgtable_trans_huge_withdraw(mm, pmd); -@@ -2914,6 +2915,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, - swp_entry_t swp_entry; - swp_entry = make_migration_entry(page + i, write); - entry = swp_entry_to_pte(swp_entry); -+ if (soft_dirty) -+ entry = pte_swp_mksoft_dirty(entry); - } else { - entry = mk_pte(page + i, vma->vm_page_prot); - entry = maybe_mkwrite(entry, vma); -@@ -2921,6 +2924,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, - entry = pte_wrprotect(entry); - if (!young) - entry = pte_mkold(entry); -+ if (soft_dirty) -+ entry = pte_mksoft_dirty(entry); - } - if (dirty) - SetPageDirty(page + i); -diff --git a/mm/readahead.c b/mm/readahead.c -index 40be3ae..7f9f8c3 100644 ---- a/mm/readahead.c -+++ b/mm/readahead.c -@@ -8,6 +8,7 @@ - */ - - #include <linux/kernel.h> -+#include <linux/dax.h> - #include <linux/gfp.h> - #include <linux/export.h> - #include <linux/blkdev.h> -@@ -545,6 +546,14 @@ do_readahead(struct address_space *mapping, struct file *filp, - if (!mapping || !mapping->a_ops) - return -EINVAL; - -+ /* -+ * Readahead doesn't make sense for DAX inodes, but we don't want it -+ * to report a failure either. Instead, we just return success and -+ * don't do any work. -+ */ -+ if (dax_mapping(mapping)) -+ return 0; -+ - return force_page_cache_readahead(mapping, filp, index, nr); - } - -diff --git a/mm/slub.c b/mm/slub.c -index 825ff45..7a6d268 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -3479,6 +3479,7 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page, - */ - static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n) - { -+ LIST_HEAD(discard); - struct page *page, *h; - - BUG_ON(irqs_disabled()); -@@ -3486,13 +3487,16 @@ static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n) - list_for_each_entry_safe(page, h, &n->partial, lru) { - if (!page->inuse) { - remove_partial(n, page); -- discard_slab(s, page); -+ list_add(&page->lru, &discard); - } else { - list_slab_objects(s, page, - "Objects remaining in %s on __kmem_cache_shutdown()"); - } - } - spin_unlock_irq(&n->list_lock); -+ -+ list_for_each_entry_safe(page, h, &discard, lru) -+ discard_slab(s, page); - } - - /* -diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index 0c12e40..8cc49c0 100644 ---- a/net/mac80211/cfg.c -+++ b/net/mac80211/cfg.c -@@ -869,7 +869,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev) - - /* free all potentially still buffered bcast frames */ - local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf); -- skb_queue_purge(&sdata->u.ap.ps.bc_buf); -+ ieee80211_purge_tx_queue(&local->hw, &sdata->u.ap.ps.bc_buf); - - mutex_lock(&local->mtx); - ieee80211_vif_copy_chanctx_to_vlans(sdata, true); -diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c -index 2030443..8bad2ad 100644 ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -365,7 +365,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local) - skb = skb_dequeue(&ps->bc_buf); - if (skb) { - purged++; -- dev_kfree_skb(skb); -+ ieee80211_free_txskb(&local->hw, skb); - } - total += skb_queue_len(&ps->bc_buf); - } -@@ -448,7 +448,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx) - if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) { - ps_dbg(tx->sdata, - "BC TX buffer full - dropping the oldest frame\n"); -- dev_kfree_skb(skb_dequeue(&ps->bc_buf)); -+ ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf)); - } else - tx->local->total_ps_buffered++; - -@@ -4055,7 +4055,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw, - sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev); - if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb)) - break; -- dev_kfree_skb_any(skb); -+ ieee80211_free_txskb(hw, skb); - } - - info = IEEE80211_SKB_CB(skb); -diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c -index e64ae93..bf4b0e9 100644 ---- a/net/sunrpc/auth_gss/auth_gss.c -+++ b/net/sunrpc/auth_gss/auth_gss.c -@@ -340,12 +340,14 @@ gss_release_msg(struct gss_upcall_msg *gss_msg) - } - - static struct gss_upcall_msg * --__gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid) -+__gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const struct gss_auth *auth) - { - struct gss_upcall_msg *pos; - list_for_each_entry(pos, &pipe->in_downcall, list) { - if (!uid_eq(pos->uid, uid)) - continue; -+ if (auth && pos->auth->service != auth->service) -+ continue; - atomic_inc(&pos->count); - dprintk("RPC: %s found msg %p\n", __func__, pos); - return pos; -@@ -365,7 +367,7 @@ gss_add_msg(struct gss_upcall_msg *gss_msg) - struct gss_upcall_msg *old; - - spin_lock(&pipe->lock); -- old = __gss_find_upcall(pipe, gss_msg->uid); -+ old = __gss_find_upcall(pipe, gss_msg->uid, gss_msg->auth); - if (old == NULL) { - atomic_inc(&gss_msg->count); - list_add(&gss_msg->list, &pipe->in_downcall); -@@ -714,7 +716,7 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) - err = -ENOENT; - /* Find a matching upcall */ - spin_lock(&pipe->lock); -- gss_msg = __gss_find_upcall(pipe, uid); -+ gss_msg = __gss_find_upcall(pipe, uid, NULL); - if (gss_msg == NULL) { - spin_unlock(&pipe->lock); - goto err_put_ctx; -diff --git a/net/sunrpc/xprtmultipath.c b/net/sunrpc/xprtmultipath.c -index e7fd769..66c9d63 100644 ---- a/net/sunrpc/xprtmultipath.c -+++ b/net/sunrpc/xprtmultipath.c -@@ -271,14 +271,12 @@ struct rpc_xprt *xprt_iter_next_entry_multiple(struct rpc_xprt_iter *xpi, - xprt_switch_find_xprt_t find_next) - { - struct rpc_xprt_switch *xps = rcu_dereference(xpi->xpi_xpswitch); -- struct list_head *head; - - if (xps == NULL) - return NULL; -- head = &xps->xps_xprt_list; -- if (xps->xps_nxprts < 2) -- return xprt_switch_find_first_entry(head); -- return xprt_switch_set_next_cursor(head, &xpi->xpi_cursor, find_next); -+ return xprt_switch_set_next_cursor(&xps->xps_xprt_list, -+ &xpi->xpi_cursor, -+ find_next); - } - - static -diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c -index 7e2b2fa..167cf59 100644 ---- a/net/sunrpc/xprtsock.c -+++ b/net/sunrpc/xprtsock.c -@@ -2278,6 +2278,10 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock) - /* SYN_SENT! */ - if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO) - xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO; -+ break; -+ case -EADDRNOTAVAIL: -+ /* Source port number is unavailable. Try a new one! */ -+ transport->srcport = 0; - } - out: - return ret; -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 89dacf9..160c7f7 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -906,20 +906,23 @@ static int azx_resume(struct device *dev) - struct snd_card *card = dev_get_drvdata(dev); - struct azx *chip; - struct hda_intel *hda; -+ struct hdac_bus *bus; - - if (!card) - return 0; - - chip = card->private_data; - hda = container_of(chip, struct hda_intel, chip); -+ bus = azx_bus(chip); - if (chip->disabled || hda->init_failed || !chip->running) - return 0; - -- if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL -- && hda->need_i915_power) { -- snd_hdac_display_power(azx_bus(chip), true); -- snd_hdac_i915_set_bclk(azx_bus(chip)); -+ if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) { -+ snd_hdac_display_power(bus, true); -+ if (hda->need_i915_power) -+ snd_hdac_i915_set_bclk(bus); - } -+ - if (chip->msi) - if (pci_enable_msi(pci) < 0) - chip->msi = 0; -@@ -929,6 +932,11 @@ static int azx_resume(struct device *dev) - - hda_intel_init_chip(chip, true); - -+ /* power down again for link-controlled chips */ -+ if ((chip->driver_caps & AZX_DCAPS_I915_POWERWELL) && -+ !hda->need_i915_power) -+ snd_hdac_display_power(bus, false); -+ - snd_power_change_state(card, SNDRV_CTL_POWER_D0); - - trace_azx_resume(chip); -@@ -1008,6 +1016,7 @@ static int azx_runtime_resume(struct device *dev) - - chip = card->private_data; - hda = container_of(chip, struct hda_intel, chip); -+ bus = azx_bus(chip); - if (chip->disabled || hda->init_failed) - return 0; - -@@ -1015,15 +1024,9 @@ static int azx_runtime_resume(struct device *dev) - return 0; - - if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) { -- bus = azx_bus(chip); -- if (hda->need_i915_power) { -- snd_hdac_display_power(bus, true); -+ snd_hdac_display_power(bus, true); -+ if (hda->need_i915_power) - snd_hdac_i915_set_bclk(bus); -- } else { -- /* toggle codec wakeup bit for STATESTS read */ -- snd_hdac_set_codec_wakeup(bus, true); -- snd_hdac_set_codec_wakeup(bus, false); -- } - } - - /* Read STATESTS before controller reset */ -@@ -1043,6 +1046,11 @@ static int azx_runtime_resume(struct device *dev) - azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) & - ~STATESTS_INT_MASK); - -+ /* power down again for link-controlled chips */ -+ if ((chip->driver_caps & AZX_DCAPS_I915_POWERWELL) && -+ !hda->need_i915_power) -+ snd_hdac_display_power(bus, false); -+ - trace_azx_runtime_resume(chip); - return 0; - } -diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c -index 204cc07..41aa335 100644 ---- a/sound/usb/line6/pcm.c -+++ b/sound/usb/line6/pcm.c -@@ -55,7 +55,6 @@ static int snd_line6_impulse_volume_put(struct snd_kcontrol *kcontrol, - err = line6_pcm_acquire(line6pcm, LINE6_STREAM_IMPULSE); - if (err < 0) { - line6pcm->impulse_volume = 0; -- line6_pcm_release(line6pcm, LINE6_STREAM_IMPULSE); - return err; - } - } else { -@@ -211,7 +210,9 @@ static void line6_stream_stop(struct snd_line6_pcm *line6pcm, int direction, - spin_lock_irqsave(&pstr->lock, flags); - clear_bit(type, &pstr->running); - if (!pstr->running) { -+ spin_unlock_irqrestore(&pstr->lock, flags); - line6_unlink_audio_urbs(line6pcm, pstr); -+ spin_lock_irqsave(&pstr->lock, flags); - if (direction == SNDRV_PCM_STREAM_CAPTURE) { - line6pcm->prev_fbuf = NULL; - line6pcm->prev_fsize = 0; -diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c -index daf81d1..45dd348 100644 ---- a/sound/usb/line6/pod.c -+++ b/sound/usb/line6/pod.c -@@ -244,8 +244,8 @@ static int pod_set_system_param_int(struct usb_line6_pod *pod, int value, - static ssize_t serial_number_show(struct device *dev, - struct device_attribute *attr, char *buf) - { -- struct usb_interface *interface = to_usb_interface(dev); -- struct usb_line6_pod *pod = usb_get_intfdata(interface); -+ struct snd_card *card = dev_to_snd_card(dev); -+ struct usb_line6_pod *pod = card->private_data; - - return sprintf(buf, "%u\n", pod->serial_number); - } -@@ -256,8 +256,8 @@ static ssize_t serial_number_show(struct device *dev, - static ssize_t firmware_version_show(struct device *dev, - struct device_attribute *attr, char *buf) - { -- struct usb_interface *interface = to_usb_interface(dev); -- struct usb_line6_pod *pod = usb_get_intfdata(interface); -+ struct snd_card *card = dev_to_snd_card(dev); -+ struct usb_line6_pod *pod = card->private_data; - - return sprintf(buf, "%d.%02d\n", pod->firmware_version / 100, - pod->firmware_version % 100); -@@ -269,8 +269,8 @@ static ssize_t firmware_version_show(struct device *dev, - static ssize_t device_id_show(struct device *dev, - struct device_attribute *attr, char *buf) - { -- struct usb_interface *interface = to_usb_interface(dev); -- struct usb_line6_pod *pod = usb_get_intfdata(interface); -+ struct snd_card *card = dev_to_snd_card(dev); -+ struct usb_line6_pod *pod = card->private_data; - - return sprintf(buf, "%d\n", pod->device_id); - } -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 6adde45..6cf1f35 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1128,6 +1128,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) - { - /* devices which do not support reading the sample rate. */ - switch (chip->usb_id) { -+ case USB_ID(0x041E, 0x4080): /* Creative Live Cam VF0610 */ - case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema */ - case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */ - case USB_ID(0x045E, 0x076E): /* MS Lifecam HD-5001 */ -@@ -1138,6 +1139,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) - case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */ - case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ - case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */ -+ case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */ - case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ - case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */ - case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */ -diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c -index a07b960..853b26d 100644 ---- a/tools/perf/arch/x86/util/intel-pt.c -+++ b/tools/perf/arch/x86/util/intel-pt.c -@@ -501,7 +501,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr, - struct intel_pt_recording *ptr = - container_of(itr, struct intel_pt_recording, itr); - struct perf_pmu *intel_pt_pmu = ptr->intel_pt_pmu; -- bool have_timing_info; -+ bool have_timing_info, need_immediate = false; - struct perf_evsel *evsel, *intel_pt_evsel = NULL; - const struct cpu_map *cpus = evlist->cpus; - bool privileged = geteuid() == 0 || perf_event_paranoid() < 0; -@@ -655,6 +655,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr, - ptr->have_sched_switch = 3; - } else { - opts->record_switch_events = true; -+ need_immediate = true; - if (cpu_wide) - ptr->have_sched_switch = 3; - else -@@ -700,6 +701,9 @@ static int intel_pt_recording_options(struct auxtrace_record *itr, - tracking_evsel->attr.freq = 0; - tracking_evsel->attr.sample_period = 1; - -+ if (need_immediate) -+ tracking_evsel->immediate = true; -+ - /* In per-cpu case, always need the time of mmap events etc */ - if (!cpu_map__empty(cpus)) { - perf_evsel__set_sample_bit(tracking_evsel, TIME); -diff --git a/tools/perf/builtin-mem.c b/tools/perf/builtin-mem.c -index 1dc140c..3f02bea10 100644 ---- a/tools/perf/builtin-mem.c -+++ b/tools/perf/builtin-mem.c -@@ -87,6 +87,9 @@ static int __cmd_record(int argc, const char **argv, struct perf_mem *mem) - if (mem->operation & MEM_OPERATION_LOAD) - perf_mem_events[PERF_MEM_EVENTS__LOAD].record = true; - -+ if (mem->operation & MEM_OPERATION_STORE) -+ perf_mem_events[PERF_MEM_EVENTS__STORE].record = true; -+ - if (perf_mem_events[PERF_MEM_EVENTS__LOAD].record) - rec_argv[i++] = "-W"; - -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index 87a297d..c33efb9 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -827,7 +827,8 @@ int dso__load_sym(struct dso *dso, struct map *map, - sec = syms_ss->symtab; - shdr = syms_ss->symshdr; - -- if (elf_section_by_name(elf, &ehdr, &tshdr, ".text", NULL)) -+ if (elf_section_by_name(runtime_ss->elf, &runtime_ss->ehdr, &tshdr, -+ ".text", NULL)) - dso->text_offset = tshdr.sh_addr - tshdr.sh_offset; - - if (runtime_ss->opdsec) -diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c -index c919866..1bfacc8 100644 ---- a/tools/testing/nvdimm/test/nfit.c -+++ b/tools/testing/nvdimm/test/nfit.c -@@ -13,6 +13,7 @@ - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt - #include <linux/platform_device.h> - #include <linux/dma-mapping.h> -+#include <linux/workqueue.h> - #include <linux/libnvdimm.h> - #include <linux/vmalloc.h> - #include <linux/device.h> -@@ -1480,6 +1481,7 @@ static int nfit_test_probe(struct platform_device *pdev) - if (nfit_test->setup != nfit_test0_setup) - return 0; - -+ flush_work(&acpi_desc->work); - nfit_test->setup_hotplug = 1; - nfit_test->setup(nfit_test); - diff --git a/4.7.4/1003_linux-4.7.4.patch b/4.7.4/1003_linux-4.7.4.patch deleted file mode 100644 index af6c1d4..0000000 --- a/4.7.4/1003_linux-4.7.4.patch +++ /dev/null @@ -1,2424 +0,0 @@ -diff --git a/Makefile b/Makefile -index 4afff18..ec3bd11 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 7 --SUBLEVEL = 3 -+SUBLEVEL = 4 - EXTRAVERSION = - NAME = Psychotic Stoned Sheep - -diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c -index 60078a6..b15e1c1 100644 ---- a/arch/x86/kernel/apic/apic.c -+++ b/arch/x86/kernel/apic/apic.c -@@ -1597,6 +1597,9 @@ void __init enable_IR_x2apic(void) - unsigned long flags; - int ret, ir_stat; - -+ if (skip_ioapic_setup) -+ return; -+ - ir_stat = irq_remapping_prepare(); - if (ir_stat < 0 && !x2apic_supported()) - return; -diff --git a/block/blk-core.c b/block/blk-core.c -index 2475b1c7..b993f88 100644 ---- a/block/blk-core.c -+++ b/block/blk-core.c -@@ -515,7 +515,9 @@ EXPORT_SYMBOL_GPL(blk_queue_bypass_end); - - void blk_set_queue_dying(struct request_queue *q) - { -- queue_flag_set_unlocked(QUEUE_FLAG_DYING, q); -+ spin_lock_irq(q->queue_lock); -+ queue_flag_set(QUEUE_FLAG_DYING, q); -+ spin_unlock_irq(q->queue_lock); - - if (q->mq_ops) - blk_mq_wake_waiters(q); -diff --git a/block/blk-merge.c b/block/blk-merge.c -index 2613531..bea9344 100644 ---- a/block/blk-merge.c -+++ b/block/blk-merge.c -@@ -94,9 +94,31 @@ static struct bio *blk_bio_segment_split(struct request_queue *q, - bool do_split = true; - struct bio *new = NULL; - const unsigned max_sectors = get_max_io_size(q, bio); -+ unsigned bvecs = 0; - - bio_for_each_segment(bv, bio, iter) { - /* -+ * With arbitrary bio size, the incoming bio may be very -+ * big. We have to split the bio into small bios so that -+ * each holds at most BIO_MAX_PAGES bvecs because -+ * bio_clone() can fail to allocate big bvecs. -+ * -+ * It should have been better to apply the limit per -+ * request queue in which bio_clone() is involved, -+ * instead of globally. The biggest blocker is the -+ * bio_clone() in bio bounce. -+ * -+ * If bio is splitted by this reason, we should have -+ * allowed to continue bios merging, but don't do -+ * that now for making the change simple. -+ * -+ * TODO: deal with bio bounce's bio_clone() gracefully -+ * and convert the global limit into per-queue limit. -+ */ -+ if (bvecs++ >= BIO_MAX_PAGES) -+ goto split; -+ -+ /* - * If the queue doesn't support SG gaps and adding this - * offset would create a gap, disallow it. - */ -diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c -index 84708a5..b206115 100644 ---- a/drivers/block/floppy.c -+++ b/drivers/block/floppy.c -@@ -3663,11 +3663,6 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) - - opened_bdev[drive] = bdev; - -- if (!(mode & (FMODE_READ|FMODE_WRITE))) { -- res = -EINVAL; -- goto out; -- } -- - res = -ENXIO; - - if (!floppy_track_buffer) { -@@ -3711,20 +3706,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) - if (UFDCS->rawcmd == 1) - UFDCS->rawcmd = 2; - -- UDRS->last_checked = 0; -- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); -- check_disk_change(bdev); -- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) -- goto out; -- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) -- goto out; -- -- res = -EROFS; -- -- if ((mode & FMODE_WRITE) && -- !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) -- goto out; -- -+ if (!(mode & FMODE_NDELAY)) { -+ if (mode & (FMODE_READ|FMODE_WRITE)) { -+ UDRS->last_checked = 0; -+ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); -+ check_disk_change(bdev); -+ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) -+ goto out; -+ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) -+ goto out; -+ } -+ res = -EROFS; -+ if ((mode & FMODE_WRITE) && -+ !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) -+ goto out; -+ } - mutex_unlock(&open_lock); - mutex_unlock(&floppy_mutex); - return 0; -diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c -index 0bb44d5..2ee40fd 100644 ---- a/drivers/cpufreq/cpufreq-dt-platdev.c -+++ b/drivers/cpufreq/cpufreq-dt-platdev.c -@@ -74,6 +74,8 @@ static const struct of_device_id machines[] __initconst = { - { .compatible = "ti,omap5", }, - - { .compatible = "xlnx,zynq-7000", }, -+ -+ { } - }; - - static int __init cpufreq_dt_platdev_init(void) -diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c -index 6dc5971..b304421 100644 ---- a/drivers/crypto/caam/caamalg.c -+++ b/drivers/crypto/caam/caamalg.c -@@ -556,7 +556,10 @@ skip_enc: - - /* Read and write assoclen bytes */ - append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ); -- append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ); -+ if (alg->caam.geniv) -+ append_math_add_imm_u32(desc, VARSEQOUTLEN, REG3, IMM, ivsize); -+ else -+ append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ); - - /* Skip assoc data */ - append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF); -@@ -565,6 +568,14 @@ skip_enc: - append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS2 | FIFOLD_TYPE_MSG | - KEY_VLF); - -+ if (alg->caam.geniv) { -+ append_seq_load(desc, ivsize, LDST_CLASS_1_CCB | -+ LDST_SRCDST_BYTE_CONTEXT | -+ (ctx1_iv_off << LDST_OFFSET_SHIFT)); -+ append_move(desc, MOVE_SRC_CLASS1CTX | MOVE_DEST_CLASS2INFIFO | -+ (ctx1_iv_off << MOVE_OFFSET_SHIFT) | ivsize); -+ } -+ - /* Load Counter into CONTEXT1 reg */ - if (is_rfc3686) - append_load_imm_u32(desc, be32_to_cpu(1), LDST_IMM | -@@ -2150,7 +2161,7 @@ static void init_authenc_job(struct aead_request *req, - - init_aead_job(req, edesc, all_contig, encrypt); - -- if (ivsize && (is_rfc3686 || !(alg->caam.geniv && encrypt))) -+ if (ivsize && ((is_rfc3686 && encrypt) || !alg->caam.geniv)) - append_load_as_imm(desc, req->iv, ivsize, - LDST_CLASS_1_CCB | - LDST_SRCDST_BYTE_CONTEXT | -@@ -2537,20 +2548,6 @@ static int aead_decrypt(struct aead_request *req) - return ret; - } - --static int aead_givdecrypt(struct aead_request *req) --{ -- struct crypto_aead *aead = crypto_aead_reqtfm(req); -- unsigned int ivsize = crypto_aead_ivsize(aead); -- -- if (req->cryptlen < ivsize) -- return -EINVAL; -- -- req->cryptlen -= ivsize; -- req->assoclen += ivsize; -- -- return aead_decrypt(req); --} -- - /* - * allocate and map the ablkcipher extended descriptor for ablkcipher - */ -@@ -3210,7 +3207,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = AES_BLOCK_SIZE, - .maxauthsize = MD5_DIGEST_SIZE, - }, -@@ -3256,7 +3253,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = AES_BLOCK_SIZE, - .maxauthsize = SHA1_DIGEST_SIZE, - }, -@@ -3302,7 +3299,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = AES_BLOCK_SIZE, - .maxauthsize = SHA224_DIGEST_SIZE, - }, -@@ -3348,7 +3345,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = AES_BLOCK_SIZE, - .maxauthsize = SHA256_DIGEST_SIZE, - }, -@@ -3394,7 +3391,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = AES_BLOCK_SIZE, - .maxauthsize = SHA384_DIGEST_SIZE, - }, -@@ -3440,7 +3437,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = AES_BLOCK_SIZE, - .maxauthsize = SHA512_DIGEST_SIZE, - }, -@@ -3486,7 +3483,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = DES3_EDE_BLOCK_SIZE, - .maxauthsize = MD5_DIGEST_SIZE, - }, -@@ -3534,7 +3531,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = DES3_EDE_BLOCK_SIZE, - .maxauthsize = SHA1_DIGEST_SIZE, - }, -@@ -3582,7 +3579,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = DES3_EDE_BLOCK_SIZE, - .maxauthsize = SHA224_DIGEST_SIZE, - }, -@@ -3630,7 +3627,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = DES3_EDE_BLOCK_SIZE, - .maxauthsize = SHA256_DIGEST_SIZE, - }, -@@ -3678,7 +3675,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = DES3_EDE_BLOCK_SIZE, - .maxauthsize = SHA384_DIGEST_SIZE, - }, -@@ -3726,7 +3723,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = DES3_EDE_BLOCK_SIZE, - .maxauthsize = SHA512_DIGEST_SIZE, - }, -@@ -3772,7 +3769,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = DES_BLOCK_SIZE, - .maxauthsize = MD5_DIGEST_SIZE, - }, -@@ -3818,7 +3815,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = DES_BLOCK_SIZE, - .maxauthsize = SHA1_DIGEST_SIZE, - }, -@@ -3864,7 +3861,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = DES_BLOCK_SIZE, - .maxauthsize = SHA224_DIGEST_SIZE, - }, -@@ -3910,7 +3907,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = DES_BLOCK_SIZE, - .maxauthsize = SHA256_DIGEST_SIZE, - }, -@@ -3956,7 +3953,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = DES_BLOCK_SIZE, - .maxauthsize = SHA384_DIGEST_SIZE, - }, -@@ -4002,7 +3999,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = DES_BLOCK_SIZE, - .maxauthsize = SHA512_DIGEST_SIZE, - }, -@@ -4051,7 +4048,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = CTR_RFC3686_IV_SIZE, - .maxauthsize = MD5_DIGEST_SIZE, - }, -@@ -4102,7 +4099,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = CTR_RFC3686_IV_SIZE, - .maxauthsize = SHA1_DIGEST_SIZE, - }, -@@ -4153,7 +4150,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = CTR_RFC3686_IV_SIZE, - .maxauthsize = SHA224_DIGEST_SIZE, - }, -@@ -4204,7 +4201,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = CTR_RFC3686_IV_SIZE, - .maxauthsize = SHA256_DIGEST_SIZE, - }, -@@ -4255,7 +4252,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = CTR_RFC3686_IV_SIZE, - .maxauthsize = SHA384_DIGEST_SIZE, - }, -@@ -4306,7 +4303,7 @@ static struct caam_aead_alg driver_aeads[] = { - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .encrypt = aead_encrypt, -- .decrypt = aead_givdecrypt, -+ .decrypt = aead_decrypt, - .ivsize = CTR_RFC3686_IV_SIZE, - .maxauthsize = SHA512_DIGEST_SIZE, - }, -diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c -index 9bb99e2..79a05a3 100644 ---- a/drivers/gpu/drm/drm_atomic.c -+++ b/drivers/gpu/drm/drm_atomic.c -@@ -465,7 +465,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc, - val, - -1, - &replaced); -- state->color_mgmt_changed = replaced; -+ state->color_mgmt_changed |= replaced; - return ret; - } else if (property == config->ctm_property) { - ret = drm_atomic_replace_property_blob_from_id(crtc, -@@ -473,7 +473,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc, - val, - sizeof(struct drm_color_ctm), - &replaced); -- state->color_mgmt_changed = replaced; -+ state->color_mgmt_changed |= replaced; - return ret; - } else if (property == config->gamma_lut_property) { - ret = drm_atomic_replace_property_blob_from_id(crtc, -@@ -481,7 +481,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc, - val, - -1, - &replaced); -- state->color_mgmt_changed = replaced; -+ state->color_mgmt_changed |= replaced; - return ret; - } else if (crtc->funcs->atomic_set_property) - return crtc->funcs->atomic_set_property(crtc, state, property, val); -diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c -index 0e3cc66..a5cae1b 100644 ---- a/drivers/gpu/drm/drm_crtc.c -+++ b/drivers/gpu/drm/drm_crtc.c -@@ -5312,6 +5312,9 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev, - struct drm_pending_vblank_event *e = NULL; - int ret = -EINVAL; - -+ if (!drm_core_check_feature(dev, DRIVER_MODESET)) -+ return -EINVAL; -+ - if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS || - page_flip->reserved != 0) - return -EINVAL; -diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c -index eb4bb8b..eb515f0 100644 ---- a/drivers/gpu/drm/msm/msm_gem_submit.c -+++ b/drivers/gpu/drm/msm/msm_gem_submit.c -@@ -62,6 +62,14 @@ void msm_gem_submit_free(struct msm_gem_submit *submit) - kfree(submit); - } - -+static inline unsigned long __must_check -+copy_from_user_inatomic(void *to, const void __user *from, unsigned long n) -+{ -+ if (access_ok(VERIFY_READ, from, n)) -+ return __copy_from_user_inatomic(to, from, n); -+ return -EFAULT; -+} -+ - static int submit_lookup_objects(struct msm_gem_submit *submit, - struct drm_msm_gem_submit *args, struct drm_file *file) - { -@@ -69,6 +77,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, - int ret = 0; - - spin_lock(&file->table_lock); -+ pagefault_disable(); - - for (i = 0; i < args->nr_bos; i++) { - struct drm_msm_gem_submit_bo submit_bo; -@@ -82,10 +91,15 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, - */ - submit->bos[i].flags = 0; - -- ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo)); -- if (ret) { -- ret = -EFAULT; -- goto out_unlock; -+ ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo)); -+ if (unlikely(ret)) { -+ pagefault_enable(); -+ spin_unlock(&file->table_lock); -+ ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo)); -+ if (ret) -+ goto out; -+ spin_lock(&file->table_lock); -+ pagefault_disable(); - } - - if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) { -@@ -125,9 +139,12 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, - } - - out_unlock: -- submit->nr_bos = i; -+ pagefault_enable(); - spin_unlock(&file->table_lock); - -+out: -+ submit->nr_bos = i; -+ - return ret; - } - -diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c -index 259cd6e..17e3454 100644 ---- a/drivers/gpu/drm/radeon/atombios_crtc.c -+++ b/drivers/gpu/drm/radeon/atombios_crtc.c -@@ -627,7 +627,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc, - if (radeon_crtc->ss.refdiv) { - radeon_crtc->pll_flags |= RADEON_PLL_USE_REF_DIV; - radeon_crtc->pll_reference_div = radeon_crtc->ss.refdiv; -- if (rdev->family >= CHIP_RV770) -+ if (ASIC_IS_AVIVO(rdev) && -+ rdev->family != CHIP_RS780 && -+ rdev->family != CHIP_RS880) - radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV; - } - } -diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c -index 590b037..0ab76dd 100644 ---- a/drivers/gpu/drm/radeon/radeon_ttm.c -+++ b/drivers/gpu/drm/radeon/radeon_ttm.c -@@ -263,8 +263,8 @@ static int radeon_move_blit(struct ttm_buffer_object *bo, - - rdev = radeon_get_rdev(bo->bdev); - ridx = radeon_copy_ring_index(rdev); -- old_start = old_mem->start << PAGE_SHIFT; -- new_start = new_mem->start << PAGE_SHIFT; -+ old_start = (u64)old_mem->start << PAGE_SHIFT; -+ new_start = (u64)new_mem->start << PAGE_SHIFT; - - switch (old_mem->mem_type) { - case TTM_PL_VRAM: -diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h -index 37cac59..2e24616 100644 ---- a/drivers/gpu/drm/vc4/vc4_drv.h -+++ b/drivers/gpu/drm/vc4/vc4_drv.h -@@ -321,6 +321,15 @@ vc4_first_render_job(struct vc4_dev *vc4) - struct vc4_exec_info, head); - } - -+static inline struct vc4_exec_info * -+vc4_last_render_job(struct vc4_dev *vc4) -+{ -+ if (list_empty(&vc4->render_job_list)) -+ return NULL; -+ return list_last_entry(&vc4->render_job_list, -+ struct vc4_exec_info, head); -+} -+ - /** - * struct vc4_texture_sample_info - saves the offsets into the UBO for texture - * setup parameters. -diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c -index 46899d6..78ab08e 100644 ---- a/drivers/gpu/drm/vc4/vc4_gem.c -+++ b/drivers/gpu/drm/vc4/vc4_gem.c -@@ -574,8 +574,8 @@ vc4_cl_lookup_bos(struct drm_device *dev, - spin_unlock(&file_priv->table_lock); - - fail: -- kfree(handles); -- return 0; -+ drm_free_large(handles); -+ return ret; - } - - static int -diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c -index b0104a34..094bc6a 100644 ---- a/drivers/gpu/drm/vc4/vc4_irq.c -+++ b/drivers/gpu/drm/vc4/vc4_irq.c -@@ -83,8 +83,10 @@ vc4_overflow_mem_work(struct work_struct *work) - - spin_lock_irqsave(&vc4->job_lock, irqflags); - current_exec = vc4_first_bin_job(vc4); -+ if (!current_exec) -+ current_exec = vc4_last_render_job(vc4); - if (current_exec) { -- vc4->overflow_mem->seqno = vc4->finished_seqno + 1; -+ vc4->overflow_mem->seqno = current_exec->seqno; - list_add_tail(&vc4->overflow_mem->unref_head, - ¤t_exec->unref_list); - vc4->overflow_mem = NULL; -diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c -index 70ed1d0..d3ef0fc 100644 ---- a/drivers/irqchip/irq-mips-gic.c -+++ b/drivers/irqchip/irq-mips-gic.c -@@ -713,9 +713,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq, - unsigned long flags; - int i; - -- irq_set_chip_and_handler(virq, &gic_level_irq_controller, -- handle_level_irq); -- - spin_lock_irqsave(&gic_lock, flags); - gic_map_to_pin(intr, gic_cpu_pin); - gic_map_to_vpe(intr, mips_cm_vp_id(vpe)); -@@ -732,6 +729,10 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq, - { - if (GIC_HWIRQ_TO_LOCAL(hw) < GIC_NUM_LOCAL_INTRS) - return gic_local_irq_domain_map(d, virq, hw); -+ -+ irq_set_chip_and_handler(virq, &gic_level_irq_controller, -+ handle_level_irq); -+ - return gic_shared_irq_domain_map(d, virq, hw, 0); - } - -@@ -771,11 +772,13 @@ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq, - hwirq = GIC_SHARED_TO_HWIRQ(base_hwirq + i); - - ret = irq_domain_set_hwirq_and_chip(d, virq + i, hwirq, -- &gic_edge_irq_controller, -+ &gic_level_irq_controller, - NULL); - if (ret) - goto error; - -+ irq_set_handler(virq + i, handle_level_irq); -+ - ret = gic_shared_irq_domain_map(d, virq + i, hwirq, cpu); - if (ret) - goto error; -@@ -890,10 +893,17 @@ void gic_dev_domain_free(struct irq_domain *d, unsigned int virq, - return; - } - -+static void gic_dev_domain_activate(struct irq_domain *domain, -+ struct irq_data *d) -+{ -+ gic_shared_irq_domain_map(domain, d->irq, d->hwirq, 0); -+} -+ - static struct irq_domain_ops gic_dev_domain_ops = { - .xlate = gic_dev_domain_xlate, - .alloc = gic_dev_domain_alloc, - .free = gic_dev_domain_free, -+ .activate = gic_dev_domain_activate, - }; - - static int gic_ipi_domain_xlate(struct irq_domain *d, struct device_node *ctrlr, -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index f5dbb4e..5d3b231 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -1818,7 +1818,7 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca) - free = roundup_pow_of_two(ca->sb.nbuckets) >> 10; - - if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) || -- !init_fifo(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) || -+ !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) || - !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) || - !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) || - !init_fifo(&ca->free_inc, free << 2, GFP_KERNEL) || -diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c -index e2fb44c..dc3a854 100644 ---- a/drivers/misc/mei/hw-me.c -+++ b/drivers/misc/mei/hw-me.c -@@ -1263,8 +1263,14 @@ static bool mei_me_fw_type_nm(struct pci_dev *pdev) - static bool mei_me_fw_type_sps(struct pci_dev *pdev) - { - u32 reg; -- /* Read ME FW Status check for SPS Firmware */ -- pci_read_config_dword(pdev, PCI_CFG_HFS_1, ®); -+ unsigned int devfn; -+ -+ /* -+ * Read ME FW Status register to check for SPS Firmware -+ * The SPS FW is only signaled in pci function 0 -+ */ -+ devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0); -+ pci_bus_read_config_dword(pdev->bus, devfn, PCI_CFG_HFS_1, ®); - trace_mei_pci_cfg_read(&pdev->dev, "PCI_CFG_HFS_1", PCI_CFG_HFS_1, reg); - /* if bits [19:16] = 15, running SPS Firmware */ - return (reg & 0xf0000) == 0xf0000; -diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c -index 64e64da..71cea9b 100644 ---- a/drivers/misc/mei/pci-me.c -+++ b/drivers/misc/mei/pci-me.c -@@ -85,8 +85,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = { - - {MEI_PCI_DEVICE(MEI_DEV_ID_SPT, mei_me_pch8_cfg)}, - {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)}, -- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_cfg)}, -- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_cfg)}, -+ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)}, -+ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)}, - - {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)}, - {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)}, -diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c -index 83458f7..6dc96c8 100644 ---- a/drivers/scsi/constants.c -+++ b/drivers/scsi/constants.c -@@ -361,8 +361,9 @@ static const char * const snstext[] = { - - /* Get sense key string or NULL if not available */ - const char * --scsi_sense_key_string(unsigned char key) { -- if (key <= 0xE) -+scsi_sense_key_string(unsigned char key) -+{ -+ if (key < ARRAY_SIZE(snstext)) - return snstext[key]; - return NULL; - } -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 0a4d54a..591e520 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1196,6 +1196,8 @@ static int acm_probe(struct usb_interface *intf, - } - - if (!buflen) { -+ if (!intf->cur_altsetting || !intf->cur_altsetting->endpoint) -+ return -EINVAL; - if (intf->cur_altsetting->endpoint && - intf->cur_altsetting->endpoint->extralen && - intf->cur_altsetting->endpoint->extra) { -@@ -1276,6 +1278,8 @@ next_desc: - data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num)); - control_interface = intf; - } else { -+ if (!intf->cur_altsetting) -+ return -ENODEV; - if (intf->cur_altsetting->desc.bNumEndpoints != 3) { - dev_dbg(&intf->dev,"No union descriptor, giving up\n"); - return -ENODEV; -@@ -1305,15 +1309,22 @@ next_desc: - combined_interfaces = 1; - /* a popular other OS doesn't use it */ - quirks |= NO_CAP_LINE; -+ if (!data_interface->cur_altsetting) -+ return -EINVAL; - if (data_interface->cur_altsetting->desc.bNumEndpoints != 3) { - dev_err(&intf->dev, "This needs exactly 3 endpoints\n"); - return -EINVAL; - } - look_for_collapsed_interface: -+ if (!data_interface->cur_altsetting) -+ return -EINVAL; - for (i = 0; i < 3; i++) { - struct usb_endpoint_descriptor *ep; - ep = &data_interface->cur_altsetting->endpoint[i].desc; - -+ if (!ep) -+ return -ENODEV; -+ - if (usb_endpoint_is_int_in(ep)) - epctrl = ep; - else if (usb_endpoint_is_bulk_out(ep)) -@@ -1332,8 +1343,12 @@ look_for_collapsed_interface: - skip_normal_probe: - - /*workaround for switched interfaces */ -+ if (!data_interface->cur_altsetting) -+ return -EINVAL; - if (data_interface->cur_altsetting->desc.bInterfaceClass - != CDC_DATA_INTERFACE_TYPE) { -+ if (!control_interface->cur_altsetting) -+ return -EINVAL; - if (control_interface->cur_altsetting->desc.bInterfaceClass - == CDC_DATA_INTERFACE_TYPE) { - dev_dbg(&intf->dev, -@@ -1356,6 +1371,7 @@ skip_normal_probe: - - - if (data_interface->cur_altsetting->desc.bNumEndpoints < 2 || -+ !control_interface->cur_altsetting || - control_interface->cur_altsetting->desc.bNumEndpoints == 0) - return -EINVAL; - -@@ -1363,6 +1379,8 @@ skip_normal_probe: - epread = &data_interface->cur_altsetting->endpoint[0].desc; - epwrite = &data_interface->cur_altsetting->endpoint[1].desc; - -+ if (!epctrl || !epread || !epwrite) -+ return -ENODEV; - - /* workaround for switched endpoints */ - if (!usb_endpoint_dir_in(epread)) { -diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c -index 9d6320e..6e29d05 100644 ---- a/drivers/vhost/scsi.c -+++ b/drivers/vhost/scsi.c -@@ -88,7 +88,7 @@ struct vhost_scsi_cmd { - struct scatterlist *tvc_prot_sgl; - struct page **tvc_upages; - /* Pointer to response header iovec */ -- struct iovec *tvc_resp_iov; -+ struct iovec tvc_resp_iov; - /* Pointer to vhost_scsi for our device */ - struct vhost_scsi *tvc_vhost; - /* Pointer to vhost_virtqueue for the cmd */ -@@ -547,7 +547,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) - memcpy(v_rsp.sense, cmd->tvc_sense_buf, - se_cmd->scsi_sense_length); - -- iov_iter_init(&iov_iter, READ, cmd->tvc_resp_iov, -+ iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov, - cmd->tvc_in_iovs, sizeof(v_rsp)); - ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter); - if (likely(ret == sizeof(v_rsp))) { -@@ -1044,7 +1044,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) - } - cmd->tvc_vhost = vs; - cmd->tvc_vq = vq; -- cmd->tvc_resp_iov = &vq->iov[out]; -+ cmd->tvc_resp_iov = vq->iov[out]; - cmd->tvc_in_iovs = in; - - pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n", -diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c -index 7487971..c1010f01 100644 ---- a/drivers/xen/xenbus/xenbus_dev_frontend.c -+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c -@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsigned msg_type, - rc = -ENOMEM; - goto out; - } -- } else { -+ } else if (msg_type == XS_TRANSACTION_END) { - list_for_each_entry(trans, &u->transactions, list) - if (trans->handle.id == u->u.msg.tx_id) - break; -diff --git a/fs/block_dev.c b/fs/block_dev.c -index 71ccab1..b1495fa 100644 ---- a/fs/block_dev.c -+++ b/fs/block_dev.c -@@ -659,7 +659,7 @@ static struct dentry *bd_mount(struct file_system_type *fs_type, - { - struct dentry *dent; - dent = mount_pseudo(fs_type, "bdev:", &bdev_sops, NULL, BDEVFS_MAGIC); -- if (dent) -+ if (!IS_ERR(dent)) - dent->d_sb->s_iflags |= SB_I_CGROUPWB; - return dent; - } -diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c -index 0f9961e..f96547f 100644 ---- a/fs/crypto/policy.c -+++ b/fs/crypto/policy.c -@@ -95,10 +95,15 @@ static int create_encryption_context_from_policy(struct inode *inode, - int fscrypt_process_policy(struct inode *inode, - const struct fscrypt_policy *policy) - { -+ if (!inode_owner_or_capable(inode)) -+ return -EACCES; -+ - if (policy->version != 0) - return -EINVAL; - - if (!inode_has_encryption_context(inode)) { -+ if (!S_ISDIR(inode->i_mode)) -+ return -EINVAL; - if (!inode->i_sb->s_cop->empty_dir) - return -EOPNOTSUPP; - if (!inode->i_sb->s_cop->empty_dir(inode)) -diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c -index ad05069..8a9feb3 100644 ---- a/fs/ext4/crypto_policy.c -+++ b/fs/ext4/crypto_policy.c -@@ -102,6 +102,9 @@ static int ext4_create_encryption_context_from_policy( - int ext4_process_policy(const struct ext4_encryption_policy *policy, - struct inode *inode) - { -+ if (!inode_owner_or_capable(inode)) -+ return -EACCES; -+ - if (policy->version != 0) - return -EINVAL; - -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index b747ec0..ea628af 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -51,25 +51,31 @@ static __u32 ext4_inode_csum(struct inode *inode, struct ext4_inode *raw, - struct ext4_inode_info *ei) - { - struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); -- __u16 csum_lo; -- __u16 csum_hi = 0; - __u32 csum; -+ __u16 dummy_csum = 0; -+ int offset = offsetof(struct ext4_inode, i_checksum_lo); -+ unsigned int csum_size = sizeof(dummy_csum); - -- csum_lo = le16_to_cpu(raw->i_checksum_lo); -- raw->i_checksum_lo = 0; -- if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE && -- EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) { -- csum_hi = le16_to_cpu(raw->i_checksum_hi); -- raw->i_checksum_hi = 0; -- } -+ csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw, offset); -+ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, csum_size); -+ offset += csum_size; -+ csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset, -+ EXT4_GOOD_OLD_INODE_SIZE - offset); - -- csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw, -- EXT4_INODE_SIZE(inode->i_sb)); -- -- raw->i_checksum_lo = cpu_to_le16(csum_lo); -- if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE && -- EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) -- raw->i_checksum_hi = cpu_to_le16(csum_hi); -+ if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) { -+ offset = offsetof(struct ext4_inode, i_checksum_hi); -+ csum = ext4_chksum(sbi, csum, (__u8 *)raw + -+ EXT4_GOOD_OLD_INODE_SIZE, -+ offset - EXT4_GOOD_OLD_INODE_SIZE); -+ if (EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) { -+ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, -+ csum_size); -+ offset += csum_size; -+ csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset, -+ EXT4_INODE_SIZE(inode->i_sb) - -+ offset); -+ } -+ } - - return csum; - } -@@ -5460,8 +5466,6 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode) - sbi->s_want_extra_isize, - iloc, handle); - if (ret) { -- ext4_set_inode_state(inode, -- EXT4_STATE_NO_EXPAND); - if (mnt_count != - le16_to_cpu(sbi->s_es->s_mnt_count)) { - ext4_warning(inode->i_sb, -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index ec4c399..5bb46b6 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -420,15 +420,14 @@ static __le32 ext4_dx_csum(struct inode *inode, struct ext4_dir_entry *dirent, - struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); - struct ext4_inode_info *ei = EXT4_I(inode); - __u32 csum; -- __le32 save_csum; - int size; -+ __u32 dummy_csum = 0; -+ int offset = offsetof(struct dx_tail, dt_checksum); - - size = count_offset + (count * sizeof(struct dx_entry)); -- save_csum = t->dt_checksum; -- t->dt_checksum = 0; - csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)dirent, size); -- csum = ext4_chksum(sbi, csum, (__u8 *)t, sizeof(struct dx_tail)); -- t->dt_checksum = save_csum; -+ csum = ext4_chksum(sbi, csum, (__u8 *)t, offset); -+ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum)); - - return cpu_to_le32(csum); - } -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 639bd756..d4505f8 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -2068,23 +2068,25 @@ failed: - static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group, - struct ext4_group_desc *gdp) - { -- int offset; -+ int offset = offsetof(struct ext4_group_desc, bg_checksum); - __u16 crc = 0; - __le32 le_group = cpu_to_le32(block_group); - struct ext4_sb_info *sbi = EXT4_SB(sb); - - if (ext4_has_metadata_csum(sbi->s_sb)) { - /* Use new metadata_csum algorithm */ -- __le16 save_csum; - __u32 csum32; -+ __u16 dummy_csum = 0; - -- save_csum = gdp->bg_checksum; -- gdp->bg_checksum = 0; - csum32 = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&le_group, - sizeof(le_group)); -- csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp, -- sbi->s_desc_size); -- gdp->bg_checksum = save_csum; -+ csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp, offset); -+ csum32 = ext4_chksum(sbi, csum32, (__u8 *)&dummy_csum, -+ sizeof(dummy_csum)); -+ offset += sizeof(dummy_csum); -+ if (offset < sbi->s_desc_size) -+ csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp + offset, -+ sbi->s_desc_size - offset); - - crc = csum32 & 0xFFFF; - goto out; -@@ -2094,8 +2096,6 @@ static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group, - if (!ext4_has_feature_gdt_csum(sb)) - return 0; - -- offset = offsetof(struct ext4_group_desc, bg_checksum); -- - crc = crc16(~0, sbi->s_es->s_uuid, sizeof(sbi->s_es->s_uuid)); - crc = crc16(crc, (__u8 *)&le_group, sizeof(le_group)); - crc = crc16(crc, (__u8 *)gdp, offset); -@@ -2131,6 +2131,7 @@ void ext4_group_desc_csum_set(struct super_block *sb, __u32 block_group, - - /* Called at mount-time, super-block is locked */ - static int ext4_check_descriptors(struct super_block *sb, -+ ext4_fsblk_t sb_block, - ext4_group_t *first_not_zeroed) - { - struct ext4_sb_info *sbi = EXT4_SB(sb); -@@ -2161,6 +2162,11 @@ static int ext4_check_descriptors(struct super_block *sb, - grp = i; - - block_bitmap = ext4_block_bitmap(sb, gdp); -+ if (block_bitmap == sb_block) { -+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " -+ "Block bitmap for group %u overlaps " -+ "superblock", i); -+ } - if (block_bitmap < first_block || block_bitmap > last_block) { - ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " - "Block bitmap for group %u not in group " -@@ -2168,6 +2174,11 @@ static int ext4_check_descriptors(struct super_block *sb, - return 0; - } - inode_bitmap = ext4_inode_bitmap(sb, gdp); -+ if (inode_bitmap == sb_block) { -+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " -+ "Inode bitmap for group %u overlaps " -+ "superblock", i); -+ } - if (inode_bitmap < first_block || inode_bitmap > last_block) { - ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " - "Inode bitmap for group %u not in group " -@@ -2175,6 +2186,11 @@ static int ext4_check_descriptors(struct super_block *sb, - return 0; - } - inode_table = ext4_inode_table(sb, gdp); -+ if (inode_table == sb_block) { -+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " -+ "Inode table for group %u overlaps " -+ "superblock", i); -+ } - if (inode_table < first_block || - inode_table + sbi->s_itb_per_group - 1 > last_block) { - ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " -@@ -3677,7 +3693,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - goto failed_mount2; - } - } -- if (!ext4_check_descriptors(sb, &first_not_zeroed)) { -+ if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) { - ext4_msg(sb, KERN_ERR, "group descriptors corrupted!"); - ret = -EFSCORRUPTED; - goto failed_mount2; -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index e79bd32..2eb935c 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -121,17 +121,18 @@ static __le32 ext4_xattr_block_csum(struct inode *inode, - { - struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); - __u32 csum; -- __le32 save_csum; - __le64 dsk_block_nr = cpu_to_le64(block_nr); -+ __u32 dummy_csum = 0; -+ int offset = offsetof(struct ext4_xattr_header, h_checksum); - -- save_csum = hdr->h_checksum; -- hdr->h_checksum = 0; - csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&dsk_block_nr, - sizeof(dsk_block_nr)); -- csum = ext4_chksum(sbi, csum, (__u8 *)hdr, -- EXT4_BLOCK_SIZE(inode->i_sb)); -+ csum = ext4_chksum(sbi, csum, (__u8 *)hdr, offset); -+ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum)); -+ offset += sizeof(dummy_csum); -+ csum = ext4_chksum(sbi, csum, (__u8 *)hdr + offset, -+ EXT4_BLOCK_SIZE(inode->i_sb) - offset); - -- hdr->h_checksum = save_csum; - return cpu_to_le32(csum); - } - -@@ -1352,15 +1353,19 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, - size_t min_offs, free; - int total_ino; - void *base, *start, *end; -- int extra_isize = 0, error = 0, tried_min_extra_isize = 0; -+ int error = 0, tried_min_extra_isize = 0; - int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize); -+ int isize_diff; /* How much do we need to grow i_extra_isize */ - - down_write(&EXT4_I(inode)->xattr_sem); -+ /* -+ * Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty -+ */ -+ ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND); - retry: -- if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) { -- up_write(&EXT4_I(inode)->xattr_sem); -- return 0; -- } -+ isize_diff = new_extra_isize - EXT4_I(inode)->i_extra_isize; -+ if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) -+ goto out; - - header = IHDR(inode, raw_inode); - entry = IFIRST(header); -@@ -1381,7 +1386,7 @@ retry: - goto cleanup; - - free = ext4_xattr_free_space(last, &min_offs, base, &total_ino); -- if (free >= new_extra_isize) { -+ if (free >= isize_diff) { - entry = IFIRST(header); - ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize - - new_extra_isize, (void *)raw_inode + -@@ -1389,8 +1394,7 @@ retry: - (void *)header, total_ino, - inode->i_sb->s_blocksize); - EXT4_I(inode)->i_extra_isize = new_extra_isize; -- error = 0; -- goto cleanup; -+ goto out; - } - - /* -@@ -1413,7 +1417,7 @@ retry: - end = bh->b_data + bh->b_size; - min_offs = end - base; - free = ext4_xattr_free_space(first, &min_offs, base, NULL); -- if (free < new_extra_isize) { -+ if (free < isize_diff) { - if (!tried_min_extra_isize && s_min_extra_isize) { - tried_min_extra_isize++; - new_extra_isize = s_min_extra_isize; -@@ -1427,7 +1431,7 @@ retry: - free = inode->i_sb->s_blocksize; - } - -- while (new_extra_isize > 0) { -+ while (isize_diff > 0) { - size_t offs, size, entry_size; - struct ext4_xattr_entry *small_entry = NULL; - struct ext4_xattr_info i = { -@@ -1458,7 +1462,7 @@ retry: - EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) + - EXT4_XATTR_LEN(last->e_name_len); - if (total_size <= free && total_size < min_total_size) { -- if (total_size < new_extra_isize) { -+ if (total_size < isize_diff) { - small_entry = last; - } else { - entry = last; -@@ -1513,22 +1517,22 @@ retry: - error = ext4_xattr_ibody_set(handle, inode, &i, is); - if (error) - goto cleanup; -+ total_ino -= entry_size; - - entry = IFIRST(header); -- if (entry_size + EXT4_XATTR_SIZE(size) >= new_extra_isize) -- shift_bytes = new_extra_isize; -+ if (entry_size + EXT4_XATTR_SIZE(size) >= isize_diff) -+ shift_bytes = isize_diff; - else -- shift_bytes = entry_size + size; -+ shift_bytes = entry_size + EXT4_XATTR_SIZE(size); - /* Adjust the offsets and shift the remaining entries ahead */ -- ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize - -- shift_bytes, (void *)raw_inode + -- EXT4_GOOD_OLD_INODE_SIZE + extra_isize + shift_bytes, -- (void *)header, total_ino - entry_size, -- inode->i_sb->s_blocksize); -+ ext4_xattr_shift_entries(entry, -shift_bytes, -+ (void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE + -+ EXT4_I(inode)->i_extra_isize + shift_bytes, -+ (void *)header, total_ino, inode->i_sb->s_blocksize); - -- extra_isize += shift_bytes; -- new_extra_isize -= shift_bytes; -- EXT4_I(inode)->i_extra_isize = extra_isize; -+ isize_diff -= shift_bytes; -+ EXT4_I(inode)->i_extra_isize += shift_bytes; -+ header = IHDR(inode, raw_inode); - - i.name = b_entry_name; - i.value = buffer; -@@ -1550,6 +1554,8 @@ retry: - kfree(bs); - } - brelse(bh); -+out: -+ ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND); - up_write(&EXT4_I(inode)->xattr_sem); - return 0; - -@@ -1561,6 +1567,10 @@ cleanup: - kfree(is); - kfree(bs); - brelse(bh); -+ /* -+ * We deliberately leave EXT4_STATE_NO_EXPAND set here since inode -+ * size expansion failed. -+ */ - up_write(&EXT4_I(inode)->xattr_sem); - return error; - } -diff --git a/fs/namei.c b/fs/namei.c -index 70580ab..9281b2b 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -901,6 +901,7 @@ static inline int may_follow_link(struct nameidata *nd) - { - const struct inode *inode; - const struct inode *parent; -+ kuid_t puid; - - if (!sysctl_protected_symlinks) - return 0; -@@ -916,7 +917,8 @@ static inline int may_follow_link(struct nameidata *nd) - return 0; - - /* Allowed if parent directory and link owner match. */ -- if (uid_eq(parent->i_uid, inode->i_uid)) -+ puid = parent->i_uid; -+ if (uid_valid(puid) && uid_eq(puid, inode->i_uid)) - return 0; - - if (nd->flags & LOOKUP_RCU) -diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c -index 80aa6f1..4133aa7 100644 ---- a/fs/overlayfs/copy_up.c -+++ b/fs/overlayfs/copy_up.c -@@ -80,6 +80,8 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new) - } - - for (name = buf; name < (buf + list_size); name += strlen(name) + 1) { -+ if (ovl_is_private_xattr(name)) -+ continue; - retry: - size = vfs_getxattr(old, name, value, value_size); - if (size == -ERANGE) -diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c -index d1cdc60..ac98a71 100644 ---- a/fs/overlayfs/inode.c -+++ b/fs/overlayfs/inode.c -@@ -231,7 +231,7 @@ static int ovl_readlink(struct dentry *dentry, char __user *buf, int bufsiz) - } - - --static bool ovl_is_private_xattr(const char *name) -+bool ovl_is_private_xattr(const char *name) - { - return strncmp(name, OVL_XATTR_PRE_NAME, OVL_XATTR_PRE_LEN) == 0; - } -@@ -279,24 +279,27 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size) - { - struct dentry *realdentry = ovl_dentry_real(dentry); - ssize_t res; -- int off; -+ size_t len; -+ char *s; - - res = vfs_listxattr(realdentry, list, size); - if (res <= 0 || size == 0) - return res; - - /* filter out private xattrs */ -- for (off = 0; off < res;) { -- char *s = list + off; -- size_t slen = strlen(s) + 1; -+ for (s = list, len = res; len;) { -+ size_t slen = strnlen(s, len) + 1; - -- BUG_ON(off + slen > res); -+ /* underlying fs providing us with an broken xattr list? */ -+ if (WARN_ON(slen > len)) -+ return -EIO; - -+ len -= slen; - if (ovl_is_private_xattr(s)) { - res -= slen; -- memmove(s, s + slen, res - off); -+ memmove(s, s + slen, len); - } else { -- off += slen; -+ s += slen; - } - } - -diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h -index cfbca53..d8ddc31 100644 ---- a/fs/overlayfs/overlayfs.h -+++ b/fs/overlayfs/overlayfs.h -@@ -168,6 +168,8 @@ int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list); - void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list); - void ovl_cache_free(struct list_head *list); - int ovl_check_d_type_supported(struct path *realpath); -+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt, -+ struct dentry *dentry, int level); - - /* inode.c */ - int ovl_setattr(struct dentry *dentry, struct iattr *attr); -@@ -180,6 +182,7 @@ ssize_t ovl_getxattr(struct dentry *dentry, struct inode *inode, - ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size); - int ovl_removexattr(struct dentry *dentry, const char *name); - struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags); -+bool ovl_is_private_xattr(const char *name); - - struct inode *ovl_new_inode(struct super_block *sb, umode_t mode, - struct ovl_entry *oe); -diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c -index cf37fc7..f241b4e 100644 ---- a/fs/overlayfs/readdir.c -+++ b/fs/overlayfs/readdir.c -@@ -248,7 +248,7 @@ static inline int ovl_dir_read(struct path *realpath, - err = rdd->err; - } while (!err && rdd->count); - -- if (!err && rdd->first_maybe_whiteout) -+ if (!err && rdd->first_maybe_whiteout && rdd->dentry) - err = ovl_check_whiteouts(realpath->dentry, rdd); - - fput(realfile); -@@ -606,3 +606,64 @@ int ovl_check_d_type_supported(struct path *realpath) - - return rdd.d_type_supported; - } -+ -+static void ovl_workdir_cleanup_recurse(struct path *path, int level) -+{ -+ int err; -+ struct inode *dir = path->dentry->d_inode; -+ LIST_HEAD(list); -+ struct ovl_cache_entry *p; -+ struct ovl_readdir_data rdd = { -+ .ctx.actor = ovl_fill_merge, -+ .dentry = NULL, -+ .list = &list, -+ .root = RB_ROOT, -+ .is_lowest = false, -+ }; -+ -+ err = ovl_dir_read(path, &rdd); -+ if (err) -+ goto out; -+ -+ inode_lock_nested(dir, I_MUTEX_PARENT); -+ list_for_each_entry(p, &list, l_node) { -+ struct dentry *dentry; -+ -+ if (p->name[0] == '.') { -+ if (p->len == 1) -+ continue; -+ if (p->len == 2 && p->name[1] == '.') -+ continue; -+ } -+ dentry = lookup_one_len(p->name, path->dentry, p->len); -+ if (IS_ERR(dentry)) -+ continue; -+ if (dentry->d_inode) -+ ovl_workdir_cleanup(dir, path->mnt, dentry, level); -+ dput(dentry); -+ } -+ inode_unlock(dir); -+out: -+ ovl_cache_free(&list); -+} -+ -+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt, -+ struct dentry *dentry, int level) -+{ -+ int err; -+ -+ if (!d_is_dir(dentry) || level > 1) { -+ ovl_cleanup(dir, dentry); -+ return; -+ } -+ -+ err = ovl_do_rmdir(dir, dentry); -+ if (err) { -+ struct path path = { .mnt = mnt, .dentry = dentry }; -+ -+ inode_unlock(dir); -+ ovl_workdir_cleanup_recurse(&path, level + 1); -+ inode_lock_nested(dir, I_MUTEX_PARENT); -+ ovl_cleanup(dir, dentry); -+ } -+} -diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index 6db75cb..86f2025 100644 ---- a/fs/overlayfs/super.c -+++ b/fs/overlayfs/super.c -@@ -798,6 +798,10 @@ retry: - struct kstat stat = { - .mode = S_IFDIR | 0, - }; -+ struct iattr attr = { -+ .ia_valid = ATTR_MODE, -+ .ia_mode = stat.mode, -+ }; - - if (work->d_inode) { - err = -EEXIST; -@@ -805,7 +809,7 @@ retry: - goto out_dput; - - retried = true; -- ovl_cleanup(dir, work); -+ ovl_workdir_cleanup(dir, mnt, work, 0); - dput(work); - goto retry; - } -@@ -813,6 +817,21 @@ retry: - err = ovl_create_real(dir, work, &stat, NULL, NULL, true); - if (err) - goto out_dput; -+ -+ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT); -+ if (err && err != -ENODATA && err != -EOPNOTSUPP) -+ goto out_dput; -+ -+ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS); -+ if (err && err != -ENODATA && err != -EOPNOTSUPP) -+ goto out_dput; -+ -+ /* Clear any inherited mode bits */ -+ inode_lock(work->d_inode); -+ err = notify_change(work, &attr, NULL); -+ inode_unlock(work->d_inode); -+ if (err) -+ goto out_dput; - } - out_unlock: - inode_unlock(dir); -diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c -index b45345d..51157da 100644 ---- a/fs/ubifs/tnc_commit.c -+++ b/fs/ubifs/tnc_commit.c -@@ -370,7 +370,7 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt) - - p = c->gap_lebs; - do { -- ubifs_assert(p < c->gap_lebs + sizeof(int) * c->lst.idx_lebs); -+ ubifs_assert(p < c->gap_lebs + c->lst.idx_lebs); - written = layout_leb_in_gaps(c, p); - if (written < 0) { - err = written; -diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c -index b5fc279..c63710f 100644 ---- a/fs/ubifs/xattr.c -+++ b/fs/ubifs/xattr.c -@@ -575,7 +575,8 @@ static int ubifs_xattr_get(const struct xattr_handler *handler, - dbg_gen("xattr '%s', ino %lu ('%pd'), buf size %zd", name, - inode->i_ino, dentry, size); - -- return __ubifs_getxattr(inode, name, buffer, size); -+ name = xattr_full_name(handler, name); -+ return __ubifs_getxattr(inode, name, buffer, size); - } - - static int ubifs_xattr_set(const struct xattr_handler *handler, -@@ -586,6 +587,8 @@ static int ubifs_xattr_set(const struct xattr_handler *handler, - dbg_gen("xattr '%s', host ino %lu ('%pd'), size %zd", - name, inode->i_ino, dentry, size); - -+ name = xattr_full_name(handler, name); -+ - if (value) - return __ubifs_setxattr(inode, name, value, size, flags); - else -diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c -index 12ca867..85bdf3d 100644 ---- a/fs/xfs/libxfs/xfs_sb.c -+++ b/fs/xfs/libxfs/xfs_sb.c -@@ -581,7 +581,8 @@ xfs_sb_verify( - * Only check the in progress field for the primary superblock as - * mkfs.xfs doesn't clear it from secondary superblocks. - */ -- return xfs_mount_validate_sb(mp, &sb, bp->b_bn == XFS_SB_DADDR, -+ return xfs_mount_validate_sb(mp, &sb, -+ bp->b_maps[0].bm_bn == XFS_SB_DADDR, - check_version); - } - -diff --git a/include/linux/capability.h b/include/linux/capability.h -index 00690ff..5f3c63d 100644 ---- a/include/linux/capability.h -+++ b/include/linux/capability.h -@@ -206,6 +206,7 @@ extern bool has_ns_capability_noaudit(struct task_struct *t, - struct user_namespace *ns, int cap); - extern bool capable(int cap); - extern bool ns_capable(struct user_namespace *ns, int cap); -+extern bool ns_capable_noaudit(struct user_namespace *ns, int cap); - #else - static inline bool has_capability(struct task_struct *t, int cap) - { -@@ -233,6 +234,10 @@ static inline bool ns_capable(struct user_namespace *ns, int cap) - { - return true; - } -+static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap) -+{ -+ return true; -+} - #endif /* CONFIG_MULTIUSER */ - extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap); - extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap); -diff --git a/kernel/capability.c b/kernel/capability.c -index 45432b5..00411c8 100644 ---- a/kernel/capability.c -+++ b/kernel/capability.c -@@ -361,6 +361,24 @@ bool has_capability_noaudit(struct task_struct *t, int cap) - return has_ns_capability_noaudit(t, &init_user_ns, cap); - } - -+static bool ns_capable_common(struct user_namespace *ns, int cap, bool audit) -+{ -+ int capable; -+ -+ if (unlikely(!cap_valid(cap))) { -+ pr_crit("capable() called with invalid cap=%u\n", cap); -+ BUG(); -+ } -+ -+ capable = audit ? security_capable(current_cred(), ns, cap) : -+ security_capable_noaudit(current_cred(), ns, cap); -+ if (capable == 0) { -+ current->flags |= PF_SUPERPRIV; -+ return true; -+ } -+ return false; -+} -+ - /** - * ns_capable - Determine if the current task has a superior capability in effect - * @ns: The usernamespace we want the capability in -@@ -374,19 +392,27 @@ bool has_capability_noaudit(struct task_struct *t, int cap) - */ - bool ns_capable(struct user_namespace *ns, int cap) - { -- if (unlikely(!cap_valid(cap))) { -- pr_crit("capable() called with invalid cap=%u\n", cap); -- BUG(); -- } -- -- if (security_capable(current_cred(), ns, cap) == 0) { -- current->flags |= PF_SUPERPRIV; -- return true; -- } -- return false; -+ return ns_capable_common(ns, cap, true); - } - EXPORT_SYMBOL(ns_capable); - -+/** -+ * ns_capable_noaudit - Determine if the current task has a superior capability -+ * (unaudited) in effect -+ * @ns: The usernamespace we want the capability in -+ * @cap: The capability to be tested for -+ * -+ * Return true if the current task has the given superior capability currently -+ * available for use, false if not. -+ * -+ * This sets PF_SUPERPRIV on the task if the capability is available on the -+ * assumption that it's about to be used. -+ */ -+bool ns_capable_noaudit(struct user_namespace *ns, int cap) -+{ -+ return ns_capable_common(ns, cap, false); -+} -+EXPORT_SYMBOL(ns_capable_noaudit); - - /** - * capable - Determine if the current task has a superior capability in effect -diff --git a/kernel/cred.c b/kernel/cred.c -index 0c0cd8a..5f264fb 100644 ---- a/kernel/cred.c -+++ b/kernel/cred.c -@@ -689,6 +689,8 @@ EXPORT_SYMBOL(set_security_override_from_ctx); - */ - int set_create_files_as(struct cred *new, struct inode *inode) - { -+ if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid)) -+ return -EINVAL; - new->fsuid = inode->i_uid; - new->fsgid = inode->i_gid; - return security_kernel_create_files_as(new, inode); -diff --git a/kernel/fork.c b/kernel/fork.c -index 4a7ec0c..aea4f4d 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -1406,7 +1406,6 @@ static struct task_struct *copy_process(unsigned long clone_flags, - p->real_start_time = ktime_get_boot_ns(); - p->io_context = NULL; - p->audit_context = NULL; -- threadgroup_change_begin(current); - cgroup_fork(p); - #ifdef CONFIG_NUMA - p->mempolicy = mpol_dup(p->mempolicy); -@@ -1558,6 +1557,7 @@ static struct task_struct *copy_process(unsigned long clone_flags, - INIT_LIST_HEAD(&p->thread_group); - p->task_works = NULL; - -+ threadgroup_change_begin(current); - /* - * Ensure that the cgroup subsystem policies allow the new process to be - * forked. It should be noted the the new process's css_set can be changed -@@ -1658,6 +1658,7 @@ static struct task_struct *copy_process(unsigned long clone_flags, - bad_fork_cancel_cgroup: - cgroup_cancel_fork(p); - bad_fork_free_pid: -+ threadgroup_change_end(current); - if (pid != &init_struct_pid) - free_pid(pid); - bad_fork_cleanup_thread: -@@ -1690,7 +1691,6 @@ bad_fork_cleanup_policy: - mpol_put(p->mempolicy); - bad_fork_cleanup_threadgroup_lock: - #endif -- threadgroup_change_end(current); - delayacct_tsk_free(p); - bad_fork_cleanup_count: - atomic_dec(&p->cred->user->processes); -diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c -index 479d25c..b6c3945 100644 ---- a/kernel/time/timekeeping.c -+++ b/kernel/time/timekeeping.c -@@ -401,7 +401,10 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf) - do { - seq = raw_read_seqcount_latch(&tkf->seq); - tkr = tkf->base + (seq & 0x01); -- now = ktime_to_ns(tkr->base) + timekeeping_get_ns(tkr); -+ now = ktime_to_ns(tkr->base); -+ -+ now += clocksource_delta(tkr->read(tkr->clock), -+ tkr->cycle_last, tkr->mask); - } while (read_seqcount_retry(&tkf->seq, seq)); - - return now; -diff --git a/kernel/time/timekeeping_debug.c b/kernel/time/timekeeping_debug.c -index f6bd652..107310a 100644 ---- a/kernel/time/timekeeping_debug.c -+++ b/kernel/time/timekeeping_debug.c -@@ -23,7 +23,9 @@ - - #include "timekeeping_internal.h" - --static unsigned int sleep_time_bin[32] = {0}; -+#define NUM_BINS 32 -+ -+static unsigned int sleep_time_bin[NUM_BINS] = {0}; - - static int tk_debug_show_sleep_time(struct seq_file *s, void *data) - { -@@ -69,6 +71,9 @@ late_initcall(tk_debug_sleep_time_init); - - void tk_debug_account_sleep_time(struct timespec64 *t) - { -- sleep_time_bin[fls(t->tv_sec)]++; -+ /* Cap bin index so we don't overflow the array */ -+ int bin = min(fls(t->tv_sec), NUM_BINS-1); -+ -+ sleep_time_bin[bin]++; - } - -diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c -index c094754..f02ab80 100644 ---- a/net/sunrpc/xprtrdma/frwr_ops.c -+++ b/net/sunrpc/xprtrdma/frwr_ops.c -@@ -125,17 +125,16 @@ __frwr_reset_mr(struct rpcrdma_ia *ia, struct rpcrdma_mw *r) - } - - static void --__frwr_reset_and_unmap(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mw *mw) -+__frwr_reset_and_unmap(struct rpcrdma_mw *mw) - { -+ struct rpcrdma_xprt *r_xprt = mw->mw_xprt; - struct rpcrdma_ia *ia = &r_xprt->rx_ia; -- struct rpcrdma_frmr *f = &mw->frmr; - int rc; - - rc = __frwr_reset_mr(ia, mw); -- ib_dma_unmap_sg(ia->ri_device, f->fr_sg, f->fr_nents, f->fr_dir); -+ ib_dma_unmap_sg(ia->ri_device, mw->mw_sg, mw->mw_nents, mw->mw_dir); - if (rc) - return; -- - rpcrdma_put_mw(r_xprt, mw); - } - -@@ -152,8 +151,7 @@ __frwr_recovery_worker(struct work_struct *work) - struct rpcrdma_mw *r = container_of(work, struct rpcrdma_mw, - mw_work); - -- __frwr_reset_and_unmap(r->mw_xprt, r); -- return; -+ __frwr_reset_and_unmap(r); - } - - /* A broken MR was discovered in a context that can't sleep. -@@ -167,8 +165,7 @@ __frwr_queue_recovery(struct rpcrdma_mw *r) - } - - static int --__frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, struct ib_device *device, -- unsigned int depth) -+__frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, unsigned int depth) - { - struct rpcrdma_frmr *f = &r->frmr; - int rc; -@@ -177,11 +174,11 @@ __frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, struct ib_device *device, - if (IS_ERR(f->fr_mr)) - goto out_mr_err; - -- f->fr_sg = kcalloc(depth, sizeof(*f->fr_sg), GFP_KERNEL); -- if (!f->fr_sg) -+ r->mw_sg = kcalloc(depth, sizeof(*r->mw_sg), GFP_KERNEL); -+ if (!r->mw_sg) - goto out_list_err; - -- sg_init_table(f->fr_sg, depth); -+ sg_init_table(r->mw_sg, depth); - - init_completion(&f->fr_linv_done); - -@@ -210,7 +207,7 @@ __frwr_release(struct rpcrdma_mw *r) - if (rc) - dprintk("RPC: %s: ib_dereg_mr status %i\n", - __func__, rc); -- kfree(r->frmr.fr_sg); -+ kfree(r->mw_sg); - } - - static int -@@ -350,7 +347,6 @@ static int - frwr_op_init(struct rpcrdma_xprt *r_xprt) - { - struct rpcrdma_buffer *buf = &r_xprt->rx_buf; -- struct ib_device *device = r_xprt->rx_ia.ri_device; - unsigned int depth = r_xprt->rx_ia.ri_max_frmr_depth; - struct ib_pd *pd = r_xprt->rx_ia.ri_pd; - int i; -@@ -372,7 +368,7 @@ frwr_op_init(struct rpcrdma_xprt *r_xprt) - if (!r) - return -ENOMEM; - -- rc = __frwr_init(r, pd, device, depth); -+ rc = __frwr_init(r, pd, depth); - if (rc) { - kfree(r); - return rc; -@@ -386,7 +382,7 @@ frwr_op_init(struct rpcrdma_xprt *r_xprt) - return 0; - } - --/* Post a FAST_REG Work Request to register a memory region -+/* Post a REG_MR Work Request to register a memory region - * for remote access via RDMA READ or RDMA WRITE. - */ - static int -@@ -394,8 +390,6 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg, - int nsegs, bool writing) - { - struct rpcrdma_ia *ia = &r_xprt->rx_ia; -- struct ib_device *device = ia->ri_device; -- enum dma_data_direction direction = rpcrdma_data_dir(writing); - struct rpcrdma_mr_seg *seg1 = seg; - struct rpcrdma_mw *mw; - struct rpcrdma_frmr *frmr; -@@ -421,15 +415,14 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg, - - if (nsegs > ia->ri_max_frmr_depth) - nsegs = ia->ri_max_frmr_depth; -- - for (i = 0; i < nsegs;) { - if (seg->mr_page) -- sg_set_page(&frmr->fr_sg[i], -+ sg_set_page(&mw->mw_sg[i], - seg->mr_page, - seg->mr_len, - offset_in_page(seg->mr_offset)); - else -- sg_set_buf(&frmr->fr_sg[i], seg->mr_offset, -+ sg_set_buf(&mw->mw_sg[i], seg->mr_offset, - seg->mr_len); - - ++seg; -@@ -440,26 +433,20 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg, - offset_in_page((seg-1)->mr_offset + (seg-1)->mr_len)) - break; - } -- frmr->fr_nents = i; -- frmr->fr_dir = direction; -- -- dma_nents = ib_dma_map_sg(device, frmr->fr_sg, frmr->fr_nents, direction); -- if (!dma_nents) { -- pr_err("RPC: %s: failed to dma map sg %p sg_nents %u\n", -- __func__, frmr->fr_sg, frmr->fr_nents); -- return -ENOMEM; -- } -+ mw->mw_nents = i; -+ mw->mw_dir = rpcrdma_data_dir(writing); - -- n = ib_map_mr_sg(mr, frmr->fr_sg, frmr->fr_nents, NULL, PAGE_SIZE); -- if (unlikely(n != frmr->fr_nents)) { -- pr_err("RPC: %s: failed to map mr %p (%u/%u)\n", -- __func__, frmr->fr_mr, n, frmr->fr_nents); -- rc = n < 0 ? n : -EINVAL; -- goto out_senderr; -- } -+ dma_nents = ib_dma_map_sg(ia->ri_device, -+ mw->mw_sg, mw->mw_nents, mw->mw_dir); -+ if (!dma_nents) -+ goto out_dmamap_err; -+ -+ n = ib_map_mr_sg(mr, mw->mw_sg, mw->mw_nents, NULL, PAGE_SIZE); -+ if (unlikely(n != mw->mw_nents)) -+ goto out_mapmr_err; - - dprintk("RPC: %s: Using frmr %p to map %u segments (%u bytes)\n", -- __func__, mw, frmr->fr_nents, mr->length); -+ __func__, mw, mw->mw_nents, mr->length); - - key = (u8)(mr->rkey & 0x000000FF); - ib_update_fast_reg_key(mr, ++key); -@@ -484,13 +471,25 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg, - seg1->rl_mw = mw; - seg1->mr_rkey = mr->rkey; - seg1->mr_base = mr->iova; -- seg1->mr_nsegs = frmr->fr_nents; -+ seg1->mr_nsegs = mw->mw_nents; - seg1->mr_len = mr->length; - -- return frmr->fr_nents; -+ return mw->mw_nents; -+ -+out_dmamap_err: -+ pr_err("rpcrdma: failed to dma map sg %p sg_nents %u\n", -+ mw->mw_sg, mw->mw_nents); -+ return -ENOMEM; -+ -+out_mapmr_err: -+ pr_err("rpcrdma: failed to map mr %p (%u/%u)\n", -+ frmr->fr_mr, n, mw->mw_nents); -+ rc = n < 0 ? n : -EIO; -+ __frwr_queue_recovery(mw); -+ return rc; - - out_senderr: -- dprintk("RPC: %s: ib_post_send status %i\n", __func__, rc); -+ pr_err("rpcrdma: ib_post_send status %i\n", rc); - __frwr_queue_recovery(mw); - return rc; - } -@@ -582,8 +581,8 @@ unmap: - mw = seg->rl_mw; - seg->rl_mw = NULL; - -- ib_dma_unmap_sg(ia->ri_device, f->fr_sg, f->fr_nents, -- f->fr_dir); -+ ib_dma_unmap_sg(ia->ri_device, -+ mw->mw_sg, mw->mw_nents, mw->mw_dir); - rpcrdma_put_mw(r_xprt, mw); - - i += seg->mr_nsegs; -@@ -630,7 +629,7 @@ frwr_op_unmap_safe(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req, - mw = seg->rl_mw; - - if (sync) -- __frwr_reset_and_unmap(r_xprt, mw); -+ __frwr_reset_and_unmap(mw); - else - __frwr_queue_recovery(mw); - -diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h -index 95cdc66..c53abd1 100644 ---- a/net/sunrpc/xprtrdma/xprt_rdma.h -+++ b/net/sunrpc/xprtrdma/xprt_rdma.h -@@ -221,9 +221,6 @@ enum rpcrdma_frmr_state { - }; - - struct rpcrdma_frmr { -- struct scatterlist *fr_sg; -- int fr_nents; -- enum dma_data_direction fr_dir; - struct ib_mr *fr_mr; - struct ib_cqe fr_cqe; - enum rpcrdma_frmr_state fr_state; -@@ -240,13 +237,16 @@ struct rpcrdma_fmr { - }; - - struct rpcrdma_mw { -+ struct list_head mw_list; -+ struct scatterlist *mw_sg; -+ int mw_nents; -+ enum dma_data_direction mw_dir; - union { - struct rpcrdma_fmr fmr; - struct rpcrdma_frmr frmr; - }; - struct work_struct mw_work; - struct rpcrdma_xprt *mw_xprt; -- struct list_head mw_list; - struct list_head mw_all; - }; - -diff --git a/net/sysctl_net.c b/net/sysctl_net.c -index ed98c1f..46a71c7 100644 ---- a/net/sysctl_net.c -+++ b/net/sysctl_net.c -@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ctl_table_header *head, - kgid_t root_gid = make_kgid(net->user_ns, 0); - - /* Allow network administrator to have same access as root. */ -- if (ns_capable(net->user_ns, CAP_NET_ADMIN) || -+ if (ns_capable_noaudit(net->user_ns, CAP_NET_ADMIN) || - uid_eq(root_uid, current_euid())) { - int mode = (table->mode >> 6) & 7; - return (mode << 6) | (mode << 3) | mode; -diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c -index 705c287..7347fcc 100644 ---- a/security/apparmor/policy.c -+++ b/security/apparmor/policy.c -@@ -766,7 +766,9 @@ struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name) - struct aa_profile *profile; - - rcu_read_lock(); -- profile = aa_get_profile(__find_child(&parent->base.profiles, name)); -+ do { -+ profile = __find_child(&parent->base.profiles, name); -+ } while (profile && !aa_get_profile_not0(profile)); - rcu_read_unlock(); - - /* refcount released by caller */ -diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c -index 795437b..b450a27 100644 ---- a/sound/core/rawmidi.c -+++ b/sound/core/rawmidi.c -@@ -1633,11 +1633,13 @@ static int snd_rawmidi_dev_register(struct snd_device *device) - return -EBUSY; - } - list_add_tail(&rmidi->list, &snd_rawmidi_devices); -+ mutex_unlock(®ister_mutex); - err = snd_register_device(SNDRV_DEVICE_TYPE_RAWMIDI, - rmidi->card, rmidi->device, - &snd_rawmidi_f_ops, rmidi, &rmidi->dev); - if (err < 0) { - rmidi_err(rmidi, "unable to register\n"); -+ mutex_lock(®ister_mutex); - list_del(&rmidi->list); - mutex_unlock(®ister_mutex); - return err; -@@ -1645,6 +1647,7 @@ static int snd_rawmidi_dev_register(struct snd_device *device) - if (rmidi->ops && rmidi->ops->dev_register && - (err = rmidi->ops->dev_register(rmidi)) < 0) { - snd_unregister_device(&rmidi->dev); -+ mutex_lock(®ister_mutex); - list_del(&rmidi->list); - mutex_unlock(®ister_mutex); - return err; -@@ -1677,7 +1680,6 @@ static int snd_rawmidi_dev_register(struct snd_device *device) - } - } - #endif /* CONFIG_SND_OSSEMUL */ -- mutex_unlock(®ister_mutex); - sprintf(name, "midi%d", rmidi->device); - entry = snd_info_create_card_entry(rmidi->card, name, rmidi->card->proc_root); - if (entry) { -diff --git a/sound/core/timer.c b/sound/core/timer.c -index 9a6157e..fc144f4 100644 ---- a/sound/core/timer.c -+++ b/sound/core/timer.c -@@ -35,6 +35,9 @@ - #include <sound/initval.h> - #include <linux/kmod.h> - -+/* internal flags */ -+#define SNDRV_TIMER_IFLG_PAUSED 0x00010000 -+ - #if IS_ENABLED(CONFIG_SND_HRTIMER) - #define DEFAULT_TIMER_LIMIT 4 - #else -@@ -294,8 +297,21 @@ int snd_timer_open(struct snd_timer_instance **ti, - get_device(&timer->card->card_dev); - timeri->slave_class = tid->dev_sclass; - timeri->slave_id = slave_id; -- if (list_empty(&timer->open_list_head) && timer->hw.open) -- timer->hw.open(timer); -+ -+ if (list_empty(&timer->open_list_head) && timer->hw.open) { -+ int err = timer->hw.open(timer); -+ if (err) { -+ kfree(timeri->owner); -+ kfree(timeri); -+ -+ if (timer->card) -+ put_device(&timer->card->card_dev); -+ module_put(timer->module); -+ mutex_unlock(®ister_mutex); -+ return err; -+ } -+ } -+ - list_add_tail(&timeri->open_list, &timer->open_list_head); - snd_timer_check_master(timeri); - mutex_unlock(®ister_mutex); -@@ -526,6 +542,10 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) - } - } - timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START); -+ if (stop) -+ timeri->flags &= ~SNDRV_TIMER_IFLG_PAUSED; -+ else -+ timeri->flags |= SNDRV_TIMER_IFLG_PAUSED; - snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : - SNDRV_TIMER_EVENT_CONTINUE); - unlock: -@@ -587,6 +607,10 @@ int snd_timer_stop(struct snd_timer_instance *timeri) - */ - int snd_timer_continue(struct snd_timer_instance *timeri) - { -+ /* timer can continue only after pause */ -+ if (!(timeri->flags & SNDRV_TIMER_IFLG_PAUSED)) -+ return -EINVAL; -+ - if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) - return snd_timer_start_slave(timeri, false); - else -@@ -813,6 +837,7 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid, - timer->tmr_subdevice = tid->subdevice; - if (id) - strlcpy(timer->id, id, sizeof(timer->id)); -+ timer->sticks = 1; - INIT_LIST_HEAD(&timer->device_list); - INIT_LIST_HEAD(&timer->open_list_head); - INIT_LIST_HEAD(&timer->active_list_head); -@@ -1817,6 +1842,9 @@ static int snd_timer_user_continue(struct file *file) - tu = file->private_data; - if (!tu->timeri) - return -EBADFD; -+ /* start timer instead of continue if it's not used before */ -+ if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED)) -+ return snd_timer_user_start(file); - tu->timeri->lost = 0; - return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0; - } -@@ -1958,6 +1986,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, - tu->qused--; - spin_unlock_irq(&tu->qlock); - -+ mutex_lock(&tu->ioctl_lock); - if (tu->tread) { - if (copy_to_user(buffer, &tu->tqueue[qhead], - sizeof(struct snd_timer_tread))) -@@ -1967,6 +1996,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, - sizeof(struct snd_timer_read))) - err = -EFAULT; - } -+ mutex_unlock(&tu->ioctl_lock); - - spin_lock_irq(&tu->qlock); - if (err < 0) -diff --git a/sound/firewire/fireworks/fireworks.h b/sound/firewire/fireworks/fireworks.h -index 03ed352..d73c12b 100644 ---- a/sound/firewire/fireworks/fireworks.h -+++ b/sound/firewire/fireworks/fireworks.h -@@ -108,7 +108,6 @@ struct snd_efw { - u8 *resp_buf; - u8 *pull_ptr; - u8 *push_ptr; -- unsigned int resp_queues; - }; - - int snd_efw_transaction_cmd(struct fw_unit *unit, -diff --git a/sound/firewire/fireworks/fireworks_hwdep.c b/sound/firewire/fireworks/fireworks_hwdep.c -index 33df865..2e1d9a2 100644 ---- a/sound/firewire/fireworks/fireworks_hwdep.c -+++ b/sound/firewire/fireworks/fireworks_hwdep.c -@@ -25,6 +25,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained, - { - unsigned int length, till_end, type; - struct snd_efw_transaction *t; -+ u8 *pull_ptr; - long count = 0; - - if (remained < sizeof(type) + sizeof(struct snd_efw_transaction)) -@@ -38,8 +39,17 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained, - buf += sizeof(type); - - /* write into buffer as many responses as possible */ -- while (efw->resp_queues > 0) { -- t = (struct snd_efw_transaction *)(efw->pull_ptr); -+ spin_lock_irq(&efw->lock); -+ -+ /* -+ * When another task reaches here during this task's access to user -+ * space, it picks up current position in buffer and can read the same -+ * series of responses. -+ */ -+ pull_ptr = efw->pull_ptr; -+ -+ while (efw->push_ptr != pull_ptr) { -+ t = (struct snd_efw_transaction *)(pull_ptr); - length = be32_to_cpu(t->length) * sizeof(__be32); - - /* confirm enough space for this response */ -@@ -49,26 +59,39 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained, - /* copy from ring buffer to user buffer */ - while (length > 0) { - till_end = snd_efw_resp_buf_size - -- (unsigned int)(efw->pull_ptr - efw->resp_buf); -+ (unsigned int)(pull_ptr - efw->resp_buf); - till_end = min_t(unsigned int, length, till_end); - -- if (copy_to_user(buf, efw->pull_ptr, till_end)) -+ spin_unlock_irq(&efw->lock); -+ -+ if (copy_to_user(buf, pull_ptr, till_end)) - return -EFAULT; - -- efw->pull_ptr += till_end; -- if (efw->pull_ptr >= efw->resp_buf + -- snd_efw_resp_buf_size) -- efw->pull_ptr -= snd_efw_resp_buf_size; -+ spin_lock_irq(&efw->lock); -+ -+ pull_ptr += till_end; -+ if (pull_ptr >= efw->resp_buf + snd_efw_resp_buf_size) -+ pull_ptr -= snd_efw_resp_buf_size; - - length -= till_end; - buf += till_end; - count += till_end; - remained -= till_end; - } -- -- efw->resp_queues--; - } - -+ /* -+ * All of tasks can read from the buffer nearly simultaneously, but the -+ * last position for each task is different depending on the length of -+ * given buffer. Here, for simplicity, a position of buffer is set by -+ * the latest task. It's better for a listening application to allow one -+ * thread to read from the buffer. Unless, each task can read different -+ * sequence of responses depending on variation of buffer length. -+ */ -+ efw->pull_ptr = pull_ptr; -+ -+ spin_unlock_irq(&efw->lock); -+ - return count; - } - -@@ -76,14 +99,17 @@ static long - hwdep_read_locked(struct snd_efw *efw, char __user *buf, long count, - loff_t *offset) - { -- union snd_firewire_event event; -+ union snd_firewire_event event = { -+ .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS, -+ }; - -- memset(&event, 0, sizeof(event)); -+ spin_lock_irq(&efw->lock); - -- event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS; - event.lock_status.status = (efw->dev_lock_count > 0); - efw->dev_lock_changed = false; - -+ spin_unlock_irq(&efw->lock); -+ - count = min_t(long, count, sizeof(event.lock_status)); - - if (copy_to_user(buf, &event, count)) -@@ -98,10 +124,15 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, - { - struct snd_efw *efw = hwdep->private_data; - DEFINE_WAIT(wait); -+ bool dev_lock_changed; -+ bool queued; - - spin_lock_irq(&efw->lock); - -- while ((!efw->dev_lock_changed) && (efw->resp_queues == 0)) { -+ dev_lock_changed = efw->dev_lock_changed; -+ queued = efw->push_ptr != efw->pull_ptr; -+ -+ while (!dev_lock_changed && !queued) { - prepare_to_wait(&efw->hwdep_wait, &wait, TASK_INTERRUPTIBLE); - spin_unlock_irq(&efw->lock); - schedule(); -@@ -109,15 +140,17 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, - if (signal_pending(current)) - return -ERESTARTSYS; - spin_lock_irq(&efw->lock); -+ dev_lock_changed = efw->dev_lock_changed; -+ queued = efw->push_ptr != efw->pull_ptr; - } - -- if (efw->dev_lock_changed) -+ spin_unlock_irq(&efw->lock); -+ -+ if (dev_lock_changed) - count = hwdep_read_locked(efw, buf, count, offset); -- else if (efw->resp_queues > 0) -+ else if (queued) - count = hwdep_read_resp_buf(efw, buf, count, offset); - -- spin_unlock_irq(&efw->lock); -- - return count; - } - -@@ -160,7 +193,7 @@ hwdep_poll(struct snd_hwdep *hwdep, struct file *file, poll_table *wait) - poll_wait(file, &efw->hwdep_wait, wait); - - spin_lock_irq(&efw->lock); -- if (efw->dev_lock_changed || (efw->resp_queues > 0)) -+ if (efw->dev_lock_changed || efw->pull_ptr != efw->push_ptr) - events = POLLIN | POLLRDNORM; - else - events = 0; -diff --git a/sound/firewire/fireworks/fireworks_proc.c b/sound/firewire/fireworks/fireworks_proc.c -index 0639dcb..beb0a0f 100644 ---- a/sound/firewire/fireworks/fireworks_proc.c -+++ b/sound/firewire/fireworks/fireworks_proc.c -@@ -188,8 +188,8 @@ proc_read_queues_state(struct snd_info_entry *entry, - else - consumed = (unsigned int)(efw->push_ptr - efw->pull_ptr); - -- snd_iprintf(buffer, "%d %d/%d\n", -- efw->resp_queues, consumed, snd_efw_resp_buf_size); -+ snd_iprintf(buffer, "%d/%d\n", -+ consumed, snd_efw_resp_buf_size); - } - - static void -diff --git a/sound/firewire/fireworks/fireworks_transaction.c b/sound/firewire/fireworks/fireworks_transaction.c -index f550808..36a08ba 100644 ---- a/sound/firewire/fireworks/fireworks_transaction.c -+++ b/sound/firewire/fireworks/fireworks_transaction.c -@@ -121,11 +121,11 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode) - size_t capacity, till_end; - struct snd_efw_transaction *t; - -- spin_lock_irq(&efw->lock); -- - t = (struct snd_efw_transaction *)data; - length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length); - -+ spin_lock_irq(&efw->lock); -+ - if (efw->push_ptr < efw->pull_ptr) - capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr); - else -@@ -155,7 +155,6 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode) - } - - /* for hwdep */ -- efw->resp_queues++; - wake_up(&efw->hwdep_wait); - - *rcode = RCODE_COMPLETE; -diff --git a/sound/firewire/tascam/tascam-hwdep.c b/sound/firewire/tascam/tascam-hwdep.c -index 131267c..106406c 100644 ---- a/sound/firewire/tascam/tascam-hwdep.c -+++ b/sound/firewire/tascam/tascam-hwdep.c -@@ -16,31 +16,14 @@ - - #include "tascam.h" - --static long hwdep_read_locked(struct snd_tscm *tscm, char __user *buf, -- long count) --{ -- union snd_firewire_event event; -- -- memset(&event, 0, sizeof(event)); -- -- event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS; -- event.lock_status.status = (tscm->dev_lock_count > 0); -- tscm->dev_lock_changed = false; -- -- count = min_t(long, count, sizeof(event.lock_status)); -- -- if (copy_to_user(buf, &event, count)) -- return -EFAULT; -- -- return count; --} -- - static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, - loff_t *offset) - { - struct snd_tscm *tscm = hwdep->private_data; - DEFINE_WAIT(wait); -- union snd_firewire_event event; -+ union snd_firewire_event event = { -+ .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS, -+ }; - - spin_lock_irq(&tscm->lock); - -@@ -54,10 +37,16 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, - spin_lock_irq(&tscm->lock); - } - -- memset(&event, 0, sizeof(event)); -- count = hwdep_read_locked(tscm, buf, count); -+ event.lock_status.status = (tscm->dev_lock_count > 0); -+ tscm->dev_lock_changed = false; -+ - spin_unlock_irq(&tscm->lock); - -+ count = min_t(long, count, sizeof(event.lock_status)); -+ -+ if (copy_to_user(buf, &event, count)) -+ return -EFAULT; -+ - return count; - } - -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index f25479b..eaee626 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -4840,6 +4840,7 @@ enum { - ALC221_FIXUP_HP_FRONT_MIC, - ALC292_FIXUP_TPT460, - ALC298_FIXUP_SPK_VOLUME, -+ ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER, - }; - - static const struct hda_fixup alc269_fixups[] = { -@@ -5501,6 +5502,15 @@ static const struct hda_fixup alc269_fixups[] = { - .chained = true, - .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, - }, -+ [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ { 0x1b, 0x90170151 }, -+ { } -+ }, -+ .chained = true, -+ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE -+ }, - }; - - static const struct snd_pci_quirk alc269_fixup_tbl[] = { -@@ -5545,6 +5555,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), - SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), - SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), -+ SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), - SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), - SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), - SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), -@@ -5879,6 +5890,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { - {0x12, 0x90a60170}, - {0x14, 0x90170120}, - {0x21, 0x02211030}), -+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell Inspiron 5468", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, -+ {0x12, 0x90a60180}, -+ {0x14, 0x90170120}, -+ {0x21, 0x02211030}), - SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, - ALC256_STANDARD_PINS), - SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4, -diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c -index 1267e1a..633d54ca 100644 ---- a/sound/soc/atmel/atmel_ssc_dai.c -+++ b/sound/soc/atmel/atmel_ssc_dai.c -@@ -299,8 +299,9 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream, - clk_enable(ssc_p->ssc->clk); - ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk); - -- /* Reset the SSC to keep it at a clean status */ -- ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST)); -+ /* Reset the SSC unless initialized to keep it in a clean state */ -+ if (!ssc_p->initialized) -+ ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST)); - - if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { - dir = 0; -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 6cf1f35..152292e 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1141,6 +1141,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) - case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */ - case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */ - case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ -+ case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */ - case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */ - case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */ - case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */ diff --git a/4.7.4/0000_README b/4.7.5/0000_README index a9515bb..9104194 100644 --- a/4.7.4/0000_README +++ b/4.7.5/0000_README @@ -2,23 +2,7 @@ README ----------------------------------------------------------------------------- Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 1000_linux-4.7.1.patch -From: http://www.kernel.org -Desc: Linux 4.7.1 - -Patch: 1001_linux-4.7.2.patch -From: http://www.kernel.org -Desc: Linux 4.7.2 - -Patch: 1002_linux-4.7.3.patch -From: http://www.kernel.org -Desc: Linux 4.7.3 - -Patch: 1003_linux-4.7.4.patch -From: http://www.kernel.org -Desc: Linux 4.7.4 - -Patch: 4420_grsecurity-3.1-4.7.4-201609211951.patch +Patch: 4420_grsecurity-3.1-4.7.5-201609261522.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/4.7.4/4420_grsecurity-3.1-4.7.4-201609211951.patch b/4.7.5/4420_grsecurity-3.1-4.7.5-201609261522.patch index 5bddf8c..9169f89 100644 --- a/4.7.4/4420_grsecurity-3.1-4.7.4-201609211951.patch +++ b/4.7.5/4420_grsecurity-3.1-4.7.5-201609261522.patch @@ -420,7 +420,7 @@ index a3683ce..5ec8bf4 100644 A toggle value indicating if modules are allowed to be loaded diff --git a/Makefile b/Makefile -index ec3bd11..35d4d88 100644 +index dd755d19..b480d63 100644 --- a/Makefile +++ b/Makefile @@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -3219,7 +3219,7 @@ index e2c6da0..6155a88 100644 . = ALIGN(1<<SECTION_SHIFT); #else diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c -index f1bde7c..6dc92ba 100644 +index 4e1b22a..10ef049 100644 --- a/arch/arm/kvm/arm.c +++ b/arch/arm/kvm/arm.c @@ -58,7 +58,7 @@ static unsigned long hyp_default_vectors; @@ -3231,7 +3231,7 @@ index f1bde7c..6dc92ba 100644 static u32 kvm_next_vmid; static unsigned int kvm_vmid_bits __read_mostly; static DEFINE_SPINLOCK(kvm_vmid_lock); -@@ -389,7 +389,7 @@ void force_vm_exit(const cpumask_t *mask) +@@ -387,7 +387,7 @@ void force_vm_exit(const cpumask_t *mask) */ static bool need_new_vmid_gen(struct kvm *kvm) { @@ -3240,7 +3240,7 @@ index f1bde7c..6dc92ba 100644 } /** -@@ -422,7 +422,7 @@ static void update_vttbr(struct kvm *kvm) +@@ -420,7 +420,7 @@ static void update_vttbr(struct kvm *kvm) /* First user of a new VMID generation? */ if (unlikely(kvm_next_vmid == 0)) { @@ -3249,7 +3249,7 @@ index f1bde7c..6dc92ba 100644 kvm_next_vmid = 1; /* -@@ -439,7 +439,7 @@ static void update_vttbr(struct kvm *kvm) +@@ -437,7 +437,7 @@ static void update_vttbr(struct kvm *kvm) kvm_call_hyp(__kvm_flush_vm_context); } @@ -5435,7 +5435,7 @@ index 45698cd..e8e2dbc 100644 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock) diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h -index 2189d5d..420134b 100644 +index ebcd8a1..dfa2f7a 100644 --- a/arch/ia64/include/asm/uaccess.h +++ b/arch/ia64/include/asm/uaccess.h @@ -70,6 +70,7 @@ @@ -5471,7 +5471,7 @@ index 2189d5d..420134b 100644 return __copy_user((__force void __user *) to, from, count); } -@@ -256,10 +269,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count) +@@ -256,19 +269,22 @@ __copy_from_user (void *to, const void __user *from, unsigned long count) ({ \ void __user *__cu_to = (to); \ const void *__cu_from = (from); \ @@ -5480,30 +5480,42 @@ index 2189d5d..420134b 100644 \ - if (__access_ok(__cu_to, __cu_len, get_fs())) \ + if (__cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) { \ -+ if (!__builtin_constant_p(n)) \ -+ check_object_size(__cu_from, __cu_len, true); \ ++ check_object_size(__cu_from, __cu_len, true); \ __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \ + } \ __cu_len; \ }) -@@ -267,11 +283,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count) - ({ \ - void *__cu_to = (to); \ - const void __user *__cu_from = (from); \ -- long __cu_len = (n); \ -+ unsigned long __cu_len = (n); \ - \ - __chk_user_ptr(__cu_from); \ -- if (__access_ok(__cu_from, __cu_len, get_fs())) \ -+ if (__cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) { \ -+ if (!__builtin_constant_p(n)) \ -+ check_object_size(__cu_to, __cu_len, false); \ - __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \ -+ } \ - __cu_len; \ + static inline unsigned long + copy_from_user(void *to, const void __user *from, unsigned long n) + { +- if (likely(__access_ok(from, n, get_fs()))) +- n = __copy_user((__force void __user *) to, from, n); +- else ++ if (likely(__access_ok(from, n, get_fs()))) { ++ check_object_size(to, n, false); ++ n = __copy_user((void __force_user *) to, from, n); ++ } else if ((long)n > 0) + memset(to, 0, n); + return n; + } +@@ -339,11 +355,13 @@ extern unsigned long __strnlen_user (const char __user *, long); + __su_ret; \ }) +-#define ARCH_HAS_RELATIVE_EXTABLE ++/* Generic code can't deal with the location-relative format that we use for compactness. */ ++#define ARCH_HAS_SORT_EXTABLE ++#define ARCH_HAS_SEARCH_EXTABLE + + struct exception_table_entry { +- int insn; /* location-relative address of insn this fixup is for */ +- int fixup; /* location-relative continuation addr.; if bit 2 is set, r9 is set to 0 */ ++ int addr; /* location-relative address of insn this fixup is for */ ++ int cont; /* location-relative continuation addr.; if bit 2 is set, r9 is set to 0 */ + }; + + extern void ia64_handle_exception (struct pt_regs *regs, const struct exception_table_entry *e); diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c index 6ab0ae7..88f1b60 100644 --- a/arch/ia64/kernel/module.c @@ -6711,10 +6723,10 @@ index e309d8f..20eefec 100644 /* * We stash processor id into a COP0 register to retrieve it fast diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h -index 7f109d4..40b1195 100644 +index b6e20f3..afabc54 100644 --- a/arch/mips/include/asm/uaccess.h +++ b/arch/mips/include/asm/uaccess.h -@@ -146,6 +146,7 @@ static inline bool eva_kernel_access(void) +@@ -147,6 +147,7 @@ static inline bool eva_kernel_access(void) __ok == 0; \ }) @@ -7469,22 +7481,217 @@ index 291cee2..2ac33db 100644 #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC) #define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX) diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h -index 0f59fd9..c502784 100644 +index 37a1bee..a3916f9 100644 --- a/arch/parisc/include/asm/uaccess.h +++ b/arch/parisc/include/asm/uaccess.h -@@ -220,10 +220,10 @@ static inline unsigned long __must_check copy_from_user(void *to, +@@ -41,29 +41,34 @@ static inline long access_ok(int type, const void __user * addr, + #define get_user __get_user + + #if !defined(CONFIG_64BIT) +-#define LDD_USER(ptr) __get_user_asm64(ptr) ++#define LDD_KERNEL(ptr) BUILD_BUG() ++#define LDD_USER(ptr) BUILD_BUG() ++#define STD_KERNEL(x, ptr) __put_kernel_asm64(x, ptr) + #define STD_USER(x, ptr) __put_user_asm64(x, ptr) ++#define ASM_WORD_INSN ".word\t" + #else ++#define LDD_KERNEL(ptr) __get_kernel_asm("ldd", ptr) + #define LDD_USER(ptr) __get_user_asm("ldd", ptr) ++#define STD_KERNEL(x, ptr) __put_kernel_asm("std", x, ptr) + #define STD_USER(x, ptr) __put_user_asm("std", x, ptr) ++#define ASM_WORD_INSN ".dword\t" + #endif + + /* +- * The exception table contains two values: the first is the relative offset to +- * the address of the instruction that is allowed to fault, and the second is +- * the relative offset to the address of the fixup routine. Since relative +- * addresses are used, 32bit values are sufficient even on 64bit kernel. ++ * The exception table contains two values: the first is an address ++ * for an instruction that is allowed to fault, and the second is ++ * the address to the fixup routine. Even on a 64bit kernel we could ++ * use a 32bit (unsigned int) address here. + */ + +-#define ARCH_HAS_RELATIVE_EXTABLE + struct exception_table_entry { +- int insn; /* relative address of insn that is allowed to fault. */ +- int fixup; /* relative address of fixup routine */ ++ unsigned long insn; /* address of insn that is allowed to fault. */ ++ unsigned long fixup; /* fixup routine */ + }; + + #define ASM_EXCEPTIONTABLE_ENTRY( fault_addr, except_addr )\ + ".section __ex_table,\"aw\"\n" \ +- ".word (" #fault_addr " - .), (" #except_addr " - .)\n\t" \ ++ ASM_WORD_INSN #fault_addr ", " #except_addr "\n\t" \ + ".previous\n" + + /* +@@ -77,70 +82,70 @@ struct exception_data { + unsigned long fault_addr; + }; + +-/* +- * load_sr2() preloads the space register %%sr2 - based on the value of +- * get_fs() - with either a value of 0 to access kernel space (KERNEL_DS which +- * is 0), or with the current value of %%sr3 to access user space (USER_DS) +- * memory. The following __get_user_asm() and __put_user_asm() functions have +- * %%sr2 hard-coded to access the requested memory. +- */ +-#define load_sr2() \ +- __asm__(" or,= %0,%%r0,%%r0\n\t" \ +- " mfsp %%sr3,%0\n\t" \ +- " mtsp %0,%%sr2\n\t" \ +- : : "r"(get_fs()) : ) +- + #define __get_user(x, ptr) \ + ({ \ + register long __gu_err __asm__ ("r8") = 0; \ + register long __gu_val __asm__ ("r9") = 0; \ + \ +- load_sr2(); \ +- switch (sizeof(*(ptr))) { \ ++ if (segment_eq(get_fs(), KERNEL_DS)) { \ ++ switch (sizeof(*(ptr))) { \ ++ case 1: __get_kernel_asm("ldb", ptr); break; \ ++ case 2: __get_kernel_asm("ldh", ptr); break; \ ++ case 4: __get_kernel_asm("ldw", ptr); break; \ ++ case 8: LDD_KERNEL(ptr); break; \ ++ default: BUILD_BUG(); break; \ ++ } \ ++ } \ ++ else { \ ++ switch (sizeof(*(ptr))) { \ + case 1: __get_user_asm("ldb", ptr); break; \ + case 2: __get_user_asm("ldh", ptr); break; \ + case 4: __get_user_asm("ldw", ptr); break; \ + case 8: LDD_USER(ptr); break; \ + default: BUILD_BUG(); break; \ ++ } \ + } \ + \ + (x) = (__force __typeof__(*(ptr))) __gu_val; \ + __gu_err; \ + }) + ++#define __get_kernel_asm(ldx, ptr) \ ++ __asm__("\n1:\t" ldx "\t0(%2),%0\n\t" \ ++ ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_1)\ ++ : "=r"(__gu_val), "=r"(__gu_err) \ ++ : "r"(ptr), "1"(__gu_err) \ ++ : "r1"); ++ + #define __get_user_asm(ldx, ptr) \ +- __asm__("\n1:\t" ldx "\t0(%%sr2,%2),%0\n\t" \ ++ __asm__("\n1:\t" ldx "\t0(%%sr3,%2),%0\n\t" \ + ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_1)\ + : "=r"(__gu_val), "=r"(__gu_err) \ + : "r"(ptr), "1"(__gu_err) \ + : "r1"); + +-#if !defined(CONFIG_64BIT) +- +-#define __get_user_asm64(ptr) \ +- __asm__("\n1:\tldw 0(%%sr2,%2),%0" \ +- "\n2:\tldw 4(%%sr2,%2),%R0\n\t" \ +- ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_2)\ +- ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_get_user_skip_1)\ +- : "=r"(__gu_val), "=r"(__gu_err) \ +- : "r"(ptr), "1"(__gu_err) \ +- : "r1"); +- +-#endif /* !defined(CONFIG_64BIT) */ +- +- + #define __put_user(x, ptr) \ + ({ \ + register long __pu_err __asm__ ("r8") = 0; \ + __typeof__(*(ptr)) __x = (__typeof__(*(ptr)))(x); \ + \ +- load_sr2(); \ +- switch (sizeof(*(ptr))) { \ ++ if (segment_eq(get_fs(), KERNEL_DS)) { \ ++ switch (sizeof(*(ptr))) { \ ++ case 1: __put_kernel_asm("stb", __x, ptr); break; \ ++ case 2: __put_kernel_asm("sth", __x, ptr); break; \ ++ case 4: __put_kernel_asm("stw", __x, ptr); break; \ ++ case 8: STD_KERNEL(__x, ptr); break; \ ++ default: BUILD_BUG(); break; \ ++ } \ ++ } \ ++ else { \ ++ switch (sizeof(*(ptr))) { \ + case 1: __put_user_asm("stb", __x, ptr); break; \ + case 2: __put_user_asm("sth", __x, ptr); break; \ + case 4: __put_user_asm("stw", __x, ptr); break; \ + case 8: STD_USER(__x, ptr); break; \ + default: BUILD_BUG(); break; \ ++ } \ + } \ + \ + __pu_err; \ +@@ -156,9 +161,17 @@ struct exception_data { + * r8/r9 are already listed as err/val. + */ + ++#define __put_kernel_asm(stx, x, ptr) \ ++ __asm__ __volatile__ ( \ ++ "\n1:\t" stx "\t%2,0(%1)\n\t" \ ++ ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_1)\ ++ : "=r"(__pu_err) \ ++ : "r"(ptr), "r"(x), "0"(__pu_err) \ ++ : "r1") ++ + #define __put_user_asm(stx, x, ptr) \ + __asm__ __volatile__ ( \ +- "\n1:\t" stx "\t%2,0(%%sr2,%1)\n\t" \ ++ "\n1:\t" stx "\t%2,0(%%sr3,%1)\n\t" \ + ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_1)\ + : "=r"(__pu_err) \ + : "r"(ptr), "r"(x), "0"(__pu_err) \ +@@ -167,10 +180,21 @@ struct exception_data { + + #if !defined(CONFIG_64BIT) + ++#define __put_kernel_asm64(__val, ptr) do { \ ++ __asm__ __volatile__ ( \ ++ "\n1:\tstw %2,0(%1)" \ ++ "\n2:\tstw %R2,4(%1)\n\t" \ ++ ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_2)\ ++ ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_put_user_skip_1)\ ++ : "=r"(__pu_err) \ ++ : "r"(ptr), "r"(__val), "0"(__pu_err) \ ++ : "r1"); \ ++} while (0) ++ + #define __put_user_asm64(__val, ptr) do { \ + __asm__ __volatile__ ( \ +- "\n1:\tstw %2,0(%%sr2,%1)" \ +- "\n2:\tstw %R2,4(%%sr2,%1)\n\t" \ ++ "\n1:\tstw %2,0(%%sr3,%1)" \ ++ "\n2:\tstw %R2,4(%%sr3,%1)\n\t" \ + ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_2)\ + ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_put_user_skip_1)\ + : "=r"(__pu_err) \ +@@ -221,14 +245,14 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n) { - int sz = __compiletime_object_size(to); + size_t sz = __compiletime_object_size(to); - int ret = -EFAULT; + unsigned long ret = n; - if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n)) + if (likely(sz == (size_t)-1 || !__builtin_constant_p(n) || sz >= n)) ret = __copy_from_user(to, from, n); else copy_from_user_overflow(); +- if (unlikely(ret)) ++ if (unlikely(ret && (long)ret > 0)) + memset(to + (n - ret), 0, ret); + return ret; + } diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c index a0ecdb4a..71d2069 100644 --- a/arch/parisc/kernel/module.c @@ -8884,7 +9091,7 @@ index 8febc3f..a4614f3 100644 #define _TIF_USER_WORK_MASK (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \ _TIF_NOTIFY_RESUME | _TIF_UPROBE | \ diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h -index b7c20f0..4adc0f1 100644 +index 43888c8..e231600 100644 --- a/arch/powerpc/include/asm/uaccess.h +++ b/arch/powerpc/include/asm/uaccess.h @@ -58,6 +58,7 @@ @@ -8895,7 +9102,29 @@ index b7c20f0..4adc0f1 100644 #define access_ok(type, addr, size) \ (__chk_user_ptr(addr), \ __access_ok((__force unsigned long)(addr), (size), get_fs())) -@@ -303,52 +304,6 @@ do { \ +@@ -274,6 +275,21 @@ do { \ + __gu_err; \ + }) + ++#ifndef __powerpc64__ ++#define __get_user64_nocheck(x, ptr, size) \ ++({ \ ++ long __gu_err; \ ++ long long __gu_val; \ ++ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \ ++ __chk_user_ptr(ptr); \ ++ if (!is_kernel_addr((unsigned long)__gu_addr)) \ ++ might_fault(); \ ++ __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \ ++ (x) = (__force __typeof__(*(ptr)))__gu_val; \ ++ __gu_err; \ ++}) ++#endif /* __powerpc64__ */ ++ + #define __get_user_check(x, ptr, size) \ + ({ \ + long __gu_err = -EFAULT; \ +@@ -303,39 +319,6 @@ do { \ extern unsigned long __copy_tofrom_user(void __user *to, const void __user *from, unsigned long size); @@ -8904,30 +9133,17 @@ index b7c20f0..4adc0f1 100644 -static inline unsigned long copy_from_user(void *to, - const void __user *from, unsigned long n) -{ -- unsigned long over; -- -- if (access_ok(VERIFY_READ, from, n)) +- if (likely(access_ok(VERIFY_READ, from, n))) - return __copy_tofrom_user((__force void __user *)to, from, n); -- if ((unsigned long)from < TASK_SIZE) { -- over = (unsigned long)from + n - TASK_SIZE; -- return __copy_tofrom_user((__force void __user *)to, from, -- n - over) + over; -- } +- memset(to, 0, n); - return n; -} - -static inline unsigned long copy_to_user(void __user *to, - const void *from, unsigned long n) -{ -- unsigned long over; -- - if (access_ok(VERIFY_WRITE, to, n)) - return __copy_tofrom_user(to, (__force void __user *)from, n); -- if ((unsigned long)to < TASK_SIZE) { -- over = (unsigned long)to + n - TASK_SIZE; -- return __copy_tofrom_user(to, (__force void __user *)from, -- n - over) + over; -- } - return n; -} - @@ -8948,29 +9164,27 @@ index b7c20f0..4adc0f1 100644 static inline unsigned long __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n) { -@@ -372,6 +327,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to, +@@ -359,6 +342,9 @@ static inline unsigned long __copy_from_user_inatomic(void *to, if (ret == 0) return 0; } + -+ if (!__builtin_constant_p(n)) -+ check_object_size(to, n, false); ++ check_object_size(to, n, false); + return __copy_tofrom_user((__force void __user *)to, from, n); } -@@ -398,6 +357,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to, +@@ -385,6 +371,9 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to, if (ret == 0) return 0; } + -+ if (!__builtin_constant_p(n)) -+ check_object_size(from, n, true); ++ check_object_size(from, n, true); + return __copy_tofrom_user(to, (__force const void __user *)from, n); } -@@ -415,6 +378,92 @@ static inline unsigned long __copy_to_user(void __user *to, +@@ -402,6 +391,70 @@ static inline unsigned long __copy_to_user(void __user *to, return __copy_to_user_inatomic(to, from, size); } @@ -8979,45 +9193,26 @@ index b7c20f0..4adc0f1 100644 +static inline unsigned long __must_check copy_from_user(void *to, + const void __user *from, unsigned long n) +{ -+ unsigned long over; -+ + if ((long)n < 0) + return n; + -+ if (access_ok(VERIFY_READ, from, n)) { -+ if (!__builtin_constant_p(n)) -+ check_object_size(to, n, false); -+ return __copy_tofrom_user((__force void __user *)to, from, n); -+ } -+ if ((unsigned long)from < TASK_SIZE) { -+ over = (unsigned long)from + n - TASK_SIZE; -+ if (!__builtin_constant_p(n - over)) -+ check_object_size(to, n - over, false); -+ return __copy_tofrom_user((__force void __user *)to, from, -+ n - over) + over; ++ if (likely(access_ok(VERIFY_READ, from, n))) { ++ check_object_size(to, n, false); ++ return __copy_tofrom_user((void __force_user *)to, from, n); + } ++ memset(to, 0, n); + return n; +} + +static inline unsigned long __must_check copy_to_user(void __user *to, + const void *from, unsigned long n) +{ -+ unsigned long over; -+ + if ((long)n < 0) + return n; + -+ if (access_ok(VERIFY_WRITE, to, n)) { -+ if (!__builtin_constant_p(n)) -+ check_object_size(from, n, true); -+ return __copy_tofrom_user(to, (__force void __user *)from, n); -+ } -+ if ((unsigned long)to < TASK_SIZE) { -+ over = (unsigned long)to + n - TASK_SIZE; -+ if (!__builtin_constant_p(n)) -+ check_object_size(from, n - over, true); -+ return __copy_tofrom_user(to, (__force void __user *)from, -+ n - over) + over; ++ if (likely(access_ok(VERIFY_WRITE, to, n))) { ++ check_object_size(from, n, true); ++ return __copy_tofrom_user(to, (void __force_user *)from, n); + } + return n; +} @@ -9032,12 +9227,10 @@ index b7c20f0..4adc0f1 100644 + if ((long)n < 0 || n > INT_MAX) + return n; + -+ if (!__builtin_constant_p(n)) ++ if (likely(access_ok(VERIFY_READ, from, n))) { + check_object_size(to, n, false); -+ -+ if (likely(access_ok(VERIFY_READ, from, n))) + n = __copy_from_user(to, from, n); -+ else ++ } else + memset(to, 0, n); + return n; +} @@ -9048,8 +9241,7 @@ index b7c20f0..4adc0f1 100644 + return n; + + if (likely(access_ok(VERIFY_WRITE, to, n))) { -+ if (!__builtin_constant_p(n)) -+ check_object_size(from, n, true); ++ check_object_size(from, n, true); + n = __copy_to_user(to, from, n); + } + return n; @@ -9712,7 +9904,7 @@ index c4a93d6..4d2a9b4 100644 #endif /* __ASM_EXEC_H */ diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h -index e0900dd..72d683d 100644 +index 666fd8b..778a9b9 100644 --- a/arch/s390/include/asm/uaccess.h +++ b/arch/s390/include/asm/uaccess.h @@ -59,6 +59,7 @@ static inline int __range_ok(unsigned long addr, unsigned long size) @@ -10591,7 +10783,7 @@ index bd56c28..4b63d83 100644 #include <asm/uaccess_64.h> #else diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h -index 57aca27..a87e6eb 100644 +index 3e8de69..d3d89a0 100644 --- a/arch/sparc/include/asm/uaccess_32.h +++ b/arch/sparc/include/asm/uaccess_32.h @@ -47,6 +47,7 @@ @@ -10602,7 +10794,92 @@ index 57aca27..a87e6eb 100644 #define access_ok(type, addr, size) \ ({ (void)(type); __access_ok((unsigned long)(addr), size); }) -@@ -248,27 +249,46 @@ unsigned long __copy_user(void __user *to, const void __user *from, unsigned lon +@@ -205,6 +206,31 @@ int __put_user_bad(void); + __gu_ret; \ + }) + ++#define __get_user_check_ret(x, addr, size, type, retval) ({ \ ++ register unsigned long __gu_val __asm__ ("l1"); \ ++ if (__access_ok(addr, size)) { \ ++ switch (size) { \ ++ case 1: \ ++ __get_user_asm_ret(__gu_val, ub, addr, retval); \ ++ break; \ ++ case 2: \ ++ __get_user_asm_ret(__gu_val, uh, addr, retval); \ ++ break; \ ++ case 4: \ ++ __get_user_asm_ret(__gu_val, , addr, retval); \ ++ break; \ ++ case 8: \ ++ __get_user_asm_ret(__gu_val, d, addr, retval); \ ++ break; \ ++ default: \ ++ if (__get_user_bad()) \ ++ return retval; \ ++ } \ ++ x = (__force type) __gu_val; \ ++ } else \ ++ return retval; \ ++}) ++ + #define __get_user_nocheck(x, addr, size, type) ({ \ + register int __gu_ret; \ + register unsigned long __gu_val; \ +@@ -222,6 +248,20 @@ int __put_user_bad(void); + __gu_ret; \ + }) + ++#define __get_user_nocheck_ret(x, addr, size, type, retval) ({ \ ++ register unsigned long __gu_val __asm__ ("l1"); \ ++ switch (size) { \ ++ case 1: __get_user_asm_ret(__gu_val, ub, addr, retval); break; \ ++ case 2: __get_user_asm_ret(__gu_val, uh, addr, retval); break; \ ++ case 4: __get_user_asm_ret(__gu_val, , addr, retval); break; \ ++ case 8: __get_user_asm_ret(__gu_val, d, addr, retval); break; \ ++ default: \ ++ if (__get_user_bad()) \ ++ return retval; \ ++ } \ ++ x = (__force type) __gu_val; \ ++}) ++ + #define __get_user_asm(x, size, addr, ret) \ + __asm__ __volatile__( \ + "/* Get user asm, inline. */\n" \ +@@ -242,28 +282,70 @@ __asm__ __volatile__( \ + : "=&r" (ret), "=&r" (x) : "m" (*__m(addr)), \ + "i" (-EFAULT)) + ++#define __get_user_asm_ret(x, size, addr, retval) \ ++if (__builtin_constant_p(retval) && retval == -EFAULT) \ ++ __asm__ __volatile__( \ ++ "/* Get user asm ret, inline. */\n" \ ++ "1:\t" "ld"#size " %1, %0\n\n\t" \ ++ ".section __ex_table,#alloc\n\t" \ ++ ".align 4\n\t" \ ++ ".word 1b,__ret_efault\n\n\t" \ ++ ".previous\n\t" \ ++ : "=&r" (x) : "m" (*__m(addr))); \ ++else \ ++ __asm__ __volatile__( \ ++ "/* Get user asm ret, inline. */\n" \ ++ "1:\t" "ld"#size " %1, %0\n\n\t" \ ++ ".section .fixup,#alloc,#execinstr\n\t" \ ++ ".align 4\n" \ ++ "3:\n\t" \ ++ "ret\n\t" \ ++ " restore %%g0, %2, %%o0\n\n\t" \ ++ ".previous\n\t" \ ++ ".section __ex_table,#alloc\n\t" \ ++ ".align 4\n\t" \ ++ ".word 1b, 3b\n\n\t" \ ++ ".previous\n\t" \ ++ : "=&r" (x) : "m" (*__m(addr)), "i" (retval)) ++ + int __get_user_bad(void); + + unsigned long __copy_user(void __user *to, const void __user *from, unsigned long size); static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n) { @@ -10640,10 +10917,12 @@ index 57aca27..a87e6eb 100644 + if (!__builtin_constant_p(n)) + check_object_size(to, n, false); return __copy_user((__force void __user *) to, from, n); -- else -+ } else +- else { ++ } else { + memset(to, 0, n); return n; - } + } +@@ -271,6 +353,9 @@ static inline unsigned long copy_from_user(void *to, const void __user *from, un static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n) { @@ -18725,10 +19004,10 @@ index 9b4f9d3..ce64392 100644 intel_ds_init(); diff --git a/arch/x86/events/intel/cqm.c b/arch/x86/events/intel/cqm.c -index 7b5fd81..3ca58b5 100644 +index 4ff41ae..9303030 100644 --- a/arch/x86/events/intel/cqm.c +++ b/arch/x86/events/intel/cqm.c -@@ -1479,7 +1479,7 @@ static struct attribute *intel_cmt_mbm_events_attr[] = { +@@ -1488,7 +1488,7 @@ static struct attribute *intel_cmt_mbm_events_attr[] = { NULL, }; @@ -18737,7 +19016,7 @@ index 7b5fd81..3ca58b5 100644 .name = "events", .attrs = NULL, }; -@@ -1737,7 +1737,9 @@ static int __init intel_cqm_init(void) +@@ -1746,7 +1746,9 @@ static int __init intel_cqm_init(void) goto out; } @@ -18748,7 +19027,7 @@ index 7b5fd81..3ca58b5 100644 ret = intel_cqm_setup_rmid_cache(); if (ret) -@@ -1753,12 +1755,14 @@ static int __init intel_cqm_init(void) +@@ -1762,12 +1764,14 @@ static int __init intel_cqm_init(void) if (ret && !cqm_enabled) goto out; @@ -18789,7 +19068,7 @@ index 9ba4e41..f931fb9 100644 static ssize_t cstate_get_attr_cpumask(struct device *dev, diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c -index 7ce9f3f..dc9146c 100644 +index 9b983a4..b31c136 100644 --- a/arch/x86/events/intel/ds.c +++ b/arch/x86/events/intel/ds.c @@ -601,7 +601,7 @@ unlock: @@ -18850,7 +19129,7 @@ index 9e2b40c..a9013c2 100644 if (!insn.opcode.got) return X86_BR_ABORT; diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c -index 04bb5fb..69cbd32 100644 +index 861a7d9..2ff89b2 100644 --- a/arch/x86/events/intel/pt.c +++ b/arch/x86/events/intel/pt.c @@ -172,11 +172,9 @@ static const struct attribute_group *pt_attr_groups[] = { @@ -24045,7 +24324,7 @@ index c3496619..3f3a7dc 100644 asmlinkage void smp_deferred_error_interrupt(void); #endif diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h -index 2982387..35d07f4 100644 +index 0328c2cc..35d07f4 100644 --- a/arch/x86/include/asm/uaccess.h +++ b/arch/x86/include/asm/uaccess.h @@ -8,6 +8,7 @@ @@ -24248,23 +24527,20 @@ index 2982387..35d07f4 100644 break; \ case 4: \ __get_user_asm_ex(x, ptr, "l", "k", "=r"); \ -@@ -412,9 +464,13 @@ do { \ +@@ -412,10 +464,10 @@ do { \ } while (0) #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \ - asm volatile("1: mov"itype" %1,%"rtype"0\n" \ + asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\ "2:\n" \ -- _ASM_EXTABLE_EX(1b, 2b) \ -+ ".section .fixup,\"ax\"\n" \ + ".section .fixup,\"ax\"\n" \ +- "3:xor"itype" %"rtype"0,%"rtype"0\n" \ + "3:xorl %k0,%k0\n" \ -+ " jmp 2b\n" \ -+ ".previous\n" \ -+ _ASM_EXTABLE_EX(1b, 3b) \ - : ltype(x) : "m" (__m(addr))) - - #define __put_user_nocheck(x, ptr, size) \ -@@ -433,13 +489,24 @@ do { \ + " jmp 2b\n" \ + ".previous\n" \ + _ASM_EXTABLE_EX(1b, 3b) \ +@@ -437,13 +489,24 @@ do { \ __uaccess_begin(); \ __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \ __uaccess_end(); \ @@ -24291,7 +24567,7 @@ index 2982387..35d07f4 100644 /* * Tell gcc we read from memory instead of writing: this is because -@@ -447,8 +514,10 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -451,8 +514,10 @@ struct __large_struct { unsigned long buf[100]; }; * aliasing issues. */ #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \ @@ -24303,7 +24579,7 @@ index 2982387..35d07f4 100644 "2:\n" \ ".section .fixup,\"ax\"\n" \ "3: mov %3,%0\n" \ -@@ -456,10 +525,12 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -460,10 +525,12 @@ struct __large_struct { unsigned long buf[100]; }; ".previous\n" \ _ASM_EXTABLE(1b, 3b) \ : "=r"(err) \ @@ -24318,7 +24594,7 @@ index 2982387..35d07f4 100644 "2:\n" \ _ASM_EXTABLE_EX(1b, 2b) \ : : ltype(x), "m" (__m(addr))) -@@ -469,11 +540,13 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -473,11 +540,13 @@ struct __large_struct { unsigned long buf[100]; }; */ #define uaccess_try do { \ current_thread_info()->uaccess_err = 0; \ @@ -24332,7 +24608,7 @@ index 2982387..35d07f4 100644 (err) |= (current_thread_info()->uaccess_err ? -EFAULT : 0); \ } while (0) -@@ -499,8 +572,12 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -503,8 +572,12 @@ struct __large_struct { unsigned long buf[100]; }; * On error, the variable @x is set to zero. */ @@ -24345,7 +24621,7 @@ index 2982387..35d07f4 100644 /** * __put_user: - Write a simple value into user space, with less checking. -@@ -523,8 +600,12 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -527,8 +600,12 @@ struct __large_struct { unsigned long buf[100]; }; * Returns zero on success, or -EFAULT on error. */ @@ -24358,7 +24634,7 @@ index 2982387..35d07f4 100644 #define __get_user_unaligned __get_user #define __put_user_unaligned __put_user -@@ -542,7 +623,7 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -546,7 +623,7 @@ struct __large_struct { unsigned long buf[100]; }; #define get_user_ex(x, ptr) do { \ unsigned long __gue_val; \ __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \ @@ -24367,7 +24643,7 @@ index 2982387..35d07f4 100644 } while (0) #define put_user_try uaccess_try -@@ -560,7 +641,7 @@ extern __must_check long strlen_user(const char __user *str); +@@ -564,7 +641,7 @@ extern __must_check long strlen_user(const char __user *str); extern __must_check long strnlen_user(const char __user *str, long n); unsigned long __must_check clear_user(void __user *mem, unsigned long len); @@ -24376,7 +24652,7 @@ index 2982387..35d07f4 100644 extern void __cmpxchg_wrong_size(void) __compiletime_error("Bad argument size for cmpxchg"); -@@ -568,22 +649,23 @@ extern void __cmpxchg_wrong_size(void) +@@ -572,22 +649,23 @@ extern void __cmpxchg_wrong_size(void) #define __user_atomic_cmpxchg_inatomic(uval, ptr, old, new, size) \ ({ \ int __ret = 0; \ @@ -24405,7 +24681,7 @@ index 2982387..35d07f4 100644 : "i" (-EFAULT), "q" (__new), "1" (__old) \ : "memory" \ ); \ -@@ -592,14 +674,14 @@ extern void __cmpxchg_wrong_size(void) +@@ -596,14 +674,14 @@ extern void __cmpxchg_wrong_size(void) case 2: \ { \ asm volatile("\n" \ @@ -24422,7 +24698,7 @@ index 2982387..35d07f4 100644 : "i" (-EFAULT), "r" (__new), "1" (__old) \ : "memory" \ ); \ -@@ -608,14 +690,14 @@ extern void __cmpxchg_wrong_size(void) +@@ -612,14 +690,14 @@ extern void __cmpxchg_wrong_size(void) case 4: \ { \ asm volatile("\n" \ @@ -24439,7 +24715,7 @@ index 2982387..35d07f4 100644 : "i" (-EFAULT), "r" (__new), "1" (__old) \ : "memory" \ ); \ -@@ -627,14 +709,14 @@ extern void __cmpxchg_wrong_size(void) +@@ -631,14 +709,14 @@ extern void __cmpxchg_wrong_size(void) __cmpxchg_wrong_size(); \ \ asm volatile("\n" \ @@ -24456,7 +24732,7 @@ index 2982387..35d07f4 100644 : "i" (-EFAULT), "r" (__new), "1" (__old) \ : "memory" \ ); \ -@@ -644,6 +726,7 @@ extern void __cmpxchg_wrong_size(void) +@@ -648,6 +726,7 @@ extern void __cmpxchg_wrong_size(void) __cmpxchg_wrong_size(); \ } \ __uaccess_end(); \ @@ -24464,7 +24740,7 @@ index 2982387..35d07f4 100644 *__uval = __old; \ __ret; \ }) -@@ -667,17 +750,6 @@ extern struct movsl_mask { +@@ -671,17 +750,6 @@ extern struct movsl_mask { #define ARCH_HAS_NOCACHE_UACCESS 1 @@ -24482,7 +24758,7 @@ index 2982387..35d07f4 100644 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS # define copy_user_diag __compiletime_error #else -@@ -687,7 +759,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from, +@@ -691,7 +759,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from, extern void copy_user_diag("copy_from_user() buffer size is too small") copy_from_user_overflow(void); extern void copy_user_diag("copy_to_user() buffer size is too small") @@ -24491,7 +24767,7 @@ index 2982387..35d07f4 100644 #undef copy_user_diag -@@ -700,7 +772,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow"); +@@ -704,7 +772,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow"); extern void __compiletime_warning("copy_to_user() buffer size is not provably correct") @@ -24500,7 +24776,7 @@ index 2982387..35d07f4 100644 #define __copy_to_user_overflow(size, count) __copy_to_user_overflow() #else -@@ -715,10 +787,16 @@ __copy_from_user_overflow(int size, unsigned long count) +@@ -719,10 +787,16 @@ __copy_from_user_overflow(int size, unsigned long count) #endif @@ -24518,7 +24794,7 @@ index 2982387..35d07f4 100644 might_fault(); -@@ -742,12 +820,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n) +@@ -746,12 +820,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n) * case, and do only runtime checking for non-constant sizes. */ @@ -24540,7 +24816,7 @@ index 2982387..35d07f4 100644 return n; } -@@ -755,19 +836,20 @@ copy_from_user(void *to, const void __user *from, unsigned long n) +@@ -759,19 +836,20 @@ copy_from_user(void *to, const void __user *from, unsigned long n) static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n) { @@ -25776,10 +26052,10 @@ index 4a8697f..8a13428 100644 obj-y += common.o obj-y += rdrand.o diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index f5c69d8..5eecf58 100644 +index b81fe2d..fa46eca 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c -@@ -780,7 +780,7 @@ static void init_amd(struct cpuinfo_x86 *c) +@@ -792,7 +792,7 @@ static void init_amd(struct cpuinfo_x86 *c) static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size) { /* AMD errata T13 (order #21922) */ @@ -29478,10 +29754,10 @@ index 33ee3e0..6d23e5c 100644 #endif /* SMP */ }; diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c -index 7b3b3f2..68b5f72 100644 +index 078c933..c5d51dc 100644 --- a/arch/x86/kernel/paravirt.c +++ b/arch/x86/kernel/paravirt.c -@@ -64,6 +64,9 @@ u64 _paravirt_ident_64(u64 x) +@@ -64,6 +64,9 @@ u64 notrace _paravirt_ident_64(u64 x) { return x; } @@ -31985,10 +32261,10 @@ index 7cc2360..6ae1236 100644 { struct kvm_kpic_state *s = opaque; diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c -index 5f42d03..052f8a4 100644 +index c7220ba..4d0a181 100644 --- a/arch/x86/kvm/ioapic.c +++ b/arch/x86/kvm/ioapic.c -@@ -413,6 +413,8 @@ static void kvm_ioapic_eoi_inject_work(struct work_struct *work) +@@ -415,6 +415,8 @@ static void kvm_ioapic_eoi_inject_work(struct work_struct *work) #define IOAPIC_SUCCESSIVE_IRQ_MAX_COUNT 10000 static void __kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu, @@ -37189,7 +37465,7 @@ index 7a1f7bb..5b4b5cc 100644 while (numpages) { /* diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c -index fb0604f..b9e0399 100644 +index 5431a32..137f092 100644 --- a/arch/x86/mm/pat.c +++ b/arch/x86/mm/pat.c @@ -633,7 +633,7 @@ int free_memtype(u64 start, u64 end) @@ -40002,7 +40278,7 @@ index 058c8d7..55229dd 100644 __be32 *dst = (__be32 *)outbuf; u32 block[4]; diff --git a/crypto/cryptd.c b/crypto/cryptd.c -index 7921251..ba86330 100644 +index 90fefae..1a7cd2e 100644 --- a/crypto/cryptd.c +++ b/crypto/cryptd.c @@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx { @@ -46652,7 +46928,7 @@ index 5d469b2..2a576b2 100644 else type = types[map->type]; diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c -index 57676f8..020e7ca 100644 +index a628975..98c84f7 100644 --- a/drivers/gpu/drm/drm_ioc32.c +++ b/drivers/gpu/drm/drm_ioc32.c @@ -458,7 +458,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd, @@ -46673,16 +46949,16 @@ index 57676f8..020e7ca 100644 if (__put_user(count, &request->count) || __put_user(list, &request->list)) -@@ -1072,7 +1072,7 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd, - return 0; +@@ -1074,7 +1074,7 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd, } + #endif -static drm_ioctl_compat_t *drm_compat_ioctls[] = { +static drm_ioctl_compat_t drm_compat_ioctls[] = { [DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version, [DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)] = compat_drm_getunique, [DRM_IOCTL_NR(DRM_IOCTL_GET_MAP32)] = compat_drm_getmap, -@@ -1119,7 +1119,6 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = { +@@ -1123,7 +1123,6 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = { long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) { unsigned int nr = DRM_IOCTL_NR(cmd); @@ -46690,7 +46966,7 @@ index 57676f8..020e7ca 100644 int ret; /* Assume that ioctls without an explicit compat routine will just -@@ -1129,10 +1128,8 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) +@@ -1133,10 +1132,8 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) if (nr >= ARRAY_SIZE(drm_compat_ioctls)) return drm_ioctl(filp, cmd, arg); @@ -50151,10 +50427,10 @@ index c966492..4e66371 100644 /* * intel_idle_state_table_update() diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c -index e6319a9..9e14f05 100644 +index 2e6a427..8b6cf88 100644 --- a/drivers/iio/industrialio-core.c +++ b/drivers/iio/industrialio-core.c -@@ -689,7 +689,7 @@ static ssize_t iio_write_channel_info(struct device *dev, +@@ -688,7 +688,7 @@ static ssize_t iio_write_channel_info(struct device *dev, } static @@ -56024,7 +56300,7 @@ index fd40bcb..13b3f293 100644 void dm_uevent_add(struct mapped_device *md, struct list_head *elist) diff --git a/drivers/md/md.c b/drivers/md/md.c -index 866825f..0c08c28 100644 +index 0678a0a..90c7246 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -198,10 +198,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev); @@ -56154,7 +56430,7 @@ index 866825f..0c08c28 100644 mask |= POLLERR | POLLPRI; return mask; } -@@ -7637,7 +7638,7 @@ static int is_mddev_idle(struct mddev *mddev, int init) +@@ -7633,7 +7634,7 @@ static int is_mddev_idle(struct mddev *mddev, int init) struct gendisk *disk = rdev->bdev->bd_contains->bd_disk; curr_events = (int)part_stat_read(&disk->part0, sectors[0]) + (int)part_stat_read(&disk->part0, sectors[1]) - @@ -56163,7 +56439,7 @@ index 866825f..0c08c28 100644 /* sync IO will cause sync_io to increase before the disk_stats * as sync_io is counted when a request starts, and * disk_stats is counted when it completes. -@@ -7901,7 +7902,7 @@ void md_do_sync(struct md_thread *thread) +@@ -7897,7 +7898,7 @@ void md_do_sync(struct md_thread *thread) * which defaults to physical size, but can be virtual size */ max_sectors = mddev->resync_max_sectors; @@ -56172,7 +56448,7 @@ index 866825f..0c08c28 100644 /* we don't use the checkpoint if there's a bitmap */ if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) j = mddev->resync_min; -@@ -8895,11 +8896,11 @@ static __exit void md_exit(void) +@@ -8891,11 +8892,11 @@ static __exit void md_exit(void) subsys_initcall(md_init); module_exit(md_exit) @@ -58406,7 +58682,7 @@ index 528390f..cacc274 100644 err = -EFAULT; goto out_array_args; diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c -index 15508df..5f0ee4e 100644 +index 73ec320..a3ed597 100644 --- a/drivers/memory/omap-gpmc.c +++ b/drivers/memory/omap-gpmc.c @@ -234,7 +234,7 @@ struct omap3_gpmc_regs { @@ -61675,7 +61951,7 @@ index 4048fc5..333809f 100644 /** * bnx2x_config_rx_mode - Send and RX_MODE ramrod according to the provided parameters. diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index c777cde..7fa85f9 100644 +index e655b76..313a56d 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -6421,7 +6421,7 @@ init_err_free: @@ -62735,7 +63011,7 @@ index 546fab0..8eeb822 100644 struct mlx4_dev_persistent *persist = pci_get_drvdata(pdev); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 6695893..6abc392 100644 +index e782d0f..6591e56 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/main.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c @@ -1384,7 +1384,7 @@ static void remove_one(struct pci_dev *pdev) @@ -63239,7 +63515,7 @@ index cb49c96..c1498cc 100644 struct smc911x_local *lp = netdev_priv(dev); unsigned int free; diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c -index 18ac52d..5fd8ce3 100644 +index b69d0e1..718a393 100644 --- a/drivers/net/ethernet/smsc/smc91x.c +++ b/drivers/net/ethernet/smsc/smc91x.c @@ -637,7 +637,7 @@ done: if (!THROTTLE_TX_PKTS) @@ -63994,10 +64270,10 @@ index fdee772..6c3ba123 100644 }; diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index e16487c..c0987f1 100644 +index 34259bd..60c2692 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c -@@ -960,7 +960,7 @@ static void tun_set_headroom(struct net_device *dev, int new_hr) +@@ -956,7 +956,7 @@ static void tun_set_headroom(struct net_device *dev, int new_hr) { struct tun_struct *tun = netdev_priv(dev); @@ -64006,7 +64282,7 @@ index e16487c..c0987f1 100644 new_hr = NET_SKB_PAD; tun->align = new_hr; -@@ -1558,7 +1558,7 @@ static int tun_validate(struct nlattr *tb[], struct nlattr *data[]) +@@ -1554,7 +1554,7 @@ static int tun_validate(struct nlattr *tb[], struct nlattr *data[]) return -EINVAL; } @@ -64015,7 +64291,7 @@ index e16487c..c0987f1 100644 .kind = DRV_NAME, .priv_size = sizeof(struct tun_struct), .setup = tun_setup, -@@ -1970,7 +1970,7 @@ unlock: +@@ -1966,7 +1966,7 @@ unlock: } static long __tun_chr_ioctl(struct file *file, unsigned int cmd, @@ -64024,7 +64300,7 @@ index e16487c..c0987f1 100644 { struct tun_file *tfile = file->private_data; struct tun_struct *tun; -@@ -1984,6 +1984,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd, +@@ -1980,6 +1980,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd, int le; int ret; @@ -64757,10 +65033,10 @@ index 9cbca12..eae7c79 100644 struct ath_nf_limits { s16 max; diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c -index 8b63988..2fd4697 100644 +index 4b59a4c..14eb96d 100644 --- a/drivers/net/wireless/ath/ath9k/main.c +++ b/drivers/net/wireless/ath/ath9k/main.c -@@ -2589,16 +2589,18 @@ void ath9k_fill_chanctx_ops(void) +@@ -2594,16 +2594,18 @@ void ath9k_fill_chanctx_ops(void) if (!ath9k_is_chanctx_enabled()) return; @@ -65413,7 +65689,7 @@ index 83770d2..3ec8a40 100644 if (modparam_pio) wldev->__using_pio = true; diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -index 62f475e..c5c90d3 100644 +index 121baba..80f9d55 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -5077,6 +5077,50 @@ static struct cfg80211_ops brcmf_cfg80211_ops = { @@ -77655,10 +77931,10 @@ index 0fbd7c0..66c6010 100644 if (share_irqs) irqflag = IRQF_SHARED; diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index 8dd250f..84599cb 100644 +index e67a463..c568cf1 100644 --- a/drivers/tty/serial/8250/8250_pci.c +++ b/drivers/tty/serial/8250/8250_pci.c -@@ -5632,7 +5632,7 @@ static struct pci_device_id serial_pci_tbl[] = { +@@ -5771,7 +5771,7 @@ static struct pci_device_id serial_pci_tbl[] = { }; static pci_ers_result_t serial8250_io_error_detected(struct pci_dev *dev, @@ -79182,10 +79458,10 @@ index 69f7fab..05c4ff5 100644 /* Device for a quirk */ #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73 diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index bc17bcf..4480e4a 100644 +index e262ccc..43da57e 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c -@@ -1872,9 +1872,9 @@ td_cleanup: +@@ -1876,9 +1876,9 @@ td_cleanup: * unsigned). Play it safe and say we didn't transfer anything. */ if (urb->actual_length > urb->transfer_buffer_length) { @@ -79197,7 +79473,7 @@ index bc17bcf..4480e4a 100644 urb->actual_length = 0; if (td->urb->transfer_flags & URB_SHORT_NOT_OK) *status = -EREMOTEIO; -@@ -1953,10 +1953,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, +@@ -1957,10 +1957,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, return finish_td(xhci, td, event_trb, event, ep, status, false); case COMP_STOP: /* Did we stop at data stage? */ @@ -79217,7 +79493,7 @@ index bc17bcf..4480e4a 100644 /* fall through */ case COMP_STOP_INVAL: return finish_td(xhci, td, event_trb, event, ep, status, false); -@@ -1970,12 +1975,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, +@@ -1974,12 +1979,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, /* else fall through */ case COMP_STALL: /* Did we transfer part of the data (middle) phase? */ @@ -79239,7 +79515,7 @@ index bc17bcf..4480e4a 100644 td->urb->actual_length = 0; return finish_td(xhci, td, event_trb, event, ep, status, false); -@@ -2008,9 +2016,12 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, +@@ -2012,9 +2020,12 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, * the last TRB. */ td->urb_length_set = true; @@ -79255,7 +79531,7 @@ index bc17bcf..4480e4a 100644 xhci_dbg(xhci, "Waiting for status " "stage event\n"); return 0; -@@ -2205,11 +2216,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td, +@@ -2209,11 +2220,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td, /* Fast path - was this the last TRB in the TD for this URB? */ } else if (event_trb == td->last_trb) { if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) { @@ -79268,7 +79544,7 @@ index bc17bcf..4480e4a 100644 xhci_warn(xhci, "HC gave bad length " "of %d bytes left\n", EVENT_TRB_LEN(le32_to_cpu(event->transfer_len))); -@@ -2218,7 +2225,10 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td, +@@ -2222,7 +2229,10 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td, *status = -EREMOTEIO; else *status = 0; @@ -97635,7 +97911,7 @@ index 948aa18..ae3bc17 100644 spin_lock_init(&cur_trans->delayed_refs.lock); diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index c05f69a..2469b31 100644 +index 542379f..054af97 100644 --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -173,7 +173,7 @@ static int start_log_trans(struct btrfs_trans_handle *trans, @@ -102351,7 +102627,7 @@ index cbece12..9b01171 100644 } diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 6cac3dc..e3ad955 100644 +index 76962a3..b0bdc86 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -849,9 +849,9 @@ struct fuse_fill_data { @@ -102776,7 +103052,7 @@ index 8a65240..59ccf62 100644 } diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c -index e157400..1b16643 100644 +index 2bcb86e..b9fad5d 100644 --- a/fs/kernfs/file.c +++ b/fs/kernfs/file.c @@ -34,7 +34,7 @@ static DEFINE_MUTEX(kernfs_open_file_mutex); @@ -104991,7 +105267,7 @@ index 5fe1cec..d0f4ac0 100644 #if IS_ENABLED(CONFIG_NFS_V4) extern int nfs_callback_up(u32 minorversion, struct rpc_xprt *xprt); diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c -index aaa2e8d..deb6e76 100644 +index 8cfa21f..fc50292 100644 --- a/fs/nfs/callback_proc.c +++ b/fs/nfs/callback_proc.c @@ -19,10 +19,12 @@ @@ -105042,7 +105318,7 @@ index aaa2e8d..deb6e76 100644 int i; __be32 res = 0; struct nfs_client *clp = cps->clp; -@@ -444,10 +448,12 @@ out: +@@ -441,10 +445,12 @@ out: return status; } @@ -105057,7 +105333,7 @@ index aaa2e8d..deb6e76 100644 struct nfs4_slot_table *tbl; struct nfs4_slot *slot; struct nfs_client *clp; -@@ -549,9 +555,10 @@ validate_bitmap_values(unsigned long mask) +@@ -546,9 +552,10 @@ validate_bitmap_values(unsigned long mask) return (mask & ~RCA4_TYPE_MASK_ALL) == 0; } @@ -105069,7 +105345,7 @@ index aaa2e8d..deb6e76 100644 __be32 status; fmode_t flags = 0; -@@ -584,9 +591,10 @@ out: +@@ -581,9 +588,10 @@ out: } /* Reduce the fore channel's max_slots to the target value */ @@ -110132,10 +110408,10 @@ index de1ff1d..bd4c347 100644 .pc_ressize = sizeof(struct nfsd4_compoundres), .pc_release = nfsd4_release_compoundargs, diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 806eda1..125792c 100644 +index 6a23098..69c65ea 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c -@@ -2362,8 +2362,9 @@ static bool client_has_state(struct nfs4_client *clp) +@@ -2341,8 +2341,9 @@ static bool client_has_state(struct nfs4_client *clp) __be32 nfsd4_exchange_id(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110146,7 +110422,7 @@ index 806eda1..125792c 100644 struct nfs4_client *conf, *new; struct nfs4_client *unconf = NULL; __be32 status; -@@ -2639,8 +2640,9 @@ static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs) +@@ -2618,8 +2619,9 @@ static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs) __be32 nfsd4_create_session(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110157,7 +110433,7 @@ index 806eda1..125792c 100644 struct sockaddr *sa = svc_addr(rqstp); struct nfs4_client *conf, *unconf; struct nfs4_client *old = NULL; -@@ -2764,8 +2766,9 @@ static __be32 nfsd4_map_bcts_dir(u32 *dir) +@@ -2743,8 +2745,9 @@ static __be32 nfsd4_map_bcts_dir(u32 *dir) return nfserr_inval; } @@ -110168,7 +110444,7 @@ index 806eda1..125792c 100644 struct nfsd4_session *session = cstate->session; struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); __be32 status; -@@ -2785,8 +2788,9 @@ __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp, struct nfsd4_compound_state +@@ -2764,8 +2767,9 @@ __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp, struct nfsd4_compound_state __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110179,7 +110455,7 @@ index 806eda1..125792c 100644 __be32 status; struct nfsd4_conn *conn; struct nfsd4_session *session; -@@ -2828,8 +2832,9 @@ static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4 +@@ -2807,8 +2811,9 @@ static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4 __be32 nfsd4_destroy_session(struct svc_rqst *r, struct nfsd4_compound_state *cstate, @@ -110190,7 +110466,7 @@ index 806eda1..125792c 100644 struct nfsd4_session *ses; __be32 status; int ref_held_by_me = 0; -@@ -2925,8 +2930,9 @@ static bool nfsd4_request_too_big(struct svc_rqst *rqstp, +@@ -2904,8 +2909,9 @@ static bool nfsd4_request_too_big(struct svc_rqst *rqstp, __be32 nfsd4_sequence(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110201,7 +110477,7 @@ index 806eda1..125792c 100644 struct nfsd4_compoundres *resp = rqstp->rq_resp; struct xdr_stream *xdr = &resp->xdr; struct nfsd4_session *session; -@@ -3060,8 +3066,9 @@ nfsd4_sequence_done(struct nfsd4_compoundres *resp) +@@ -3039,8 +3045,9 @@ nfsd4_sequence_done(struct nfsd4_compoundres *resp) } __be32 @@ -110212,7 +110488,7 @@ index 806eda1..125792c 100644 struct nfs4_client *conf, *unconf; struct nfs4_client *clp = NULL; __be32 status = 0; -@@ -3101,8 +3108,9 @@ out: +@@ -3080,8 +3087,9 @@ out: } __be32 @@ -110223,7 +110499,7 @@ index 806eda1..125792c 100644 __be32 status = 0; if (rc->rca_one_fs) { -@@ -3139,8 +3147,9 @@ out: +@@ -3118,8 +3126,9 @@ out: __be32 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110234,7 +110510,7 @@ index 806eda1..125792c 100644 struct xdr_netobj clname = setclid->se_name; nfs4_verifier clverifier = setclid->se_verf; struct nfs4_client *conf, *new; -@@ -3198,8 +3207,9 @@ out: +@@ -3177,8 +3186,9 @@ out: __be32 nfsd4_setclientid_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110245,7 +110521,7 @@ index 806eda1..125792c 100644 struct nfs4_client *conf, *unconf; struct nfs4_client *old = NULL; nfs4_verifier confirm = setclientid_confirm->sc_confirm; -@@ -4443,8 +4453,9 @@ void nfsd4_cleanup_open_state(struct nfsd4_compound_state *cstate, +@@ -4422,8 +4432,9 @@ void nfsd4_cleanup_open_state(struct nfsd4_compound_state *cstate, __be32 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110256,7 +110532,7 @@ index 806eda1..125792c 100644 struct nfs4_client *clp; __be32 status; struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); -@@ -4894,8 +4905,9 @@ out: +@@ -4873,8 +4884,9 @@ out: */ __be32 nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110267,7 +110543,7 @@ index 806eda1..125792c 100644 struct nfsd4_test_stateid_id *stateid; struct nfs4_client *cl = cstate->session->se_client; -@@ -4934,8 +4946,9 @@ out: +@@ -4913,8 +4925,9 @@ out: __be32 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110278,7 +110554,7 @@ index 806eda1..125792c 100644 stateid_t *stateid = &free_stateid->fr_stateid; struct nfs4_stid *s; struct nfs4_delegation *dp; -@@ -5063,8 +5076,9 @@ static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cs +@@ -5042,8 +5055,9 @@ static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cs __be32 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110289,7 +110565,7 @@ index 806eda1..125792c 100644 __be32 status; struct nfs4_openowner *oo; struct nfs4_ol_stateid *stp; -@@ -5132,8 +5146,9 @@ static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_ac +@@ -5111,8 +5125,9 @@ static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_ac __be32 nfsd4_open_downgrade(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110300,7 +110576,7 @@ index 806eda1..125792c 100644 __be32 status; struct nfs4_ol_stateid *stp; struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); -@@ -5201,8 +5216,9 @@ static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s) +@@ -5180,8 +5195,9 @@ static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s) */ __be32 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110311,7 +110587,7 @@ index 806eda1..125792c 100644 __be32 status; struct nfs4_ol_stateid *stp; struct net *net = SVC_NET(rqstp); -@@ -5231,8 +5247,9 @@ out: +@@ -5210,8 +5226,9 @@ out: __be32 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110322,7 +110598,7 @@ index 806eda1..125792c 100644 struct nfs4_delegation *dp; stateid_t *stateid = &dr->dr_stateid; struct nfs4_stid *s; -@@ -5583,8 +5600,9 @@ out: +@@ -5562,8 +5579,9 @@ out: */ __be32 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110333,7 +110609,7 @@ index 806eda1..125792c 100644 struct nfs4_openowner *open_sop = NULL; struct nfs4_lockowner *lock_sop = NULL; struct nfs4_ol_stateid *lock_stp = NULL; -@@ -5785,8 +5803,9 @@ static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct +@@ -5764,8 +5782,9 @@ static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct */ __be32 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110344,7 +110620,7 @@ index 806eda1..125792c 100644 struct file_lock *file_lock = NULL; struct nfs4_lockowner *lo = NULL; __be32 status; -@@ -5858,8 +5877,9 @@ out: +@@ -5837,8 +5856,9 @@ out: __be32 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110355,7 +110631,7 @@ index 806eda1..125792c 100644 struct nfs4_ol_stateid *stp; struct file *filp = NULL; struct file_lock *file_lock = NULL; -@@ -5965,8 +5985,9 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner) +@@ -5944,8 +5964,9 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner) __be32 nfsd4_release_lockowner(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, @@ -110366,7 +110642,7 @@ index 806eda1..125792c 100644 clientid_t *clid = &rlockowner->rl_clientid; struct nfs4_stateowner *sop; struct nfs4_lockowner *lo = NULL; -@@ -6910,26 +6931,34 @@ clear_current_stateid(struct nfsd4_compound_state *cstate) +@@ -6904,26 +6925,34 @@ clear_current_stateid(struct nfsd4_compound_state *cstate) * functions to set current state id */ void @@ -110405,7 +110681,7 @@ index 806eda1..125792c 100644 put_stateid(cstate, &lock->lk_resp_stateid); } -@@ -6938,49 +6967,65 @@ nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lo +@@ -6932,49 +6961,65 @@ nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lo */ void @@ -114098,7 +114374,7 @@ index 88c7de1..3e4b510 100644 static struct pid * get_children_pid(struct inode *inode, struct pid *pid_prev, loff_t pos) diff --git a/fs/proc/base.c b/fs/proc/base.c -index a11eb71..d48ca0e 100644 +index 7583df7..d0091f3 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -113,6 +113,14 @@ struct pid_entry { @@ -114368,7 +114644,7 @@ index a11eb71..d48ca0e 100644 if (src >= (env_end - env_start)) break; -@@ -1584,7 +1690,7 @@ static const char *proc_pid_get_link(struct dentry *dentry, +@@ -1579,7 +1685,7 @@ static const char *proc_pid_get_link(struct dentry *dentry, return ERR_PTR(-ECHILD); /* Are we allowed to snoop on the tasks file descriptors? */ @@ -114377,7 +114653,7 @@ index a11eb71..d48ca0e 100644 goto out; error = PROC_I(inode)->op.proc_get_link(dentry, &path); -@@ -1628,8 +1734,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b +@@ -1623,8 +1729,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b struct path path; /* Are we allowed to snoop on the tasks file descriptors? */ @@ -114398,7 +114674,7 @@ index a11eb71..d48ca0e 100644 error = PROC_I(inode)->op.proc_get_link(dentry, &path); if (error) -@@ -1679,7 +1795,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t +@@ -1674,7 +1790,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t rcu_read_lock(); cred = __task_cred(task); inode->i_uid = cred->euid; @@ -114410,7 +114686,7 @@ index a11eb71..d48ca0e 100644 rcu_read_unlock(); } security_task_to_inode(task, inode); -@@ -1715,10 +1835,19 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat) +@@ -1710,10 +1830,19 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat) return -ENOENT; } if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) || @@ -114430,7 +114706,7 @@ index a11eb71..d48ca0e 100644 } } rcu_read_unlock(); -@@ -1756,11 +1885,20 @@ int pid_revalidate(struct dentry *dentry, unsigned int flags) +@@ -1751,11 +1880,20 @@ int pid_revalidate(struct dentry *dentry, unsigned int flags) if (task) { if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) || @@ -114451,7 +114727,7 @@ index a11eb71..d48ca0e 100644 rcu_read_unlock(); } else { inode->i_uid = GLOBAL_ROOT_UID; -@@ -2374,6 +2512,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir, +@@ -2369,6 +2507,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir, if (!task) goto out_no_task; @@ -114461,7 +114737,7 @@ index a11eb71..d48ca0e 100644 /* * Yes, it does not scale. And it should not. Don't add * new entries into /proc/<tgid>/ without very good reasons. -@@ -2404,6 +2545,9 @@ static int proc_pident_readdir(struct file *file, struct dir_context *ctx, +@@ -2399,6 +2540,9 @@ static int proc_pident_readdir(struct file *file, struct dir_context *ctx, if (!task) return -ENOENT; @@ -114471,7 +114747,7 @@ index a11eb71..d48ca0e 100644 if (!dir_emit_dots(file, ctx)) goto out; -@@ -2816,7 +2960,9 @@ static const struct inode_operations proc_task_inode_operations; +@@ -2811,7 +2955,9 @@ static const struct inode_operations proc_task_inode_operations; static const struct pid_entry tgid_base_stuff[] = { DIR("task", S_IRUGO|S_IXUGO, proc_task_inode_operations, proc_task_operations), DIR("fd", S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations), @@ -114481,7 +114757,7 @@ index a11eb71..d48ca0e 100644 DIR("fdinfo", S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fdinfo_operations), DIR("ns", S_IRUSR|S_IXUGO, proc_ns_dir_inode_operations, proc_ns_dir_operations), #ifdef CONFIG_NET -@@ -2834,7 +2980,7 @@ static const struct pid_entry tgid_base_stuff[] = { +@@ -2829,7 +2975,7 @@ static const struct pid_entry tgid_base_stuff[] = { REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations), #endif REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations), @@ -114490,7 +114766,7 @@ index a11eb71..d48ca0e 100644 ONE("syscall", S_IRUSR, proc_pid_syscall), #endif REG("cmdline", S_IRUGO, proc_pid_cmdline_ops), -@@ -2859,10 +3005,10 @@ static const struct pid_entry tgid_base_stuff[] = { +@@ -2854,10 +3000,10 @@ static const struct pid_entry tgid_base_stuff[] = { #ifdef CONFIG_SECURITY DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), #endif @@ -114503,7 +114779,7 @@ index a11eb71..d48ca0e 100644 ONE("stack", S_IRUSR, proc_pid_stack), #endif #ifdef CONFIG_SCHED_INFO -@@ -2896,6 +3042,9 @@ static const struct pid_entry tgid_base_stuff[] = { +@@ -2891,6 +3037,9 @@ static const struct pid_entry tgid_base_stuff[] = { #ifdef CONFIG_HARDWALL ONE("hardwall", S_IRUGO, proc_pid_hardwall), #endif @@ -114513,7 +114789,7 @@ index a11eb71..d48ca0e 100644 #ifdef CONFIG_USER_NS REG("uid_map", S_IRUGO|S_IWUSR, proc_uid_map_operations), REG("gid_map", S_IRUGO|S_IWUSR, proc_gid_map_operations), -@@ -3029,7 +3178,14 @@ static int proc_pid_instantiate(struct inode *dir, +@@ -3024,7 +3173,14 @@ static int proc_pid_instantiate(struct inode *dir, if (!inode) goto out; @@ -114528,7 +114804,7 @@ index a11eb71..d48ca0e 100644 inode->i_op = &proc_tgid_base_inode_operations; inode->i_fop = &proc_tgid_base_operations; inode->i_flags|=S_IMMUTABLE; -@@ -3067,7 +3223,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, unsign +@@ -3062,7 +3218,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, unsign if (!task) goto out; @@ -114540,7 +114816,7 @@ index a11eb71..d48ca0e 100644 put_task_struct(task); out: return ERR_PTR(result); -@@ -3221,7 +3381,7 @@ static const struct pid_entry tid_base_stuff[] = { +@@ -3216,7 +3376,7 @@ static const struct pid_entry tid_base_stuff[] = { NOD("comm", S_IFREG|S_IRUGO|S_IWUSR, &proc_tid_comm_inode_operations, &proc_pid_set_comm_operations, {}), @@ -114549,7 +114825,7 @@ index a11eb71..d48ca0e 100644 ONE("syscall", S_IRUSR, proc_pid_syscall), #endif REG("cmdline", S_IRUGO, proc_pid_cmdline_ops), -@@ -3248,10 +3408,10 @@ static const struct pid_entry tid_base_stuff[] = { +@@ -3243,10 +3403,10 @@ static const struct pid_entry tid_base_stuff[] = { #ifdef CONFIG_SECURITY DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), #endif @@ -128944,10 +129220,10 @@ index af0254c..a4e4da3 100644 extern char __per_cpu_load[], __per_cpu_start[], __per_cpu_end[]; extern char __kprobes_text_start[], __kprobes_text_end[]; diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h -index 1bfa602..aab89b1 100644 +index 32901d1..5fa5a13 100644 --- a/include/asm-generic/uaccess.h +++ b/include/asm-generic/uaccess.h -@@ -345,4 +345,20 @@ clear_user(void __user *to, unsigned long n) +@@ -351,4 +351,20 @@ clear_user(void __user *to, unsigned long n) return __clear_user(to, n); } @@ -130502,10 +130778,10 @@ index 71c1b21..529a781 100644 extern struct dma_map_ops dma_noop_ops; diff --git a/include/linux/efi.h b/include/linux/efi.h -index f196dd0..bbcc416 100644 +index 17fd2c5..a48e2bb 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h -@@ -1184,6 +1184,7 @@ struct efivar_operations { +@@ -1193,6 +1193,7 @@ struct efivar_operations { efi_set_variable_t *set_variable_nonblocking; efi_query_variable_store_t *query_variable_store; }; @@ -132479,7 +132755,7 @@ index 1eee6bc..9cf4912 100644 extern struct ipc_namespace init_ipc_ns; extern atomic_t nr_ipc_ns; diff --git a/include/linux/irq.h b/include/linux/irq.h -index 4d758a7..f6ce482 100644 +index cbb5a2c..276804f 100644 --- a/include/linux/irq.h +++ b/include/linux/irq.h @@ -399,7 +399,10 @@ struct irq_chip { @@ -133198,7 +133474,7 @@ index 093607f..9717227 100644 register_memory_notifier(&fn##_mem_nb); \ }) diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h -index 4429d25..ae5ab54 100644 +index 5e5b296..629113f 100644 --- a/include/linux/mempolicy.h +++ b/include/linux/mempolicy.h @@ -91,6 +91,10 @@ static inline struct mempolicy *mpol_dup(struct mempolicy *pol) @@ -133212,7 +133488,7 @@ index 4429d25..ae5ab54 100644 static inline void mpol_get(struct mempolicy *pol) { -@@ -235,6 +239,9 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx) +@@ -236,6 +240,9 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx) } #define vma_policy(vma) NULL @@ -133223,7 +133499,7 @@ index 4429d25..ae5ab54 100644 static inline int vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst) diff --git a/include/linux/mm.h b/include/linux/mm.h -index ece042d..8115afb 100644 +index 317564b..3e200b9 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -107,6 +107,7 @@ extern int mmap_rnd_compat_bits __read_mostly; @@ -133416,7 +133692,7 @@ index ece042d..8115afb 100644 if (rlim < RLIM_INFINITY) { if (((new - start) + (end_data - start_data)) > rlim) return -ENOSPC; -@@ -1996,6 +2012,7 @@ extern unsigned long do_mmap(struct file *file, unsigned long addr, +@@ -1997,6 +2013,7 @@ extern unsigned long do_mmap(struct file *file, unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, vm_flags_t vm_flags, unsigned long pgoff, unsigned long *populate); extern int do_munmap(struct mm_struct *, unsigned long, size_t); @@ -133424,7 +133700,7 @@ index ece042d..8115afb 100644 static inline unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, -@@ -2032,10 +2049,11 @@ struct vm_unmapped_area_info { +@@ -2033,10 +2050,11 @@ struct vm_unmapped_area_info { unsigned long high_limit; unsigned long align_mask; unsigned long align_offset; @@ -133438,7 +133714,7 @@ index ece042d..8115afb 100644 /* * Search for an unmapped address range. -@@ -2047,7 +2065,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info); +@@ -2048,7 +2066,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info); * - satisfies (begin_addr & align_mask) == (align_offset & align_mask) */ static inline unsigned long @@ -133447,7 +133723,7 @@ index ece042d..8115afb 100644 { if (info->flags & VM_UNMAPPED_AREA_TOPDOWN) return unmapped_area_topdown(info); -@@ -2107,6 +2125,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add +@@ -2108,6 +2126,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr, struct vm_area_struct **pprev); @@ -133458,7 +133734,7 @@ index ece042d..8115afb 100644 /* Look up the first VMA which intersects the interval start_addr..end_addr-1, NULL if none. Assume start_addr < end_addr. */ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr) -@@ -2136,10 +2158,10 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm, +@@ -2137,10 +2159,10 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm, } #ifdef CONFIG_MMU @@ -133471,7 +133747,7 @@ index ece042d..8115afb 100644 { return __pgprot(0); } -@@ -2322,7 +2344,7 @@ extern int get_hwpoison_page(struct page *page); +@@ -2323,7 +2345,7 @@ extern int get_hwpoison_page(struct page *page); extern int sysctl_memory_failure_early_kill; extern int sysctl_memory_failure_recovery; extern void shake_page(struct page *p, int access); @@ -133480,7 +133756,7 @@ index ece042d..8115afb 100644 extern int soft_offline_page(struct page *page, int flags); -@@ -2410,5 +2432,11 @@ void __init setup_nr_node_ids(void); +@@ -2411,5 +2433,11 @@ void __init setup_nr_node_ids(void); static inline void setup_nr_node_ids(void) {} #endif @@ -133870,7 +134146,7 @@ index 25aa03b..9817031 100644 struct iovec; struct kvec; diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index da4b33b..0ae34af 100644 +index 4f0e6fb..2f980dd 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1290,6 +1290,7 @@ struct net_device_ops { @@ -133903,7 +134179,7 @@ index da4b33b..0ae34af 100644 #ifdef CONFIG_WIRELESS_EXT const struct iw_handler_def *wireless_handlers; -@@ -4152,7 +4153,7 @@ static inline bool netif_reduces_vlan_mtu(struct net_device *dev) +@@ -4153,7 +4154,7 @@ static inline bool netif_reduces_vlan_mtu(struct net_device *dev) return dev->priv_flags & IFF_MACSEC; } @@ -137045,7 +137321,7 @@ index 5122b5e..598b440 100644 void v9fs_register_trans(struct p9_trans_module *m); void v9fs_unregister_trans(struct p9_trans_module *m); diff --git a/include/net/af_unix.h b/include/net/af_unix.h -index 9b4c418..f3ff431 100644 +index fd60ecc..64e2a1e 100644 --- a/include/net/af_unix.h +++ b/include/net/af_unix.h @@ -36,7 +36,7 @@ struct unix_skb_parms { @@ -137951,7 +138227,7 @@ index ff5be7e..598bf64 100644 void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk, diff --git a/include/net/tcp.h b/include/net/tcp.h -index 0bcc70f..5c46882 100644 +index 7254051..1f9ddac 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -543,7 +543,7 @@ void tcp_retransmit_timer(struct sock *sk); @@ -137983,7 +138259,7 @@ index 0bcc70f..5c46882 100644 union { struct { /* There is space for up to 20 bytes */ -@@ -1869,7 +1869,7 @@ static inline void tcp_segs_in(struct tcp_sock *tp, const struct sk_buff *skb) +@@ -1871,7 +1871,7 @@ static inline void tcp_segs_in(struct tcp_sock *tp, const struct sk_buff *skb) */ static inline void tcp_listendrop(const struct sock *sk) { @@ -140505,7 +140781,7 @@ index 8c50276..457c599 100644 pagefault_disable(); result = __get_user(opcode, (uprobe_opcode_t __user *)vaddr); diff --git a/kernel/exit.c b/kernel/exit.c -index 9e6e135..4af378d 100644 +index 26a766a..b802979 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -170,6 +170,10 @@ void release_task(struct task_struct *p) @@ -140566,7 +140842,7 @@ index 9e6e135..4af378d 100644 exit_mm(tsk); if (group_dead) -@@ -851,7 +860,7 @@ SYSCALL_DEFINE1(exit, int, error_code) +@@ -846,7 +855,7 @@ SYSCALL_DEFINE1(exit, int, error_code) * Take down every thread in the group. This is called by fatal signals * as well as by sys_exit_group (below). */ @@ -140575,7 +140851,7 @@ index 9e6e135..4af378d 100644 do_group_exit(int exit_code) { struct signal_struct *sig = current->signal; -@@ -979,6 +988,7 @@ static int wait_noreap_copyout(struct wait_opts *wo, struct task_struct *p, +@@ -974,6 +983,7 @@ static int wait_noreap_copyout(struct wait_opts *wo, struct task_struct *p, * the lock and this task is uninteresting. If we return nonzero, we have * released the lock and the system call should return. */ @@ -140583,7 +140859,7 @@ index 9e6e135..4af378d 100644 static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p) { int state, retval, status; -@@ -995,6 +1005,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p) +@@ -990,6 +1000,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p) get_task_struct(p); read_unlock(&tasklist_lock); @@ -140591,7 +140867,7 @@ index 9e6e135..4af378d 100644 sched_annotate_sleep(); if ((exit_code & 0x7f) == 0) { -@@ -1017,6 +1028,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p) +@@ -1012,6 +1023,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p) * We own this thread, nobody else can reap it. */ read_unlock(&tasklist_lock); @@ -140599,7 +140875,7 @@ index 9e6e135..4af378d 100644 sched_annotate_sleep(); /* -@@ -1159,6 +1171,8 @@ static int *task_stopped_code(struct task_struct *p, bool ptrace) +@@ -1154,6 +1166,8 @@ static int *task_stopped_code(struct task_struct *p, bool ptrace) * search should terminate. */ static int wait_task_stopped(struct wait_opts *wo, @@ -140608,7 +140884,7 @@ index 9e6e135..4af378d 100644 int ptrace, struct task_struct *p) { struct siginfo __user *infop; -@@ -1206,6 +1220,7 @@ unlock_sig: +@@ -1201,6 +1215,7 @@ unlock_sig: pid = task_pid_vnr(p); why = ptrace ? CLD_TRAPPED : CLD_STOPPED; read_unlock(&tasklist_lock); @@ -140616,7 +140892,7 @@ index 9e6e135..4af378d 100644 sched_annotate_sleep(); if (unlikely(wo->wo_flags & WNOWAIT)) -@@ -1243,6 +1258,7 @@ unlock_sig: +@@ -1238,6 +1253,7 @@ unlock_sig: * the lock and this task is uninteresting. If we return nonzero, we have * released the lock and the system call should return. */ @@ -140624,7 +140900,7 @@ index 9e6e135..4af378d 100644 static int wait_task_continued(struct wait_opts *wo, struct task_struct *p) { int retval; -@@ -1269,6 +1285,7 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p) +@@ -1264,6 +1280,7 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p) pid = task_pid_vnr(p); get_task_struct(p); read_unlock(&tasklist_lock); @@ -140632,7 +140908,7 @@ index 9e6e135..4af378d 100644 sched_annotate_sleep(); if (!wo->wo_info) { -@@ -1298,6 +1315,8 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p) +@@ -1293,6 +1310,8 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p) * or another error from security_task_wait(), or still -ECHILD. */ static int wait_consider_task(struct wait_opts *wo, int ptrace, @@ -140641,7 +140917,7 @@ index 9e6e135..4af378d 100644 struct task_struct *p) { /* -@@ -1423,6 +1442,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace, +@@ -1418,6 +1437,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace, * ->notask_error is 0 if there were any eligible children, * or another error from security_task_wait(), or still -ECHILD. */ @@ -140649,7 +140925,7 @@ index 9e6e135..4af378d 100644 static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk) { struct task_struct *p; -@@ -1437,6 +1457,7 @@ static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk) +@@ -1432,6 +1452,7 @@ static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk) return 0; } @@ -140657,7 +140933,7 @@ index 9e6e135..4af378d 100644 static int ptrace_do_wait(struct wait_opts *wo, struct task_struct *tsk) { struct task_struct *p; -@@ -1500,12 +1521,16 @@ repeat: +@@ -1495,12 +1516,16 @@ repeat: tsk = current; do { retval = do_wait_thread(wo, tsk); @@ -140714,7 +140990,7 @@ index e820cce..72195de 100644 /* Given an address, look for it in the exception tables. */ diff --git a/kernel/fork.c b/kernel/fork.c -index aea4f4d..59d599e 100644 +index 74fd390..597bfcb 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -197,12 +197,55 @@ static void free_thread_stack(unsigned long *stack) @@ -141054,7 +141330,7 @@ index aea4f4d..59d599e 100644 } static inline int mm_alloc_pgd(struct mm_struct *mm) -@@ -836,8 +940,8 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode) +@@ -859,8 +963,8 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode) return ERR_PTR(err); mm = get_task_mm(task); @@ -141065,7 +141341,7 @@ index aea4f4d..59d599e 100644 mmput(mm); mm = ERR_PTR(-EACCES); } -@@ -1038,13 +1142,20 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk) +@@ -1061,13 +1165,20 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk) spin_unlock(&fs->lock); return -EAGAIN; } @@ -141087,7 +141363,7 @@ index aea4f4d..59d599e 100644 return 0; } -@@ -1277,7 +1388,7 @@ init_task_pid(struct task_struct *task, enum pid_type type, struct pid *pid) +@@ -1300,7 +1411,7 @@ init_task_pid(struct task_struct *task, enum pid_type type, struct pid *pid) * parts of the process environment (as per the clone * flags). The actual kick-off is left to the caller. */ @@ -141096,7 +141372,7 @@ index aea4f4d..59d599e 100644 unsigned long stack_start, unsigned long stack_size, int __user *child_tidptr, -@@ -1349,6 +1460,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, +@@ -1372,6 +1483,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled); #endif retval = -EAGAIN; @@ -141106,7 +141382,7 @@ index aea4f4d..59d599e 100644 if (atomic_read(&p->real_cred->user->processes) >= task_rlimit(p, RLIMIT_NPROC)) { if (p->real_cred->user != INIT_USER && -@@ -1607,6 +1721,16 @@ static struct task_struct *copy_process(unsigned long clone_flags, +@@ -1630,6 +1744,16 @@ static struct task_struct *copy_process(unsigned long clone_flags, goto bad_fork_cancel_cgroup; } @@ -141123,7 +141399,7 @@ index aea4f4d..59d599e 100644 if (likely(p->pid)) { ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace); -@@ -1698,6 +1822,8 @@ bad_fork_cleanup_count: +@@ -1721,6 +1845,8 @@ bad_fork_cleanup_count: bad_fork_free: free_task(p); fork_out: @@ -141132,7 +141408,7 @@ index aea4f4d..59d599e 100644 return ERR_PTR(retval); } -@@ -1761,6 +1887,7 @@ long _do_fork(unsigned long clone_flags, +@@ -1784,6 +1910,7 @@ long _do_fork(unsigned long clone_flags, p = copy_process(clone_flags, stack_start, stack_size, child_tidptr, NULL, trace, tls, NUMA_NO_NODE); @@ -141140,7 +141416,7 @@ index aea4f4d..59d599e 100644 /* * Do this prior waking up the new thread - the thread pointer * might get invalid after that point, if the thread exits quickly. -@@ -1777,6 +1904,8 @@ long _do_fork(unsigned long clone_flags, +@@ -1800,6 +1927,8 @@ long _do_fork(unsigned long clone_flags, if (clone_flags & CLONE_PARENT_SETTID) put_user(nr, parent_tidptr); @@ -141149,7 +141425,7 @@ index aea4f4d..59d599e 100644 if (clone_flags & CLONE_VFORK) { p->vfork_done = &vfork; init_completion(&vfork); -@@ -1913,7 +2042,7 @@ void __init proc_caches_init(void) +@@ -1936,7 +2065,7 @@ void __init proc_caches_init(void) sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN, SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK|SLAB_ACCOUNT, NULL); @@ -141158,7 +141434,7 @@ index aea4f4d..59d599e 100644 mmap_init(); nsproxy_cache_init(); } -@@ -1961,7 +2090,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp) +@@ -1984,7 +2113,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp) return 0; /* don't need lock here; in the worst case we'll do useless copy */ @@ -141167,7 +141443,7 @@ index aea4f4d..59d599e 100644 return 0; *new_fsp = copy_fs_struct(fs); -@@ -2074,7 +2203,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) +@@ -2097,7 +2226,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) fs = current->fs; spin_lock(&fs->lock); current->fs = new_fs; @@ -141177,7 +141453,7 @@ index aea4f4d..59d599e 100644 new_fs = NULL; else new_fs = fs; -@@ -2138,7 +2268,7 @@ int unshare_files(struct files_struct **displaced) +@@ -2161,7 +2291,7 @@ int unshare_files(struct files_struct **displaced) int sysctl_max_threads(struct ctl_table *table, int write, void __user *buffer, size_t *lenp, loff_t *ppos) { @@ -141267,7 +141543,7 @@ index ef0bc02..2c983f5 100644 irq_wake_secondary(desc, action); diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c -index 0afe671..244f89c 100644 +index 6143b2f..87ffe77 100644 --- a/kernel/irq/msi.c +++ b/kernel/irq/msi.c @@ -214,16 +214,18 @@ static void msi_domain_update_dom_ops(struct msi_domain_info *info) @@ -143098,18 +143374,46 @@ index a65ba13..f600dbb 100644 if (write && !ns_capable(pid_ns->user_ns, CAP_SYS_ADMIN)) return -EPERM; diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig -index 68d3ebc..82bb833 100644 +index 68d3ebc..554935d 100644 --- a/kernel/power/Kconfig +++ b/kernel/power/Kconfig -@@ -34,6 +34,8 @@ config HIBERNATE_CALLBACKS +@@ -34,6 +34,7 @@ config HIBERNATE_CALLBACKS config HIBERNATION bool "Hibernation (aka 'suspend to disk')" depends on SWAP && ARCH_HIBERNATION_POSSIBLE + depends on !GRKERNSEC_KMEM -+ depends on !PAX_MEMORY_SANITIZE select HIBERNATE_CALLBACKS select LZO_COMPRESS select LZO_DECOMPRESS +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index fca9254..a40591f 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -305,8 +305,10 @@ static int create_image(int platform_mode) + error); + /* Restore control flow magically appears here */ + restore_processor_state(); +- if (!in_suspend) ++ if (!in_suspend) { + events_check_enabled = false; ++ clear_free_pages(); ++ } + + platform_leave(platform_mode); + +diff --git a/kernel/power/power.h b/kernel/power/power.h +index efe1b3b..cd674b2 100644 +--- a/kernel/power/power.h ++++ b/kernel/power/power.h +@@ -101,6 +101,8 @@ extern int create_basic_memory_bitmaps(void); + extern void free_basic_memory_bitmaps(void); + extern int hibernate_preallocate_memory(void); + ++extern void clear_free_pages(void); ++ + /** + * Auxiliary structure used for reading the snapshot image data and + * metadata from and writing them to the list of page backup entries diff --git a/kernel/power/process.c b/kernel/power/process.c index 0c2ee97..63229a6 100644 --- a/kernel/power/process.c @@ -143153,6 +143457,37 @@ index 0c2ee97..63229a6 100644 break; if (pm_wakeup_pending()) { +diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c +index 3a97060..12c1d4e 100644 +--- a/kernel/power/snapshot.c ++++ b/kernel/power/snapshot.c +@@ -1032,6 +1032,26 @@ void free_basic_memory_bitmaps(void) + pr_debug("PM: Basic memory bitmaps freed\n"); + } + ++void clear_free_pages(void) ++{ ++ struct memory_bitmap *bm = free_pages_map; ++ unsigned long pfn; ++ ++ if (WARN_ON(!(free_pages_map))) ++ return; ++ ++ memory_bm_position_reset(bm); ++ pfn = memory_bm_next_pfn(bm); ++ while (pfn != BM_END_OF_MAP) { ++ if (pfn_valid(pfn)) ++ clear_highpage(pfn_to_page(pfn)); ++ ++ pfn = memory_bm_next_pfn(bm); ++ } ++ memory_bm_position_reset(bm); ++ pr_info("PM: free pages cleared after restore\n"); ++} ++ + /** + * snapshot_additional_pages - estimate the number of additional pages + * be needed for setting up the suspend image data structures for given diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index 60cdf63..eab5721 100644 --- a/kernel/printk/printk.c @@ -143956,10 +144291,10 @@ index a5d966c..9c2d28b 100644 #ifdef CONFIG_RT_GROUP_SCHED /* diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 97ee9ac..f8349adf 100644 +index 38eacc3..9f35d87 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c -@@ -2236,7 +2236,7 @@ void set_numabalancing_state(bool enabled) +@@ -2258,7 +2258,7 @@ void set_numabalancing_state(bool enabled) int sysctl_numa_balancing(struct ctl_table *table, int write, void __user *buffer, size_t *lenp, loff_t *ppos) { @@ -143968,7 +144303,7 @@ index 97ee9ac..f8349adf 100644 int err; int state = static_branch_likely(&sched_numa_balancing); -@@ -2311,7 +2311,7 @@ static void __init init_schedstats(void) +@@ -2333,7 +2333,7 @@ static void __init init_schedstats(void) int sysctl_schedstats(struct ctl_table *table, int write, void __user *buffer, size_t *lenp, loff_t *ppos) { @@ -143977,7 +144312,7 @@ index 97ee9ac..f8349adf 100644 int err; int state = static_branch_likely(&sched_schedstats); -@@ -2754,7 +2754,7 @@ static struct rq *finish_task_switch(struct task_struct *prev) +@@ -2776,7 +2776,7 @@ static struct rq *finish_task_switch(struct task_struct *prev) /* rq->lock is NOT held, but preemption is disabled */ static void __balance_callback(struct rq *rq) { @@ -143986,7 +144321,7 @@ index 97ee9ac..f8349adf 100644 void (*func)(struct rq *rq); unsigned long flags; -@@ -2762,7 +2762,7 @@ static void __balance_callback(struct rq *rq) +@@ -2784,7 +2784,7 @@ static void __balance_callback(struct rq *rq) head = rq->balance_callback; rq->balance_callback = NULL; while (head) { @@ -143995,7 +144330,7 @@ index 97ee9ac..f8349adf 100644 next = head->next; head->next = NULL; head = next; -@@ -3708,6 +3708,8 @@ int can_nice(const struct task_struct *p, const int nice) +@@ -3730,6 +3730,8 @@ int can_nice(const struct task_struct *p, const int nice) /* convert nice value [19,-20] to rlimit style value [1,40] */ int nice_rlim = nice_to_rlimit(nice); @@ -144004,7 +144339,7 @@ index 97ee9ac..f8349adf 100644 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) || capable(CAP_SYS_NICE)); } -@@ -3734,7 +3736,8 @@ SYSCALL_DEFINE1(nice, int, increment) +@@ -3756,7 +3758,8 @@ SYSCALL_DEFINE1(nice, int, increment) nice = task_nice(current) + increment; nice = clamp_val(nice, MIN_NICE, MAX_NICE); @@ -144014,7 +144349,7 @@ index 97ee9ac..f8349adf 100644 return -EPERM; retval = security_task_setnice(current, nice); -@@ -4044,6 +4047,7 @@ recheck: +@@ -4066,6 +4069,7 @@ recheck: if (policy != p->policy && !rlim_rtprio) return -EPERM; @@ -144022,7 +144357,7 @@ index 97ee9ac..f8349adf 100644 /* can't increase priority */ if (attr->sched_priority > p->rt_priority && attr->sched_priority > rlim_rtprio) -@@ -7529,7 +7533,7 @@ void __might_sleep(const char *file, int line, int preempt_offset) +@@ -7551,7 +7555,7 @@ void __might_sleep(const char *file, int line, int preempt_offset) */ WARN_ONCE(current->state != TASK_RUNNING && current->task_state_change, "do not call blocking ops when !TASK_RUNNING; " @@ -149153,7 +149488,7 @@ index 9e04681..30759a2 100644 mm = get_task_mm(tsk); if (!mm) diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index 297d685..388696f 100644 +index e682861..c92d0a8 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -730,6 +730,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, @@ -150992,7 +151327,7 @@ index e248194..ff005a8 100644 struct bdi_writeback *wb = dtc->wb; unsigned long write_bw = wb->avg_write_bandwidth; diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 8b3e134..d47200a 100644 +index 6e35419..3ebe533 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -63,6 +63,7 @@ @@ -151150,7 +151485,7 @@ index 8b3e134..d47200a 100644 clear_bit(ZONE_FAIR_DEPLETED, &zone->flags); } while (zone++ != preferred_zone); } -@@ -6858,7 +6901,7 @@ static void __setup_per_zone_wmarks(void) +@@ -6812,7 +6855,7 @@ static void __setup_per_zone_wmarks(void) __mod_zone_page_state(zone, NR_ALLOC_BATCH, high_wmark_pages(zone) - low_wmark_pages(zone) - @@ -154582,7 +154917,7 @@ index b7de71f..808387d 100644 return err; diff --git a/net/core/dev.c b/net/core/dev.c -index 904ff43..050ec70 100644 +index 97fb3da..be181d7 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1766,7 +1766,7 @@ int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb) @@ -154630,7 +154965,7 @@ index 904ff43..050ec70 100644 { struct softnet_data *sd = this_cpu_ptr(&softnet_data); -@@ -4206,9 +4206,9 @@ ncls: +@@ -4222,9 +4222,9 @@ ncls: } else { drop: if (!deliver_exact) @@ -154642,7 +154977,7 @@ index 904ff43..050ec70 100644 kfree_skb(skb); /* Jamal, now you will not able to escape explaining * me how you were going to use this. :-) -@@ -5175,7 +5175,7 @@ out_unlock: +@@ -5191,7 +5191,7 @@ out_unlock: return work; } @@ -154651,7 +154986,7 @@ index 904ff43..050ec70 100644 { struct softnet_data *sd = this_cpu_ptr(&softnet_data); unsigned long time_limit = jiffies + 2; -@@ -7390,9 +7390,9 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev, +@@ -7406,9 +7406,9 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev, } else { netdev_stats_to_stats64(storage, &dev->stats); } @@ -154664,7 +154999,7 @@ index 904ff43..050ec70 100644 return storage; } EXPORT_SYMBOL(dev_get_stats); -@@ -8014,7 +8014,7 @@ static void __net_exit netdev_exit(struct net *net) +@@ -8030,7 +8030,7 @@ static void __net_exit netdev_exit(struct net *net) kfree(net->dev_index_head); } @@ -154673,7 +155008,7 @@ index 904ff43..050ec70 100644 .init = netdev_init, .exit = netdev_exit, }; -@@ -8114,7 +8114,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list) +@@ -8130,7 +8130,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list) rtnl_unlock(); } @@ -154702,7 +155037,7 @@ index b94b1d2..da3ed7c 100644 EXPORT_SYMBOL(dev_load); diff --git a/net/core/filter.c b/net/core/filter.c -index e759d90..daa69dc 100644 +index bca32d6..5a27650 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -590,7 +590,11 @@ do_pass: @@ -156128,7 +156463,7 @@ index 71a52f4d..2bab905 100644 msg.msg_flags = flags; diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c -index a917903..b0bdff6 100644 +index cc701fa..473bb8c 100644 --- a/net/ipv4/ip_vti.c +++ b/net/ipv4/ip_vti.c @@ -44,7 +44,7 @@ @@ -156149,6 +156484,15 @@ index a917903..b0bdff6 100644 .kind = "vti", .maxtype = IFLA_VTI_MAX, .policy = vti_policy, +@@ -580,7 +580,7 @@ static int vti_device_event(struct notifier_block *unused, + return NOTIFY_DONE; + } + +-static struct notifier_block vti_notifier_block __read_mostly = { ++static notifier_block_no_const vti_notifier_block __read_only = { + .notifier_call = vti_device_event, + }; + diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c index 1d71c40..3f8a6fa 100644 --- a/net/ipv4/ipconfig.c @@ -156807,7 +157151,7 @@ index 42bf89a..adc7e6d 100644 write_pnet(&ireq->ireq_net, sock_net(sk_listener)); ireq->ireq_family = sk_listener->sk_family; diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 3708de2..2b40e93 100644 +index ba7ce3f..b106df6 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -88,6 +88,10 @@ int sysctl_tcp_tw_reuse __read_mostly; @@ -156821,7 +157165,7 @@ index 3708de2..2b40e93 100644 #ifdef CONFIG_TCP_MD5SIG static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key, __be32 daddr, __be32 saddr, const struct tcphdr *th); -@@ -1425,6 +1429,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb) +@@ -1431,6 +1435,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb) return 0; reset: @@ -156831,7 +157175,7 @@ index 3708de2..2b40e93 100644 tcp_v4_send_reset(rsk, skb); discard: kfree_skb(skb); -@@ -1592,12 +1599,19 @@ int tcp_v4_rcv(struct sk_buff *skb) +@@ -1598,12 +1605,19 @@ int tcp_v4_rcv(struct sk_buff *skb) lookup: sk = __inet_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th), th->source, th->dest, &refcounted); @@ -156854,7 +157198,7 @@ index 3708de2..2b40e93 100644 if (sk->sk_state == TCP_NEW_SYN_RECV) { struct request_sock *req = inet_reqsk(sk); -@@ -1687,6 +1701,10 @@ csum_error: +@@ -1693,6 +1707,10 @@ csum_error: bad_packet: __TCP_INC_STATS(net, TCP_MIB_INERRS); } else { @@ -156865,7 +157209,7 @@ index 3708de2..2b40e93 100644 tcp_v4_send_reset(NULL, skb); } -@@ -2425,7 +2443,7 @@ static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list) +@@ -2431,7 +2449,7 @@ static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list) inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET); } @@ -156957,7 +157301,7 @@ index debdd8b..7bcef89 100644 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) { /* Has it gone just too far? */ diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index e61f7cd..8206e7a 100644 +index 00d18c5..3e65784 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -87,6 +87,7 @@ @@ -157008,7 +157352,7 @@ index e61f7cd..8206e7a 100644 daddr = inet->inet_daddr; dport = inet->inet_dport; /* Open fast path for connected socket. -@@ -1199,7 +1216,7 @@ static unsigned int first_packet_length(struct sock *sk) +@@ -1199,7 +1216,7 @@ static int first_packet_length(struct sock *sk) IS_UDPLITE(sk)); __UDP_INC_STATS(sock_net(sk), UDP_MIB_INERRORS, IS_UDPLITE(sk)); @@ -157180,7 +157524,7 @@ index 542074c..648df74 100644 sizeof(XFRM_MODE_SKB_CB(skb)->flow_lbl)); diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 047c75a..bc3f19c 100644 +index 82e367b..1b4ae5e 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -179,7 +179,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = { @@ -157210,7 +157554,7 @@ index 047c75a..bc3f19c 100644 net->dev_base_seq; hlist_for_each_entry_rcu(dev, head, index_hlist) { if (idx < s_idx) -@@ -2596,7 +2596,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg) +@@ -2597,7 +2597,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg) p.iph.ihl = 5; p.iph.protocol = IPPROTO_IPV6; p.iph.ttl = 64; @@ -157219,7 +157563,7 @@ index 047c75a..bc3f19c 100644 if (ops->ndo_do_ioctl) { mm_segment_t oldfs = get_fs(); -@@ -4029,16 +4029,23 @@ static const struct file_operations if6_fops = { +@@ -4031,16 +4031,23 @@ static const struct file_operations if6_fops = { .release = seq_release_net, }; @@ -157244,7 +157588,7 @@ index 047c75a..bc3f19c 100644 } static struct pernet_operations if6_proc_net_ops = { -@@ -4657,7 +4664,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb, +@@ -4659,7 +4666,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb, s_ip_idx = ip_idx = cb->args[2]; rcu_read_lock(); @@ -157253,7 +157597,7 @@ index 047c75a..bc3f19c 100644 for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) { idx = 0; head = &net->dev_index_head[h]; -@@ -4870,7 +4877,7 @@ static inline size_t inet6_if_nlmsg_size(void) +@@ -4872,7 +4879,7 @@ static inline size_t inet6_if_nlmsg_size(void) + nla_total_size(inet6_ifla6_size()); /* IFLA_PROTINFO */ } @@ -157262,7 +157606,7 @@ index 047c75a..bc3f19c 100644 int items, int bytes) { int i; -@@ -4880,7 +4887,7 @@ static inline void __snmp6_fill_statsdev(u64 *stats, atomic_long_t *mib, +@@ -4882,7 +4889,7 @@ static inline void __snmp6_fill_statsdev(u64 *stats, atomic_long_t *mib, /* Use put_unaligned() because stats may not be aligned for u64. */ put_unaligned(items, &stats[0]); for (i = 1; i < items; i++) @@ -157271,7 +157615,7 @@ index 047c75a..bc3f19c 100644 memset(&stats[items], 0, pad); } -@@ -5337,7 +5344,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp) +@@ -5339,7 +5346,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp) rt_genid_bump_ipv6(net); break; } @@ -157280,7 +157624,7 @@ index 047c75a..bc3f19c 100644 } static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp) -@@ -5357,7 +5364,7 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write, +@@ -5359,7 +5366,7 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write, int *valp = ctl->data; int val = *valp; loff_t pos = *ppos; @@ -157289,7 +157633,7 @@ index 047c75a..bc3f19c 100644 int ret; /* -@@ -5380,7 +5387,7 @@ static +@@ -5382,7 +5389,7 @@ static int addrconf_sysctl_hop_limit(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos) { @@ -157298,7 +157642,7 @@ index 047c75a..bc3f19c 100644 int min_hl = 1, max_hl = 255; lctl = *ctl; -@@ -5396,7 +5403,7 @@ int addrconf_sysctl_mtu(struct ctl_table *ctl, int write, +@@ -5398,7 +5405,7 @@ int addrconf_sysctl_mtu(struct ctl_table *ctl, int write, { struct inet6_dev *idev = ctl->extra1; int min_mtu = IPV6_MIN_MTU; @@ -157307,7 +157651,7 @@ index 047c75a..bc3f19c 100644 lctl = *ctl; lctl.extra1 = &min_mtu; -@@ -5471,7 +5478,7 @@ int addrconf_sysctl_disable(struct ctl_table *ctl, int write, +@@ -5473,7 +5480,7 @@ int addrconf_sysctl_disable(struct ctl_table *ctl, int write, int *valp = ctl->data; int val = *valp; loff_t pos = *ppos; @@ -157316,7 +157660,7 @@ index 047c75a..bc3f19c 100644 int ret; /* -@@ -5536,7 +5543,7 @@ static int addrconf_sysctl_stable_secret(struct ctl_table *ctl, int write, +@@ -5538,7 +5545,7 @@ static int addrconf_sysctl_stable_secret(struct ctl_table *ctl, int write, int err; struct in6_addr addr; char str[IPV6_MAX_STRLEN]; @@ -157325,7 +157669,7 @@ index 047c75a..bc3f19c 100644 struct net *net = ctl->extra2; struct ipv6_stable_secret *secret = ctl->data; -@@ -5605,7 +5612,7 @@ int addrconf_sysctl_ignore_routes_with_linkdown(struct ctl_table *ctl, +@@ -5607,7 +5614,7 @@ int addrconf_sysctl_ignore_routes_with_linkdown(struct ctl_table *ctl, int *valp = ctl->data; int val = *valp; loff_t pos = *ppos; @@ -157334,7 +157678,7 @@ index 047c75a..bc3f19c 100644 int ret; /* ctl->data points to idev->cnf.ignore_routes_when_linkdown -@@ -5945,7 +5952,7 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name, +@@ -5947,7 +5954,7 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name, struct inet6_dev *idev, struct ipv6_devconf *p) { int i; @@ -157452,7 +157796,7 @@ index 776d145..69772ae 100644 .maxtype = IFLA_GRE_MAX, .policy = ip6gre_policy, diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 7b0481e..cd77386 100644 +index 888543d..bcc126c 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -80,7 +80,7 @@ static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2) @@ -157464,7 +157808,7 @@ index 7b0481e..cd77386 100644 static int ip6_tnl_net_id __read_mostly; struct ip6_tnl_net { -@@ -1992,7 +1992,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = { +@@ -1994,7 +1994,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = { [IFLA_IPTUN_ENCAP_DPORT] = { .type = NLA_U16 }, }; @@ -157611,10 +157955,10 @@ index e4347ae..c7654e7 100644 return -ENOMEM; } diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c -index 3ee3e44..2f70cc3 100644 +index 4086604..7a868ec 100644 --- a/net/ipv6/ping.c +++ b/net/ipv6/ping.c -@@ -242,6 +242,24 @@ static struct pernet_operations ping_v6_net_ops = { +@@ -247,6 +247,24 @@ static struct pernet_operations ping_v6_net_ops = { }; #endif @@ -157639,7 +157983,7 @@ index 3ee3e44..2f70cc3 100644 int __init pingv6_init(void) { #ifdef CONFIG_PROC_FS -@@ -249,13 +267,7 @@ int __init pingv6_init(void) +@@ -254,13 +272,7 @@ int __init pingv6_init(void) if (ret) return ret; #endif @@ -157654,7 +157998,7 @@ index 3ee3e44..2f70cc3 100644 return inet6_register_protosw(&pingv6_protosw); } -@@ -264,14 +276,9 @@ int __init pingv6_init(void) +@@ -269,14 +281,9 @@ int __init pingv6_init(void) */ void pingv6_exit(void) { @@ -157893,7 +158237,7 @@ index 45243bb..cdb398e 100644 struct ctl_table *ipv6_icmp_table; int err; diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 2255d2b..b1c03a4 100644 +index 889acc4..c4a32ab 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -101,6 +101,10 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb) @@ -157907,7 +158251,7 @@ index 2255d2b..b1c03a4 100644 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb) { return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32, -@@ -1274,6 +1278,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) +@@ -1280,6 +1284,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) return 0; reset: @@ -157917,7 +158261,7 @@ index 2255d2b..b1c03a4 100644 tcp_v6_send_reset(sk, skb); discard: if (opt_skb) -@@ -1386,12 +1393,20 @@ lookup: +@@ -1392,12 +1399,20 @@ lookup: sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th), th->source, th->dest, inet6_iif(skb), &refcounted); @@ -157940,7 +158284,7 @@ index 2255d2b..b1c03a4 100644 if (sk->sk_state == TCP_NEW_SYN_RECV) { struct request_sock *req = inet_reqsk(sk); -@@ -1481,6 +1496,10 @@ csum_error: +@@ -1487,6 +1502,10 @@ csum_error: bad_packet: __TCP_INC_STATS(net, TCP_MIB_INERRS); } else { @@ -158333,7 +158677,7 @@ index 8567366..7c8aa51 100644 irda_task_kick(task); } diff --git a/net/irda/iriap.c b/net/irda/iriap.c -index 4a7ae32a..bfe8e78 100644 +index 1138eaf..cb1900c 100644 --- a/net/irda/iriap.c +++ b/net/irda/iriap.c @@ -61,7 +61,7 @@ static const char *const ias_charset_types[] __maybe_unused = { @@ -158365,7 +158709,7 @@ index 4a7ae32a..bfe8e78 100644 } /* -@@ -215,8 +215,10 @@ EXPORT_SYMBOL(iriap_open); +@@ -219,8 +219,10 @@ EXPORT_SYMBOL(iriap_open); * Removes (deallocates) the IrIAP instance * */ @@ -158377,7 +158721,7 @@ index 4a7ae32a..bfe8e78 100644 IRDA_ASSERT(self != NULL, return;); IRDA_ASSERT(self->magic == IAS_MAGIC, return;); -@@ -942,7 +944,7 @@ void iriap_call_indication(struct iriap_cb *self, struct sk_buff *skb) +@@ -946,7 +948,7 @@ void iriap_call_indication(struct iriap_cb *self, struct sk_buff *skb) * Query has taken too long time, so abort * */ @@ -158800,27 +159144,6 @@ index 7eaa000..2fa7f35 100644 .notifier_call = iucv_cpu_notify, }; -diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c -index 0b68ba7..48613f5 100644 ---- a/net/kcm/kcmsock.c -+++ b/net/kcm/kcmsock.c -@@ -13,6 +13,7 @@ - #include <linux/socket.h> - #include <linux/uaccess.h> - #include <linux/workqueue.h> -+#include <linux/syscalls.h> - #include <net/kcm.h> - #include <net/netns/generic.h> - #include <net/sock.h> -@@ -2035,7 +2036,7 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) - if (copy_to_user((void __user *)arg, &info, - sizeof(info))) { - err = -EFAULT; -- sock_release(newsock); -+ sys_close(info.fd); - } - } - diff --git a/net/key/af_key.c b/net/key/af_key.c index f9c9ecb..060751e 100644 --- a/net/key/af_key.c @@ -161297,7 +161620,7 @@ index d3d50da..55e871e 100644 static int sctp_v4_protosw_init(void) diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c -index f69edcf..f015617 100644 +index 10bae22..1d96d9d 100644 --- a/net/sctp/sctp_diag.c +++ b/net/sctp/sctp_diag.c @@ -150,7 +150,7 @@ static int inet_sctp_diag_fill(struct sock *sk, struct sctp_association *asoc, @@ -161820,23 +162143,10 @@ index 9d88c62..53396b6 100644 #define gssx_dec_release_handle NULL #define gssx_enc_get_mic NULL diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c -index e085f5a..c947fa5 100644 +index 4605dc7..c947fa5 100644 --- a/net/sunrpc/auth_gss/svcauth_gss.c +++ b/net/sunrpc/auth_gss/svcauth_gss.c -@@ -569,9 +569,10 @@ gss_svc_searchbyctx(struct cache_detail *cd, struct xdr_netobj *handle) - struct rsc *found; - - memset(&rsci, 0, sizeof(rsci)); -- rsci.handle.data = handle->data; -- rsci.handle.len = handle->len; -+ if (dup_to_netobj(&rsci.handle, handle->data, handle->len)) -+ return NULL; - found = rsc_lookup(cd, &rsci); -+ rsc_free(&rsci); - if (!found) - return NULL; - if (cache_check(cd, &found->h, NULL)) -@@ -1141,7 +1142,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd, +@@ -1142,7 +1142,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd, uint64_t *handle) { struct rsc rsci, *rscp = NULL; @@ -161845,7 +162155,7 @@ index e085f5a..c947fa5 100644 long long ctxh; struct gss_api_mech *gm = NULL; time_t expiry; -@@ -1152,7 +1153,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd, +@@ -1153,7 +1153,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd, status = -ENOMEM; /* the handle needs to be just a unique id, * use a static counter */ @@ -162384,10 +162694,10 @@ index 0dd0224..36a22a0 100644 sub->evt.event = htohl(event, sub->swap); sub->evt.found_lower = htohl(found_lower, sub->swap); diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 735362c..49c97c7 100644 +index e444fa4..1e5a065 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c -@@ -919,6 +919,12 @@ static struct sock *unix_find_other(struct net *net, +@@ -920,6 +920,12 @@ static struct sock *unix_find_other(struct net *net, err = -ECONNREFUSED; if (!S_ISSOCK(inode->i_mode)) goto put_fail; @@ -162400,7 +162710,7 @@ index 735362c..49c97c7 100644 u = unix_find_socket_byinode(inode); if (!u) goto put_fail; -@@ -939,6 +945,13 @@ static struct sock *unix_find_other(struct net *net, +@@ -940,6 +946,13 @@ static struct sock *unix_find_other(struct net *net, if (u) { struct dentry *dentry; dentry = unix_sk(u)->path.dentry; @@ -162414,27 +162724,27 @@ index 735362c..49c97c7 100644 if (dentry) touch_atime(&unix_sk(u)->path); } else -@@ -960,13 +973,19 @@ static int unix_mknod(struct dentry *dentry, const struct path *path, umode_t mo - - err = security_path_mknod(path, dentry, mode, 0); +@@ -973,12 +986,19 @@ static int unix_mknod(const char *sun_path, umode_t mode, struct path *res) + */ + err = security_path_mknod(&path, dentry, mode, 0); if (!err) { -+ if (!gr_acl_handle_mknod(dentry, path->dentry, path->mnt, mode)) { ++ if (!gr_acl_handle_mknod(dentry, path.dentry, path.mnt, mode)) { + err = -EACCES; + goto out; + } - err = vfs_mknod(d_inode(path->dentry), dentry, mode, 0); + err = vfs_mknod(d_inode(path.dentry), dentry, mode, 0); if (!err) { - res->mnt = mntget(path->mnt); + res->mnt = mntget(path.mnt); res->dentry = dget(dentry); -+ gr_handle_create(dentry, path->mnt); ++ gr_handle_create(dentry, path.mnt); } } - ++ +out: + done_path_create(&path, dentry); return err; } - -@@ -2811,9 +2830,13 @@ static int unix_seq_show(struct seq_file *seq, void *v) +@@ -2798,9 +2818,13 @@ static int unix_seq_show(struct seq_file *seq, void *v) seq_puts(seq, "Num RefCount Protocol Flags Type St " "Inode Path\n"); else { @@ -162449,7 +162759,7 @@ index 735362c..49c97c7 100644 seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu", s, -@@ -2838,10 +2861,29 @@ static int unix_seq_show(struct seq_file *seq, void *v) +@@ -2825,10 +2849,29 @@ static int unix_seq_show(struct seq_file *seq, void *v) seq_putc(seq, '@'); i++; } @@ -162995,7 +163305,7 @@ index 94c7405..499cca4 100644 int cfg80211_wext_freq(struct iw_freq *freq); diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c -index dbb2738e..6a52210 100644 +index 6250b1c..91c4bc4 100644 --- a/net/wireless/wext-core.c +++ b/net/wireless/wext-core.c @@ -781,8 +781,7 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd, @@ -214594,6 +214904,56 @@ index 552705d..9920f4fb 100644 key = ima_hash_key(entry->digest); hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]); return 0; +diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c +index 5adbfc3..17a0610 100644 +--- a/security/keys/encrypted-keys/encrypted.c ++++ b/security/keys/encrypted-keys/encrypted.c +@@ -29,6 +29,7 @@ + #include <linux/rcupdate.h> + #include <linux/scatterlist.h> + #include <linux/ctype.h> ++#include <crypto/aes.h> + #include <crypto/hash.h> + #include <crypto/sha.h> + #include <crypto/skcipher.h> +@@ -478,6 +479,7 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload, + struct crypto_skcipher *tfm; + struct skcipher_request *req; + unsigned int encrypted_datalen; ++ u8 iv[AES_BLOCK_SIZE]; + unsigned int padlen; + char pad[16]; + int ret; +@@ -500,8 +502,8 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload, + sg_init_table(sg_out, 1); + sg_set_buf(sg_out, epayload->encrypted_data, encrypted_datalen); + +- skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, +- epayload->iv); ++ memcpy(iv, epayload->iv, sizeof(iv)); ++ skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv); + ret = crypto_skcipher_encrypt(req); + tfm = crypto_skcipher_reqtfm(req); + skcipher_request_free(req); +@@ -581,6 +583,7 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload, + struct crypto_skcipher *tfm; + struct skcipher_request *req; + unsigned int encrypted_datalen; ++ u8 iv[AES_BLOCK_SIZE]; + char pad[16]; + int ret; + +@@ -599,8 +602,8 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload, + epayload->decrypted_datalen); + sg_set_buf(&sg_out[1], pad, sizeof pad); + +- skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, +- epayload->iv); ++ memcpy(iv, epayload->iv, sizeof(iv)); ++ skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv); + ret = crypto_skcipher_decrypt(req); + tfm = crypto_skcipher_reqtfm(req); + skcipher_request_free(req); diff --git a/security/keys/internal.h b/security/keys/internal.h index a705a7d..898c675 100644 --- a/security/keys/internal.h diff --git a/4.7.4/4425_grsec_remove_EI_PAX.patch b/4.7.5/4425_grsec_remove_EI_PAX.patch index ba92792..ba92792 100644 --- a/4.7.4/4425_grsec_remove_EI_PAX.patch +++ b/4.7.5/4425_grsec_remove_EI_PAX.patch diff --git a/4.7.4/4427_force_XATTR_PAX_tmpfs.patch b/4.7.5/4427_force_XATTR_PAX_tmpfs.patch index b4714fc..b4714fc 100644 --- a/4.7.4/4427_force_XATTR_PAX_tmpfs.patch +++ b/4.7.5/4427_force_XATTR_PAX_tmpfs.patch diff --git a/4.7.4/4430_grsec-remove-localversion-grsec.patch b/4.7.5/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/4.7.4/4430_grsec-remove-localversion-grsec.patch +++ b/4.7.5/4430_grsec-remove-localversion-grsec.patch diff --git a/4.7.4/4435_grsec-mute-warnings.patch b/4.7.5/4435_grsec-mute-warnings.patch index 8929222..8929222 100644 --- a/4.7.4/4435_grsec-mute-warnings.patch +++ b/4.7.5/4435_grsec-mute-warnings.patch diff --git a/4.7.4/4440_grsec-remove-protected-paths.patch b/4.7.5/4440_grsec-remove-protected-paths.patch index 741546d..741546d 100644 --- a/4.7.4/4440_grsec-remove-protected-paths.patch +++ b/4.7.5/4440_grsec-remove-protected-paths.patch diff --git a/4.7.4/4450_grsec-kconfig-default-gids.patch b/4.7.5/4450_grsec-kconfig-default-gids.patch index e892c8a..e892c8a 100644 --- a/4.7.4/4450_grsec-kconfig-default-gids.patch +++ b/4.7.5/4450_grsec-kconfig-default-gids.patch diff --git a/4.7.4/4465_selinux-avc_audit-log-curr_ip.patch b/4.7.5/4465_selinux-avc_audit-log-curr_ip.patch index 7248385..7248385 100644 --- a/4.7.4/4465_selinux-avc_audit-log-curr_ip.patch +++ b/4.7.5/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/4.7.4/4470_disable-compat_vdso.patch b/4.7.5/4470_disable-compat_vdso.patch index 0f82d7e..0f82d7e 100644 --- a/4.7.4/4470_disable-compat_vdso.patch +++ b/4.7.5/4470_disable-compat_vdso.patch diff --git a/4.7.4/4475_emutramp_default_on.patch b/4.7.5/4475_emutramp_default_on.patch index 2db58ab..2db58ab 100644 --- a/4.7.4/4475_emutramp_default_on.patch +++ b/4.7.5/4475_emutramp_default_on.patch |